Back to all events4770AuthenticationLast updated:
Kerberos service ticket renewed
What it means
An existing ticket was extended without re-authentication. Perfectly normal in long sessions.
First steps
- 1Usually noise — do not alert on it.
- 2Only interesting during an investigation: renewals from a host that should not hold the ticket.
Related events
This reference is a starting point for investigation, not a replacement for your organisation's security policy.