cortex XDR XQL "xdr_event_log" "var/log/secure" and "var/log/wtmp"

[frank.f.lu]

Cortex XDR 

Dear all,

Does anyone know the log source for action_evtlog_provider_name = "var/log/wtmp"? As I know, wtmp is last log as follow:

However, I find that the result is not only wtmp log but also secure successful log in cortex XDR:

So does anyone know the real log source for "var/log/wtmp" or the mechanism? Thanks a lot!

[nsinghvirk · Accepted solution]

Hello @frank.f.lu 

Thanks for reaching out on LiveCommunity!

"var/log/wtmp" contains the historical data regarding user login and logout events. For more details please refer linux documentation.