Custom XDR query to show a user login and log out daily

[MFlippin77]

Hi,

I'm trying to find a good query to pull not only the user login time but also a user logout in AD/AZ AD. I've been able to get the login data easy enough but I can't seem to pull a log OUT time/date or timeout. 

Does anyone have any suggestions? 

[nsinghvirk]

Hello @MFlippin77 

Thanks for reaching to LiveCommunity.

Please refer to below query and try build upon it. Currently it looks for event id 4634 for logoff events.

dataset = xdr_data
| filter event_type = ENUM.EVENT_LOG and action_evtlog_event_id = 4634