drop 4624 logon evtx csv · per-user hour histogram · z-score anomalies · heatmap · runs locally
4624 logons · optional 4625 for failed-logon correlation
drop security evtx csv with 4624 logons