create report for only users that logged in 500 or more times

Wondering if I can make a report in repository viewer that shows all the logons for all users and machines but limits to only the users and machines that had 500 or more logons in the last 24 hours.

  • #1. InTrust used to have few SSRS Report like 'User Multiple Failed Logons' (Windows, Kerberous, NTLM) to analyse security threads.
    #2. ITSearch might be a better option today, because it is designed to do such an analyses against InTrust (native platform logs) and CA generated Logs.

    Aidar Karabalaev

  • Hi dblanchard1,

    Unfortunately there is no such option as cut less than 500, the reporting is quite simple in RV.
    But, there is some sort of workaround. You have to search for all such events in the last 24 hours, group by Who (or another field you want), and then in the group area right-click on "Who" and choose "Sort by Count". In the printed report you may just ignore the groups less than 500.
  • We, the InTrust team, like to provide a lot of options :) You can also user PowerBI to analyze data collected by InTrust, but you might need to do some data-massaging.

    https://www.quest.com/community/b/en/posts/using-intrust-sql-import-workflow-with-powerbi-saas-application 

    Maybe unless you are really in to this stuff, Igor's solution is more practical ;)