Logon session terminated. Does not fire for interactive logoffs (see 4647). Primarily covers network and service logons.
Session duration anomalies (4624 to 4634 delta) can reveal long-running remote sessions. High volume — do not alert individually.
Use 4624+4634 pairs to compute session duration. Sessions >24 h from external IPs warrant review. No standalone alerting.
TargetUserNameLogonTypeTargetLogonId Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4634 // An account was logged off
| project TimeGenerated, Computer, TargetUserName, LogonType, TargetLogonId
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Security" EventCode=4634
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# An account was logged off — add EventData fields: TargetUserName, LogonType, TargetLogonId`
An account was logged off. Logon session terminated. Does not fire for interactive logoffs (see 4647). Primarily covers network and service logons.
Event 4634 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).
Use 4624+4634 pairs to compute session duration. Sessions >24 h from external IPs warrant review. No standalone alerting.