# Elastic Agent - logged-in user and model

**URL:** <https://discuss.elastic.co/t/elastic-agent-logged-in-user-and-model/370689>\
**Category:** Elastic Agent\
**Tags:** elastic-stack-security, elastic-stack-alerting\
**Created:** [November 18, 2024, 11:33am UTC](https://discuss.elastic.co/t/elastic-agent-logged-in-user-and-model/370689 "2024-11-18T11:33:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Viktor\_Movita](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/viktor_movita/32/135707_2.png) [@Viktor\_Movita](https://discuss.elastic.co/u/Viktor_Movita)\
**Post date:** [November 18, 2024, 11:33am UTC](https://discuss.elastic.co/t/elastic-agent-logged-in-user-and-model/370689/1 "2024-11-18T11:33:35Z")

</div>

Hello,  
I'm asking here because I couldn't find a definitive answer in the documentation.  
I am running an Elastic Agent on workstations. Does the agent have the capability to collect the currently logged-in user and the model of the workstation?  
The agent is managed by a Fleet server.

Thank you.

---

<div class="post-metadata">

**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\
**Post date:** [November 19, 2024, 8:27am UTC](https://discuss.elastic.co/t/elastic-agent-logged-in-user-and-model/370689/2 "2024-11-19T08:27:14Z")

</div>

Yes, if you add the [osquery manager integration](https://www.elastic.co/docs/current/en/integrations/osquery_manager) you can schedule a query (or run it manually when needed) against your agent, policy or os type.

the query you need would be

```auto
select * from logged_in_users

```

[osquery reference](https://www.osquery.io/schema/5.14.1/#logged_in_users)