You can create a list of every endpoint and server that a compromised account accessed.
Use the Search username field to search for all activity associated with the compromised account.
In the graph view, every connected hexagon represents a system the account logged into or attempted to log into.
To compile a list of all unique hostnames and IP addresses, use the grid view. Filter or sort by the Src Host and Tgt Host columns. You can use the Export CSV function to save this list for your incident report.