Which account went somewhere it never had before LOGON
A network logon is not suspicious. One account touching eleven machines in four minutes, having touched two all month, is. That is a fact about a set, not about any line in it.
The log
Anything that produced a CSV will do: an EVTX conversion, a SIEM export, a Get-WinEvent pipeline. Accounts ending in a dollar sign are computers rather than people and are left out, because there are tens of thousands of them and they bury everything that matters. A domain’s authentication log is a complete map of who can reach what; this one is read here and goes nowhere.
What the log has in it
Reaching many hosts at once
The baseline is everything before the last few days; the test is everything after. A row marked new ground reached hosts it had never reached in the baseline, and that is the finding: an administrator who logs into forty servers every day is not interesting, the forty-first is. Almost every tool gets this backwards by alerting on volume, which is why they get switched off within a fortnight.
The logon types in this log
The whole analysis
How it works
LOGON reads Windows logon events and finds the account that went somewhere it had never been before. It highlights new ground rather than volume, flags NTLM use, and tells password spraying apart from brute force. It points a person at what to check. The logs stay in this tab.
Doing this often? The Sovereign Console reads Windows event logs and the rest of the evidence into one case and timeline, with Sigma rules to hunt across them. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.