Query Details
Not Logged In
Query
//With UEBA enabled, look for users that have not logged in BehaviorAnalytics | where UsersInsights.IsDormantAccount == true
Explanation
This query is looking for users who have not logged in when User and Entity Behavior Analytics (UEBA) is enabled.
Details
Rod Trent
Released: August 2, 2021
Tables
BehaviorAnalytics
Keywords
BehaviorAnalytics,UsersInsights,IsDormantAccount
Operators
where==