Has anyone setup reporting for AD login/logout information? I have a customer who wants a report of when a user logs in and out every day.
Hello,
I personally have not used the reporting Enterprise feature .
Have you seen these?
https://docs.graylog.org/en/4.1/pages/auditlog/setup.html
https://docs.graylog.org/en/4.1/pages/reporting/setup.html
1 Like
As @gsmith mentioned, reporting is a Enterprise feature.
An alternative (free) way would be alerts and notification. You can find the event IDs for AD login/logoff (for the alert search query Alerts — Graylog 4.1.0 documentation) at the Microsoft Documentation webpage (e.g. Audit Logon (Windows 10) - Windows security | Microsoft Docs / Audit Logoff (Windows 10) - Windows security | Microsoft Docs).
1 Like
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.