User Logon Activity
Table of all user logons.
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=UserLogon
| groupBy([UserName, name, aid, aip, ComputerName, event_platform, LocalIP, LogonDomain, LogonServer, LogonType], function=[count(@timestamp), selectLast([@timestamp])])
| table([@timestamp, UserName, ComputerName, aid, aip, event_platform, LocalIP, LogonDomain, LogonType], limit=20000)user_logon_activity.yml
T1078
ByteRay GmbH
Monitoring
Endpoint
Insight
2025-08-26
2025-08-26
