Not Logged In
Query
//With UEBA enabled, look for users that have not logged in
BehaviorAnalytics
| where UsersInsights.IsDormantAccount == trueExplanation
This query is looking for users who have not logged in when User and Entity Behavior Analytics (UEBA) is enabled.
Details
Rod Trent
Released: August 2, 2021
Tables
BehaviorAnalytics
Keywords
BehaviorAnalyticsUsersInsightsIsDormantAccount
Operators
where==