endpoint-logout
April 24, 2024 · View on GitHub
Description
A user logged out of an endpoint
Parameters
| Parameter | Value |
|---|---|
| Subject | endpoint |
| Activity | logout |
| Activity Type | endpoint-logout |
| Pretty Name | Endpoint Logout |
Legacy Names
| Success | Fail |
|---|---|
| logout-remote winsession-disconnect |
Fields
The possible fields for this activity type will vary depending on whether the activity was a success or a fail.
endpoint-logout:success
| Field | Core | Detection | Informational |
|---|---|---|---|
| login_type | ✓ | ||
| domain | |||
| domain_user_name | |||
| logon_type | ✓ | ||
| user | ✓ | ✓ |
A failure activity is not currently supported for this activity-type.