endpoint-login
June 15, 2026 · View on GitHub
Description
A user logged into an endpoint
Parameters
| Parameter | Value |
|---|---|
| Subject | endpoint |
| Activity | login |
| Activity Type | endpoint-login |
| Pretty Name | Endpoint Login |
Legacy Names
| Success | Fail |
|---|---|
| local-logon remote-logon batch-logon kerberos-logon ntlm-logon service-logon remote-access computer-logon nac-logon authentication-successful | local-logon remote-logon batch-logon kerberos-logon ntlm-logon service-logon remote-access computer-logon failed-logon nac-failed-logon authentication-failed |
Fields
The possible fields for this activity type will vary depending on whether the activity was a success or a fail.
endpoint-login:success
| Field | Core | Detection | Informational |
|---|---|---|---|
| tgs_service_name | ✓ | ||
| src_mac | ✓ | ||
| source_user_entity_id | |||
| account_domain | ✓ | ||
| login_type | ✓ | ||
| domain_user_name | |||
| src_host | ✓ | ||
| subject_sid | ✓ | ||
| logon_type | ✓ | ||
| dest_zone | |||
| src_ip | ✓ | ||
| account_user_name | |||
| login_type_text | ✓ | ||
| src_zone | |||
| domain | ✓ | ||
| dest_ip | ✓ | ||
| result_code | ✓ | ||
| location | ✓ | ||
| user | ✓ | ✓ | |
| account | ✓ | ||
| cid | ✓ |
endpoint-login:fail
| Field | Core | Detection | Informational |
|---|---|---|---|
| src_mac | ✓ | ||
| failure_code | ✓ | ||
| source_user_entity_id | |||
| account_domain | ✓ | ||
| login_type | ✓ | ||
| domain_user_name | |||
| failure_reason | ✓ | ||
| src_host | ✓ | ||
| subject_sid | ✓ | ||
| logon_type | ✓ | ||
| dest_zone | |||
| src_ip | ✓ | ||
| account_user_name | |||
| login_type_text | ✓ | ||
| src_zone | |||
| domain | ✓ | ||
| dest_ip | ✓ | ||
| result_code | ✓ | ||
| location | ✓ | ||
| user | ✓ | ✓ | |
| account | ✓ | ||
| cid | ✓ |