topic Custom XDR query to show a user login and log out daily in Cortex XDR Discussions

Custom XDR query to show a user login and log out daily

MFlippin77 — Tue, 06 Jun 2023 17:31:45 GMT

Hi,

I'm trying to find a good query to pull not only the user login time but also a user logout in AD/AZ AD. I've been able to get the login data easy enough but I can't seem to pull a log OUT time/date or timeout.

Does anyone have any suggestions?

Re: Custom XDR query to show a user login and log out daily

nsinghvirk — Wed, 07 Jun 2023 15:24:39 GMT

Hello @MFlippin77

Thanks for reaching to LiveCommunity.

Please refer to below query and try build upon it. Currently it looks for event id 4634 for logoff events.

dataset = xdr_data
| filter event_type = ENUM.EVENT_LOG and action_evtlog_event_id = 4634