Thank you everyone for commenting. I have pre-defined location already based on the first two octets of the IP address schema. I thought there would be a way to identify location in that manner. Example    Log in attempt from user1 from 192.168.x.x means they are coming from Texas  Log in attempt from user2 from 172.168.x.x mean they are coming from California.    Rember this are examples and I totally understand their local IP and geo tagging might not be possible since there internal IP. In this example we know the first two octas indicated California or Texas.  The idea is to have a dashboard for Linux users that shows a map of Authentication user taking place based on IP address. There is only two IP address scheme we are dealing with and only two locations in this example each corresponding to the location in the example 192.168.x.x is Texas and 172.168.x.x is California. Hope this helps:) Something like the below image:       ... View more

I was hoping to get some help, in modifying the query above. I got an Index and a source type for my windows environment. I would like to see the following:  - Authentication PackagesName  = This looks to shows the type of Authentication taking place like NTLM, Kerberos, MFA, etc.... I need this to show for each user  (Windows Authentication Technical Overview | Microsoft Learn) - Logon Type = used by Windows to shows successful login and failers logs like (4624, 4625, 4648) and should have a count related to the above attribute  (Windows Logon Scenarios | Microsoft Learn) - LogonProcessName = The process name for the authentication action taking place for the user  PS. The idea here it sees what Authentication action is taking place for each user so I can say yea there are using NTLM or Kerberos to access this host or resource. Thanks again Community!!!! ... View more