This release of Logon Tracker is supported on Endpoint Security 5.0.1 and later with xAgent 35+ and earlier running on Windows, Linux, and macOS. For a full list of supported OS versions refer to, Endpoint Security Agent documentation.
Note
To upgrade from previous versions of Logon, follow the instructions provided in Installing the Logon Tracker Module on Installing Logon Tracker module
By default, Logon Tracker is configured to retain logon events (event age limit) from the past 30 days. When performing incident response or investigating historical lateral movement older than 30 days, the event age limit must be increased or set to “unlimited”. See Filtering settings for more information.