This section describes the various configuration settings provided in the Logon Tracker agent policy. The default settings are intended to support lateral movement investigation.
You should review your domain audit policy to ensure that success and failure logon events are being audited. The settings described in this section are only relevant if your domain policy is configured to capture the logon activity used by Logon Tracker. For more information, see the Logon data sources section
The following screenshot provides an overview of the key configuration options.
.png)