How to determine working duration of user on Change or Authentication datamodel?

[abhishekkalokhe]

Hello,

Right now I am struggling to identify the working hours of user by Application based on Change or Authentication datamodel.

the main objective is to determine the standard working time of each user, and if that user perform any activities outside of that working time then alert will trigger.

Below are the queries :-
| tstats `summariesonly` c as changes_count earliest(_time) as et latest(_time) as lt from datamodel=Change by All_Changes.user All_Changes.vendor_product index _time span=1d
| `drop_dm_object_name(All_Changes)`
| eval time_diff=((lt-et)/60/60)
| search time_diff!=0
| convert ctime(et) ctime(lt)


| tstats `summariesonly` values(Authentication.signature) as signature values(sourcetype) as sourcetype latest(_time) as lt earliest(_time) as et from datamodel=Authentication.Authentication where (Authentication.is_Successful_Authentication=1)  by Authentication.user Authentication.app index _time span=1d
| `drop_dm_object_name("Authentication")`
| eval time_diff=((lt-et)/60/60)
| convert ctime(lt) ctime(et) 
| dedup user


Now real challenge is time, some user works in different timezones and some might be working overnight.

[tscroggins]

@abhishekkalokhe 

Are you sure either model provides the information you need?

Change is intended to track state changes, which may include logging in and logging out, i.e. "create" session and "delete" session.

Authentication is intended to track independent authentication attempts.

Can you provide generalized examples of your input events?

[abhishekkalokhe]

@tscroggins 

I agree its difficult to find duration based on Authentication logs.

Ill try working with Change DM, can you provide me any general logic to identify duration/working time by User.