User Logoff Activity
Table of all UserLogoff events including UserName, ComputerName, aip, LocalIP and Domain.
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=UserLogoff
| groupBy([UserName, name, aid, aip, ComputerName, event_platform, LocalIP, LogonDomain, LogonServer, LogonType], function=[count(@timestamp), selectLast([@timestamp])])
| table([@timestamp, UserName, ComputerName, aid, aip, event_platform, LocalIP, LogonDomain, LogonType], limit=20000)user_logoff_activity.yml
T1078
ByteRay GmbH
Monitoring
Endpoint
Insight
2025-08-26
2025-10-30
