Query Help on Filter for Login Locations

Graylog Central (peer support)
1

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:

2. Describe your environment:

  • OS Information:

  • Package Version:

  • Service logs, configurations, and environment variables:

3. What steps have you already taken to try and solve the problem?

4. How can the community help?

I am trying to display results of users that have successfully logged into azure ad from mulitple Countries within the last 24 hours.

createdDateTime:[now-1d TO now] AND conditionalAccessStatus:success

Other fields our source_geo_country which is the country field.

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

2

source_geo_country is your key to count your values, to for “card()” which means differnt values. group by your users.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.