Which Account Went Somewhere It Never Had Before LOGON
A network logon is not suspicious. One account touching eleven machines in four minutes, having touched two all month, is. That is a fact about a set, not about any line in it.
The log
Anything that produced a CSV will do: an EVTX conversion, a SIEM export, a Get-WinEvent pipeline. Accounts ending in a dollar sign are computers rather than people and are left out, because there are tens of thousands of them and they bury everything that matters. A domain’s authentication log is a complete map of who can reach what; this one is read here and goes nowhere.
What the log has in it
Reaching many hosts at once
The baseline is everything before the last few days; the test is everything after. A row marked new ground reached hosts it had never reached in the baseline, and that is the finding — an administrator who logs into forty servers every day is not interesting, the forty-first is. Almost every tool gets this backwards by alerting on volume, which is why they get switched off within a fortnight.
The logon types in this log
The whole analysis
Questions people ask about LOGON