CrowdStrike - Get Login History for a Device

Updated on 02 Apr 2025
1 Minute to read

Dark
Light
PDF

Article summary

Did you find this summary helpful?

Thank you for your feedback!

Description

CrowdStrike's Get Login History for a Device Automation enables organizations to quickly and easily monitor user logins and activities on their devices. This automation provides a comprehensive view of user login activity, including the date, time, and location of each login, as well as the user's IP address. This data can be used to detect potential security threats, identify suspicious user behavior, and track user activity for compliance purposes. Additionally, the automation can be configured to alert administrators when a user logs in from an unexpected location or with an unrecognized IP address. With this automation, organizations can gain a better understanding of their user activity and ensure that their systems remain secure.

Trigger Request

HTTP Post Request
Headers:

Key	Value
Content-Type	application/json

Json body parameters:

Parameters	Type	Description
access_token	string	Access token for the CrowdStrike API. Can be achieved by calling to CrowdStrike_Base_Token flow.
ids	array	An array of one or more device IDs to get their login history.

Supported CDC Versions

Was this article helpful?

What's Next

CrowdStrike - Incident Actions

Table of contents