NetworkSessions collector

The NetworkSessions collector gets information of currently open network sessions (connections made from a remote computer to a shared resource) on the device.

Important
In some Linux distributions (CentOS 7, Oracle Linux Server 7, and RHEL Desktop and Server 7), the net command is not available by default. You must install the samba-common-tools package by executing the following command: yum install samba-common-tools

Collector output

Field	Type	Description
computer	String	IP or host name of remote device.
user	String	User logged on to host through the network session.
client	String	Remote session command provider (Windows only).
file	String	Path of local resource being accessed by client (Windows only).
idletime	String	Time since last session activity (Windows only).

Supported versions

Windows	Linux	macOS
3.0 and later	3.0 and later	n/a

Example: Show which shared resources are being accessed by user name "owilde"

NetworkSessions where NetworkSessions user equals "owilde"

Network sessions by non-system drives or IPC$ shares

NetworkSessions computer, user, client, file
    WHERE NetworkSessions file not ends with "$"

Network sessions by CIFS share type

NetworkSessions computer, user, client, file
    WHERE NetworkSessions file equals "cifsshare"

Network sessions by specific user - single

NetworkSessions computer, user, client, file
    WHERE NetworkSessions user equals "alice"

Network sessions by specific user - many

NetworkSessions computer, user, client, file
    WHERE NetworkSessions user equals "alice"
        OR NetworkSessions user equals "bob"
        OR NetworkSessions user equals "frank"

Network sessions by source system - single

NetworkSessions computer, user, client, file
    WHERE NetworkSessions computer equals "PC1"