Right now I am struggling to identify the working hours of user by Application based on Change or Authentication datamodel.
the main objective is to determine the standard working time of each user, and if that user perform any activities outside of that working time then alert will trigger.
Below are the queries :- | tstats `summariesonly` c as changes_count earliest(_time) as et latest(_time) as lt from datamodel=Change by All_Changes.user All_Changes.vendor_product index _time span=1d | `drop_dm_object_name(All_Changes)` | eval time_diff=((lt-et)/60/60) | search time_diff!=0 | convert ctime(et) ctime(lt)
| tstats `summariesonly` values(Authentication.signature) as signature values(sourcetype) as sourcetype latest(_time) as lt earliest(_time) as et from datamodel=Authentication.Authentication where (Authentication.is_Successful_Authentication=1) by Authentication.user Authentication.app index _time span=1d | `drop_dm_object_name("Authentication")` | eval time_diff=((lt-et)/60/60) | convert ctime(lt) ctime(et) | dedup user
Now real challenge is time, some user works in different timezones and some might be working overnight.