drop 4624 evtx · rdp logs · vpn logs · ssh logs · browser cookie databases · srum csv · build one unified session per user per day across all authentication sources · identify gaps · flag impossible sessions · runs locally
authentication sources
drop auth / session csvs
or click
Security 4624/4634 · TerminalServices · VPN · SSH auth.log · browser history · SRUM
drop 4624 evtx · rdp · vpn · ssh · browser history · srum csv