I am in the process of trying to create a search to identify when clients have MFA enabled / disabled. the purpose of this search is to include date, time, device info, geo location.... basically everything needed so if a account was compromised or MFA was disabled longer then what's allowed you I can document and take appropriate action with client.       Index=* source=security_logs AND incident_id=0365 AND action=disable AND authentication_type=MFA time>=24h | table user, ip_address, inbound/outbound, time, date, duration | iplocation ip_address | stats latest(time_enabled) as time_enabled | eval days_disabled=round((now()-time_enabled)/(60*60*24)) | table user, ip_address, inbound/outbound, time, date, duration, ip_city, ip_country, days_disabled ... View more