Hi All, I'm interested in capturing user login events for use in user enrichment (associating a user with a source IP address). To this end, I'd like to capture user login events with the associated IP address. I had assumed this information would be available as part of Active Directory event data, but after discussion on https://issues.apache.org/jira/browse/METRON-161, it appears that my assumptions do not seem to hold.
Is there a source for this data that I should consider which might cover a large percentage of the field?
