Analyze User Logon Patterns And Activity

Summarize user authentication events across the environment using the groupBy() function

Query

flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2["Expression"] 3@{ shape: win-pane, label: "Table" } result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> result

logscale

#event_simpleName=UserLogon
| groupBy([UserName, name, aid, aip, ComputerName, event_platform, LocalIP, LogonDomain, LogonServer, LogonType], function=[count(@timestamp), selectLast([@timestamp])])
| table([@timestamp, UserName, ComputerName, aid, aip, event_platform, LocalIP, LogonDomain, LogonType], limit=20000)

Introduction

The groupBy() function can be used to aggregate and analyze authentication events by grouping related logon information, providing insights into user access patterns and potential security anomalies.

In this example, the groupBy() function is used to analyze user logon events by aggregating authentication data across multiple systems, providing visibility into who is logging in, from where, and how often.

Example incoming data might look like this:

@timestamp	#event_simpleName	UserName	name	aid	aip	ComputerName	event_platform	LocalIP	LogonDomain	LogonServer	LogonType
2025-11-05T10:15:00Z	UserLogon	john.doe	John Doe	aid123	10.1.1.100	DESKTOP-001	Windows	192.168.1.10	CORP	DC01	2
2025-11-05T10:16:00Z	UserLogon	john.doe	John Doe	aid123	10.1.1.100	DESKTOP-001	Windows	192.168.1.10	CORP	DC01	2
2025-11-05T10:20:00Z	UserLogon	jane.smith	Jane Smith	aid124	10.1.1.101	LAPTOP-002	Windows	192.168.1.11	CORP	DC01	10
2025-11-05T10:25:00Z	UserLogon	admin.user	Admin User	aid125	10.1.1.102	SERVER-001	Windows	192.168.1.12	CORP	DC01	3
2025-11-05T10:30:00Z	UserLogon	jane.smith	Jane Smith	aid124	10.1.1.101	LAPTOP-002	Windows	192.168.1.11	CORP	DC01	10

Step-by-Step

Starting with the source repository events.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2["Expression"] 3@{ shape: win-pane, label: "Table" } result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
#event_simpleName=UserLogon
```
Filters events to include only user logon events where #event_simpleName equals UserLogon.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2["Expression"] 3@{ shape: win-pane, label: "Table" } result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> result style 2 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
| groupBy([UserName, name, aid, aip, ComputerName, event_platform, LocalIP, LogonDomain, LogonServer, LogonType], function=[count(@timestamp), selectLast([@timestamp])])
```
Groups logon events by multiple fields including user, system, and network information. For each group, it calculates two aggregate values:
- The total count of logon events using count(@timestamp).
- The most recent logon timestamp using selectLast([@timestamp]).
  Note that selectLast([@timestamp]) is equivalent to using max(@timestamp).
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2["Expression"] 3@{ shape: win-pane, label: "Table" } result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> result style 3 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
| table([@timestamp, UserName, ComputerName, aid, aip, event_platform, LocalIP, LogonDomain, LogonType], limit=20000)
```
Creates a table displaying key logon information, including timestamp, user details, system information, and logon type. The limit parameter is set to return up to 20,000 results.
Event Result set.

Summary and Results

The query is used to analyze user authentication patterns by aggregating logon events and providing a comprehensive view of user access across the environment.

This query is useful, for example, to identify unusual logon patterns, monitor privileged account usage, and track user access across different systems.

Sample output from the incoming example data:

@timestamp	UserName	ComputerName	aid	aip	event_platform	LocalIP	LogonDomain	LogonType	_count
2025-11-05T10:16:00Z	john.doe	DESKTOP-001	aid123	10.1.1.100	Windows	192.168.1.10	CORP	2	2
2025-11-05T10:30:00Z	jane.smith	LAPTOP-002	aid124	10.1.1.101	Windows	192.168.1.11	CORP	10	2
2025-11-05T10:25:00Z	admin.user	SERVER-001	aid125	10.1.1.102	Windows	192.168.1.12	CORP	3	1

Note that the _count field shows the number of logon events for each unique combination of grouped fields. The @timestamp shown is the most recent logon time for each group.

Different LogonType values indicate various authentication methods (for example, 2 for interactive, 3 for network, 10 for remote interactive).

The opposite query showing user logoff events might look like this:

logscale

#event_simpleName=UserLogoff
| groupBy([UserName, name, aid, aip, ComputerName, event_platform, LocalIP, LogonDomain, LogonServer, LogonType], function=[count(@timestamp), selectLast([@timestamp])])
| table([@timestamp, UserName, ComputerName, aid, aip, event_platform, LocalIP, LogonDomain, LogonType], limit=20000)

Examples Library