In GAT+ under the Audit section selects the ‘User Logins’ tab.
User Login – Events tab – provides an overview of all the Login events happening to your domain. It shows a Location on the Map where your users have been logging in.
It shows nice detailed view for the users and events occurred by their actions.
As usual, an Admin can filter through different search parameters just by clicking on the ‘Events’ and all other fields. This can be extracted into a spreadsheet just as easy.
A second report option ‘View by IP’ is also available. Click on this to see the history of events by IP address. This is very useful for attack analyses.
Each of the columns is sortable and each row has a click through the report for the detail behind the number.
Clicking on the ‘Negative’ Login IP shows the history of failed and suspicious logins for that account, with IP address and maps. This column is sortable domain-wide so you can quickly identify accounts under potential repeated attack.
Selecting the ‘Actions’ under the Login IP will show all the events for that IP address.
An Admin cal also checks the ‘Last login’ by users of your domain, by simply selecting ‘Users audit’ and sort by ‘Last login’ located under the ‘Basic’ tab.