Press CTRL+K to open search

LoggedInUsers collector

  • Published on Sep 3, 2026
  • 1 minute(s) read
Prev Next

The LoggedInUsers collector gathers data about users logged into managed systems.

Collector output

Field

Type

Description

id

String

The user ID set by the operating system.

userdomain

String

The domain where the user belongs.

username

String

The logon user name.



Supported versions

Windows

Linux

macOS

3.0 and later

3.0 and later

3.0 and later



Example: Show users logged under the "RISK" domain
LoggedInUsers where LoggedInUsers userdomain equals "RISK"


Related articles
  • LoggedInUsers collector
    Endpoint Detection and Response with Forensics (EDRF) > Investigate potential threats with EDRF > Conduct searches > Search real-time data of endpoints for investigation and threat hunting > Collecting device data for real-time search > Built-in collectors
  • UserProfiles collector
    Endpoint Detection and Response (EDR) > Endpoint Detection and Response Product Guide > Collecting device data for real-time search > Built-in collectors
  • UserProfiles collector
    Endpoint Detection and Response with Forensics (EDRF) > Investigate potential threats with EDRF > Conduct searches > Search real-time data of endpoints for investigation and threat hunting > Collecting device data for real-time search > Built-in collectors