Forum Discussion
Solved
DeviceLogonEvents "LogonSuccess", "LogoffSuccess", "ScreenLock", "ScreenUnlock"
I'm trying to get "LogonSuccess", "LogoffSuccess", "ScreenLock", "ScreenUnlock" from the DeviceLogonEvent table but I am only seeing LogonSuccess. I'm wondering if I need to configure something in my...
It looks like these action types are not available in Defender XDR with the standard implementation.
The only action types I am finding with any device in the log are LogonAttempted, LogonFailed, LogonFailedAggregratedReport, LogonSuccess, LogonSuccessAggregratedReport. There are no other action types in the log. I feel like it must be an Intune or MDE policy issue where we are excluding the other action types by accident.
It looks like these action types are not available in Defender XDR with the standard implementation.