UDT User Session Tracking

What this query does

Track active user sessions and their network endpoint associations

SWQL Query

SELECT u.Username, u.Domain, ep.IPAddress, ep.MACAddress,
       ep.ConnectedTo, ep.LastSeen, ep.VLANId
FROM UDT.Users u
JOIN UDT.UserEndpoints ue ON u.UserID = ue.UserID
JOIN UDT.Endpoints ep ON ue.EndpointID = ep.EndpointID
WHERE ep.LastSeen >= ADDDATE('hour', -8, GETDATE())
ORDER BY ep.LastSeen DESC

UDT

user tracking

endpoints

security

Unlock the full POLARISNOC hub

AI-powered SWQL generation, script management, CVE tracking, and verified solution intelligence.