Winlogbeat/Kibana how to visualize a user logon time over 1 month?

[Loggeruk (Gary)]

Hi all,

I am trying to visualize in some way the first initial logon time for a user each day over a month, is this possible ? everything just seems to be based on count and i cant figure out the best way to do it.

eg - graph with each date for the month and a time shown on the chart or something similar.

Thanks

[bhavyarm]

@Marius_Dragomir please?

Thanks,
Bhavya

[Marius_Dragomir]

Hi Gary,

1. First of all, make sure you have winlogbeat run with admin permissions, otherwise the Security events won't be collected.
2. Create a scripted field called hour_of_day with the following value:

doc["@timestamp"].value.getMinuteOfDay() 

Set the Type to Number, the format to Duration, Input format to Minutes, Output format to Hours. There is a small hitch here, as it will show the time with decimal points for Hours instead of minutes, I've added an issue to make this more useful. https://github.com/elastic/kibana/issues/26128
3. Create a visualization (i used a bar chart), with the following settings:

• enter event_id:4624 in the search bar or as a filter: this is the event ID for all successful logons in Windows.
• On the Y-Axis set to Top hit aggregation, on the field hour_of_day, with Aggregate on set to Min, Size set to 1,Sort onset to @timestamp field,Order` as ascending.
• On the X-Axis, set to a Date Histogram, on the @timestamp field, with a Daily interval.

Optional, you can split the series with a Terms aggregation, on the user.name field to show the top X users (as many as you set in the Size field), or even better, do a Filter aggregation instead of terms and add a filter for each user that you're interested in, something like this:

You can see how this chart would look over here:

You can get ideas for more cool stuff to do with the Winlogbeat data from this blog post: https://www.elastic.co/blog/monitoring-windows-logons-with-winlogbeat

[Loggeruk (Gary)]

Thank you, I'm very new to Elastic Search so i had to work out how to add a scripted field but once done the chart has worked perfectly, thanks !