In this example, the groupBy() function is used to analyze user logon events by aggregating authentication data across multiple systems, providing visibility into who is logging in, from where, and how often.

Example incoming data might look like this:

The query is used to analyze user authentication patterns by aggregating logon events and providing a comprehensive view of user access across the environment.

This query is useful, for example, to identify unusual logon patterns, monitor privileged account usage, and track user access across different systems.

Sample output from the incoming example data:

Note that the _count field shows the number of logon events for each unique combination of grouped fields. The @timestamp shown is the most recent logon time for each group.

Different LogonType values indicate various authentication methods (for example, 2 for interactive, 3 for network, 10 for remote interactive).

The opposite query showing user logoff events might look like this:

#event_simpleName=UserLogoff
| groupBy([UserName, name, aid, aip, ComputerName, event_platform, LocalIP, LogonDomain, LogonServer, LogonType], function=[count(@timestamp), selectLast([@timestamp])])
| table([@timestamp, UserName, ComputerName, aid, aip, event_platform, LocalIP, LogonDomain, LogonType], limit=20000)

In this example, the groupBy() function is used with selectLast() to retrieve the latest information about AWS EC2 instances running CrowdStrike sensors, showing their platform, hostname, agent version, and when they were first seen, with a 14-day reference point for age comparison.

Example incoming data (raw data in sensor_metadata) might look like this:

The query is used to retrieve the latest information about AWS EC2 instances running CrowdStrike sensors, showing their platform, hostname, agent version, and when they were first seen, with a 14-day reference point for age comparison.

The query is useful, for example, for auditing EC2 instance coverage, identifying newly added EC2 instances within the last two weeks, monitoring sensor versions or identifying aging or outdated installations.

Sample output from the incoming example data:

Each aid appears only once with its most recent values. Note that TimeDelta value is based on the current date provided (Mon, 26 May 2025 13:06:56 GMT).

In this example, the selectLast() function is used to identify when data sources have stopped sending events by comparing the timestamp of the most recent event with the current time. The query calculates the elapsed time and formats an appropriate message based on whether the delay is in minutes, hours, or days.

A time window of 30 days is recommended to effectively identify stale data sources and calculate the appropriate time elapsed since the last event.

Example incoming data might look like this:

The query is used to monitor data freshness by calculating the time elapsed since the last event was received, providing appropriately formatted alerts based on the duration of inactivity.

This query is useful, for example, to create alerts for stale data sources, monitor data pipeline health, ensure continuous data ingestion, and identify potential issues with data collection or transmission.

Sample output from the incoming example data:

Note that it is recommended to set the time window for this search to 30 days to ensure proper detection of stale data sources. This extended window allows the query to find and report on data sources that have not sent data for extended periods, up to 30 days in the past.