How do I pull together a chart of all our user accounts, with the last time that user logged in?
I currently have:
eventtype=wineventlog_security (EventCode=4776 OR EventCode=4777 OR EventCode=680 OR EventCode=681) | stats max(Time) by Logon_Account
I am getting the time but also need to display the date. I am also getting a lot of service accounts, is there an easy way to filter those out?
@ctaylor3819 Try using the below query for the date and time:
eventtype=wineventlog_security (EventCode=4776 OR EventCode=4777 OR EventCode=680 OR EventCode=681)
| stats latest(_time) as Latest_Time by Logon_Account
| convert ctime(Latest_Time)
In order to filter the users you can you a lookup file containing the list of users you want to get or the list of genuine users and use a lookup command to get only those users.
Also, If this reply helps you, an upvote would be appreciated.