DC Kerberos Activity Viewer (TGT/TGS/Pre-Auth) | Cortex XDR

chiki briki@ekkor13

•updated Aug 22, 2026•35•0•56

Shows all Kerberos authentication activity on domain controllers - TGT requests, TGS requests, and pre-auth failures (4768/4769/4771). Good for hunting credential attacks, AS-REP roasting, weak encryption usage, and account lockout troubleshooting.