How to count endpoint ACTUAL ACTIVITY by SQL query

[SAlasker]

Dears,

"ACTUAL ACTIVITY" graph under user card page in XDR is very amazing feature show the duration of user working hours. 

Unfortunately, the time was not specified with exact minuets. My management asks me a very accurate duration of how many hours the user was actively working last month to calculate his overtime.

Would you help me with SQL query will calculate the actual active working hours.

[aspatil]

Hello @SAlasker ,

Thanks for reaching out on LiveCommunity!

You cannot fetch the required information using XQL. This is ITDR feature .

Hope this helps!

Regards,

Ashutosh