// Investigation

Hunt console

Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.

hunt.queryREADY

Try

to run

Result profile

events match

Severity

Critical0
High0
Medium0
Low16
Info40

Applied filters

user = ivanov

Matches

Newest first.

Timestamp (UTC)	Severity	Event type	User	Source IP	Message
2026-09-04 18:23:38Z	Info	Authentication Success	ivanov	10.4.12.25	Kerberos TGT issued for ivanov from 10.4.12.25 (logon type 3)
2026-09-04 18:07:56Z	Info	Authentication Success	ivanov	10.4.12.37	Kerberos TGT issued for ivanov from 10.4.12.37 (logon type 3)
2026-09-04 16:59:50Z	Info	Cloud Api Call	ivanov	10.4.12.41	GetCallerIdentity by arn:aws:iam::4419:user/ivanov succeeded
2026-09-04 16:22:16Z	Low	Authentication Failure	ivanov	10.4.12.29	Pre-authentication failed for ivanov from 10.4.12.29 (status 0x18: bad password)
2026-09-04 14:34:10Z	Low	Authentication Failure	ivanov	10.4.12.37	Pre-authentication failed for ivanov from 10.4.12.37 (status 0x18: bad password)
2026-09-04 14:26:41Z	Low	Authentication Failure	ivanov	185.100.200.50	Pre-authentication failed for ivanov from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:23:29Z	Low	Authentication Failure	ivanov	185.100.200.50	Pre-authentication failed for ivanov from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:20:17Z	Low	Authentication Failure	ivanov	185.100.200.50	Pre-authentication failed for ivanov from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:17:05Z	Low	Authentication Failure	ivanov	185.100.200.50	Pre-authentication failed for ivanov from 185.100.200.50 (status 0x18: bad password)
2026-09-04 12:37:20Z	Info	Cloud Api Call	ivanov	10.4.12.35	ListBuckets by arn:aws:iam::4419:user/ivanov succeeded
2026-09-04 10:35:03Z	Info	Authentication Success	ivanov	10.4.12.22	Kerberos TGT issued for ivanov from 10.4.12.22 (logon type 3)
2026-09-04 09:17:49Z	Low	Authentication Failure	ivanov	10.4.12.38	Pre-authentication failed for ivanov from 10.4.12.38 (status 0x18: bad password)
2026-09-04 09:05:26Z	Info	Authentication Success	ivanov	10.4.12.39	Kerberos TGT issued for ivanov from 10.4.12.39 (logon type 3)
2026-09-04 08:09:54Z	Info	Authentication Success	ivanov	10.4.12.38	Kerberos TGT issued for ivanov from 10.4.12.38 (logon type 3)
2026-09-04 06:26:53Z	Info	Cloud Api Call	ivanov	10.4.12.33	GetCallerIdentity by arn:aws:iam::4419:user/ivanov succeeded
2026-09-04 04:29:23Z	Low	Authentication Failure	ivanov	10.4.12.24	Pre-authentication failed for ivanov from 10.4.12.24 (status 0x18: bad password)
2026-09-04 03:00:56Z	Info	Cloud Api Call	ivanov	10.4.12.36	DescribeSecurityGroups by arn:aws:iam::4419:user/ivanov succeeded
2026-09-04 02:30:56Z	Info	Cloud Api Call	ivanov	10.4.12.28	GetCallerIdentity by arn:aws:iam::4419:user/ivanov succeeded
2026-09-04 00:40:12Z	Info	Authentication Success	ivanov	10.4.12.41	Kerberos TGT issued for ivanov from 10.4.12.41 (logon type 3)
2026-09-03 22:33:37Z	Info	Authentication Success	ivanov	10.4.12.25	Kerberos TGT issued for ivanov from 10.4.12.25 (logon type 3)
2026-09-03 22:19:28Z	Low	Authentication Failure	ivanov	10.4.12.34	Pre-authentication failed for ivanov from 10.4.12.34 (status 0x18: bad password)
2026-09-03 22:07:35Z	Info	Authentication Success	ivanov	10.4.12.35	Kerberos TGT issued for ivanov from 10.4.12.35 (logon type 3)
2026-09-03 21:28:59Z	Info	Authentication Success	ivanov	10.4.12.26	Kerberos TGT issued for ivanov from 10.4.12.26 (logon type 3)
2026-09-03 20:15:42Z	Low	Authentication Failure	ivanov	10.4.12.36	Pre-authentication failed for ivanov from 10.4.12.36 (status 0x18: bad password)
2026-09-03 18:28:07Z	Info	Authentication Success	ivanov	10.4.12.41	Kerberos TGT issued for ivanov from 10.4.12.41 (logon type 3)
2026-09-03 18:05:43Z	Info	Authentication Success	ivanov	10.4.12.27	Kerberos TGT issued for ivanov from 10.4.12.27 (logon type 3)
