The table below describes each of the columns and their meaning in detail.
Column | Description | Possible Values | Possible Value Description |
|---|---|---|---|
Event Timestamp | Time stamp in the endpoint logs when the event was created | A timestamp | An ISO 8601/GMT timestamp when the event was created |
Category | The logon category of the event | local | A local logon |
rdp | A remote desktop logon | ||
network | A network logon | ||
network share | A logon to a network share | ||
ssh | A SSH logon | ||
service | A network service logon | ||
ard | Apple Remote Desktop | ||
wmi | Windows Management Instrumentation | ||
psexec | PsExec | ||
winrm | WinRM | ||
rpc | RPC | ||
ldap | LDAP | ||
unknown | unknown category type | ||
Type | The logon type of the event | unknown | Unknown logon type |
reconnect | An existing session used | ||
clear text | The logon used clear text credentials | ||
alternate credentials | The logon used alternate credentials | ||
cached | The logon used cached credentials | ||
automated | The logon was automated (batch, etc) | ||
service | The logon was performed by a service | ||
password | The logon was performed using a password | ||
public key | The logon was performed using a public key | ||
unknown user | The logon attempt was performed by an unknown user | ||
Status | The status of the logon | success | The logon succeeded |
failed | The logon failed | ||
unknown | It was unknown if the logon succeeded or not | ||
Src/Tgt Acct | The source or target account | An account name | The name of an account |
Src/Tgt Host | The source or target hostname | A host name | The host name of a computer |
Src/Tgt Addr | The source or target address | A IPv4 or IPv6 address | The IP address of a computer |
Tunneled (icon) | Was the logon tunneled | Checked (was tunneled) or blank | If the logon was determined to be tunneled or not. This is done by checking event data against known tunneled values. |
Path | Path to the executable, service, file or directory involved in the logon event. (Mouse over will provide additional detail based on the category and type of the logon | A path to an executable, service process, file, and directory | N/A |
CommandLine | Full command line if available | Full command line | N/A |
Context | Additional context based on the category and type of logon event | LDAP/WMI query, Service name, Share name and access | N/A |
Column | Description | Possible Values | Possible Value Description |
|---|---|---|---|
XAgent ID | The agent ID of the computer that sent the event | An alphanumeric value | N/A |
Xagt OS | An icon that displays the OS of the computer that generated the event | Penguin icon, Windows icon | N/A |
Cache Hits | A counter that shows how many times the event has been seen | A numeric value | N/A |