[ask] detect unsual login duration

[tkg_cangkul]

Hi,

Does metron support to do detection an unusual login duration?
For example.
IP A login for 3 days without logout. then metron will give some alert 
to us.

If this possible, how to do that?
Pls help.


Best Regards,

Tkg_cangkul