Can I review who last logged into a host in Crowdstrike?

Issue

I would like to see the who last logged into a particular host or a report of logon events for a host.

Environment

Crowdstrike

Resolution

View the username and login time of the last 10 user accounts to log in to a Windows or macOS device in the new User Info section of the host summary panel on the Host Management app. See Additional host details in Host Management and filters for deleted hosts for additional information.

Information can also be collected via API using the devices/combined/devices/login-history/v1 endpoint. See Crowdstrike APIs | Getting info about hosts for more information.

Detailed logon/login events can also be viewed from within the Investigate apy by browsing to  Reports → Visibility Reports → Logon Activities. See Viewing Logon Login Events for additional information.