2026-09-03 17:42:33Z	Info	Authentication Success	ivanov	10.4.12.32	Kerberos TGT issued for ivanov from 10.4.12.32 (logon type 3)
2026-09-03 17:17:23Z	Info	Authentication Success	ivanov	10.4.12.24	Kerberos TGT issued for ivanov from 10.4.12.24 (logon type 3)
2026-09-03 16:44:40Z	Info	Authentication Success	ivanov	10.4.12.35	Kerberos TGT issued for ivanov from 10.4.12.35 (logon type 3)
2026-09-03 16:38:14Z	Info	Cloud Api Call	ivanov	10.4.12.20	GetCallerIdentity by arn:aws:iam::4419:user/ivanov succeeded
2026-09-03 15:48:00Z	Info	Authentication Success	ivanov	10.4.12.36	Kerberos TGT issued for ivanov from 10.4.12.36 (logon type 3)
2026-09-03 15:21:25Z	Info	Cloud Api Call	ivanov	10.4.12.23	DescribeInstances by arn:aws:iam::4419:user/ivanov succeeded
2026-09-03 15:16:53Z	Info	Authentication Success	ivanov	10.4.12.39	Kerberos TGT issued for ivanov from 10.4.12.39 (logon type 3)
2026-09-03 14:41:42Z	Info	Authentication Success	ivanov	10.4.12.31	Kerberos TGT issued for ivanov from 10.4.12.31 (logon type 3)
2026-09-03 14:01:12Z	Info	Authentication Success	ivanov	10.4.12.42	Kerberos TGT issued for ivanov from 10.4.12.42 (logon type 3)
2026-09-03 13:41:13Z	Low	Authentication Failure	ivanov	10.4.12.33	Pre-authentication failed for ivanov from 10.4.12.33 (status 0x18: bad password)
2026-09-03 13:25:50Z	Info	Authentication Success	ivanov	10.4.12.37	Kerberos TGT issued for ivanov from 10.4.12.37 (logon type 3)
2026-09-03 13:25:27Z	Info	Cloud Api Call	ivanov	10.4.12.34	GetCallerIdentity by arn:aws:iam::4419:user/ivanov succeeded
2026-09-03 11:30:53Z	Info	Cloud Api Call	ivanov	10.4.12.23	ListBuckets by arn:aws:iam::4419:user/ivanov succeeded
2026-09-03 10:00:33Z	Info	Cloud Api Call	ivanov	10.4.12.40	GetCallerIdentity by arn:aws:iam::4419:user/ivanov succeeded
2026-09-03 09:46:43Z	Info	Authentication Success	ivanov	10.4.12.40	Kerberos TGT issued for ivanov from 10.4.12.40 (logon type 3)
2026-09-03 09:17:41Z	Info	Authentication Success	ivanov	10.4.12.20	Kerberos TGT issued for ivanov from 10.4.12.20 (logon type 3)
2026-09-03 06:51:38Z	Info	Authentication Success	ivanov	10.4.12.31	Kerberos TGT issued for ivanov from 10.4.12.31 (logon type 3)
2026-09-03 03:11:32Z	Info	Cloud Api Call	ivanov	10.4.12.27	ListBuckets by arn:aws:iam::4419:user/ivanov succeeded
2026-09-03 01:58:03Z	Low	Authentication Failure	ivanov	10.4.12.34	Pre-authentication failed for ivanov from 10.4.12.34 (status 0x18: bad password)
2026-09-03 00:20:38Z	Low	Authentication Failure	ivanov	10.4.12.30	Pre-authentication failed for ivanov from 10.4.12.30 (status 0x18: bad password)
2026-09-02 23:56:09Z	Info	Authentication Success	ivanov	10.4.12.38	Kerberos TGT issued for ivanov from 10.4.12.38 (logon type 3)
2026-09-02 23:10:52Z	Low	Authentication Failure	ivanov	10.4.12.41	Pre-authentication failed for ivanov from 10.4.12.41 (status 0x18: bad password)
2026-09-02 22:30:51Z	Info	Authentication Success	ivanov	10.4.12.36	Kerberos TGT issued for ivanov from 10.4.12.36 (logon type 3)
2026-09-02 21:48:26Z	Info	Authentication Success	ivanov	10.4.12.38	Kerberos TGT issued for ivanov from 10.4.12.38 (logon type 3)
2026-09-02 21:21:14Z	Low	Authentication Failure	ivanov	10.4.12.29	Pre-authentication failed for ivanov from 10.4.12.29 (status 0x18: bad password)
2026-09-02 21:07:23Z	Low	Authentication Failure	ivanov	10.4.12.34	Pre-authentication failed for ivanov from 10.4.12.34 (status 0x18: bad password)
2026-09-02 20:59:42Z	Info	Authentication Success	ivanov	10.4.12.34	Kerberos TGT issued for ivanov from 10.4.12.34 (logon type 3)
2026-09-02 19:25:10Z	Info	Authentication Success	ivanov	10.4.12.24	Kerberos TGT issued for ivanov from 10.4.12.24 (logon type 3)
2026-09-02 19:24:49Z	Info	Authentication Success	ivanov	10.4.12.25	Kerberos TGT issued for ivanov from 10.4.12.25 (logon type 3)
2026-09-02 19:17:15Z	Info	Authentication Success	ivanov	10.4.12.20	Kerberos TGT issued for ivanov from 10.4.12.20 (logon type 3)