AnsweredAssumed Answered

Windows Off Hours Logins Report

Question asked by Ornaldo Naqellari on Jan 11, 2019
Latest reply on Jan 14, 2019 by Ornaldo Naqellari

Hello,

I have created a build rule:

reference.id ='4624' && ec.activity="Logon" && device.type='winevent_nic' && logon.type !='3' && logon.type !='5'

Based on that rule i have created reports and schedule it to run daily at 23:45 so i can have activity from: 18:00 (

past day)  - 07:45 ( That day).
But i have noticed that i do not get the result correct. I now users that have been logged at 19:00
but there are not showing at report.

Please any advice ?

Outcomes