event_simpleName=UserLogoff Falcon sensor event

UserLogoff: CrowdStrike Logoff Event and Session Length Queries

Published

The end of a logon session on a host — which account, which logon type, when the session started and ended — so a UserLogon can be turned into a session with a length.

Fields that matter in an investigation

FieldWhat it tells you
UserName Panther FDR schema · CrowdStrike queries The account whose session ended.
UserSid Panther FDR schema SID of the account (Windows).
AuthenticationId Panther FDR schema The Windows logon session ID. The UserLogon that opened the session carries the same value on the same host.
LogonType Panther FDR schema · CrowdStrike queries The session's logon type — 2 interactive, 3 network, 10 remote desktop — as in UserLogon.
LogonTime Panther FDR schema When the session began, in Unix epoch seconds.
LogoffTime Panther FDR schema When it ended, in Unix epoch seconds. LogoffTime minus LogonTime is the session length.
UserLogoffType Panther FDR schema How the sensor learned the session ended — Panther's schema lists 1 LOGOFF_EVENT_SOURCE, 2 LOGOFF_PROFILE_UNLOAD, 3 ETW and 4 SYNTHETIC.
RemoteAddressIP4 CrowdStrike queries For remote sessions, the client's address; CrowdStrike's search-by-address dashboard looks for it here too.
ComputerName Panther FDR schema · CrowdStrike queries The host the session was on.
aid Panther FDR schema · CrowdStrike queries Sensor ID of the host.
All 16 documented UserLogoff fields, besides the generic sensor fields
  • AuthenticationIdPanther FDR schema
  • EffectiveTransmissionClassPanther FDR schema
  • LogoffTimePanther FDR schema
  • LogonTimePanther FDR schema
  • LogonTypePanther FDR schema · CrowdStrike queries
  • PasswordLastSetPanther FDR schema
  • RawProcessIdPanther FDR schema
  • RemoteAddressIP4CrowdStrike queries
  • UIDPanther FDR schema
  • UserGroupsBitmaskPanther FDR schema
  • UserIsAdminPanther FDR schema
  • UserLogoffTypePanther FDR schema
  • UserLogonFlagsPanther FDR schema
  • UserNamePanther FDR schema · CrowdStrike queries
  • UserPrincipalPanther FDR schema
  • UserSidPanther FDR schema

Panther's generic schema for all Falcon Data Replicator events adds the sensor and context fields (not every event type fills each one): ComputerName, ConfigBuild, ConfigStateHash, ContextProcessId, ContextThreadId, ContextTimeStamp, Entitlements, FileName, FilePath, InContext, TargetProcessId, TreeId, aid, aip, cid, event_platform, event_simpleName, id, name, timestamp.

What the numbers mean

These fields hold numbers that the Falcon console turns into words. The tables are CrowdStrike's own, from the decoding transforms in its public LogScale content repository, shown as published.

AuthenticationId source ↗︎

0 Invalid Luid
996 Network Service
997 Local Service
999 System
1000 Reserved Luid Max

LogonType source ↗︎

0 System
2 Interactive
3 Network
4 Batch
5 Service
6 Proxy
7 Unlock
8 Network Cleartext
9 New Credential
10 Remote Interactive
11 Cached Interactive
12 Cached Remote Interactive
13 Cached Unlock

What it records

UserLogoff marks the end of a logon session. It names the account (UserName, UserSid, UserPrincipal), the session’s LogonType, and two times in Unix epoch seconds: LogonTime, when the session began, and LogoffTime, when it ended. AuthenticationId is the Windows logon session ID, the same value the UserLogon that opened the session carries, and the same value processes started in the session carry in ProcessRollup2. For remote sessions, RemoteAddressIP4 holds the client’s address; CrowdStrike’s search-by-address dashboard includes UserLogoff among the events it searches for an address.

Panther documents UserLogon and UserLogoff with one shared schema, so both list the same account fields — UserIsAdmin, UserLogonFlags, PasswordLastSet — plus UserLogoffType, which records how the sensor learned of the end: the values are 1 LOGOFF_EVENT_SOURCE, 2 LOGOFF_PROFILE_UNLOAD, 3 ETW and 4 SYNTHETIC.

When it matters

A logoff is not suspicious on its own; its value is in turning logons into sessions with a start, an end and a length:

  • Remote desktop sessions. For LogonType 10, the length and timing of each session show whether a remote login was a quick check, a working day or something at 3 a.m. Short sessions from a new address with a burst of process activity in between are typical of hands-on intrusions.
  • Scoping. Everything an intruder did interactively happened between the logon and the logoff of their session. The two times bound the window to search for processes, connections and file writes on that host.
  • Shared and service accounts. Overlapping sessions for one account on several hosts, or sessions far longer than anyone works, point at shared or stolen credentials.

How to investigate

  1. Take the session’s aid and AuthenticationId from the UserLogon or UserLogoff and compute the length from LogonTime and LogoffTime.
  2. Search ProcessRollup2 events on the same aid with that AuthenticationId between the two times — that is what ran in the session.
  3. For remote sessions, check RemoteAddressIP4 against VPN ranges and the IP blocklist checker.
  4. Compare session lengths and hours with the account’s usual pattern.

Remote desktop sessions per user and client address, with the longest session in minutes, in Falcon’s event search:

#event_simpleName=UserLogoff event_platform=Win LogonType=10
| SessionMinutes := (LogoffTime - LogonTime) / 60
| groupBy([aid, ComputerName, UserName, RemoteAddressIP4], function=[count(as=Sessions), max(SessionMinutes, as=LongestMinutes)], limit=max)
| sort(Sessions, order=desc)

The same over Falcon Data Replicator data in Splunk (add your index):

sourcetype="crowdstrike:events:sensor" event_simpleName=UserLogoff LogonType=10
| eval SessionMinutes=round((LogoffTime - LogonTime) / 60, 1)
| stats count AS Sessions, max(SessionMinutes) AS LongestMinutes by aid, UserName, RemoteAddressIP4
| sort - Sessions

The CrowdStrike field reference covers the export format, and the free log analyzer reads Falcon exports in the browser.

Where these facts come from

CrowdStrike's event dictionary sits behind the Falcon console login, so the field list above is assembled from public sources that agree with one another, and checked on every build:

A field counts as documented when Panther or Splunk lists it for this event, or when at least two of CrowdStrike's query files read it from this event alone. The explanations are LogTriage's own.

Related events

Frequently Asked Questions

How do I match a UserLogoff to the UserLogon that started the session?
Use the same aid and AuthenticationId, the Windows logon session ID, which both events carry. The logoff record also has LogonTime, the start of the session, so for a session length you often do not need the logon event at all; subtract LogonTime from LogoffTime, both in epoch seconds.
What does UserLogoffType mean?
It names how the sensor learned that the session ended. Panther's schema for Falcon Data Replicator lists four values, 1 LOGOFF_EVENT_SOURCE, 2 LOGOFF_PROFILE_UNLOAD, 3 ETW and 4 SYNTHETIC; CrowdStrike's own descriptions are behind the console login. For an investigation the times and the account matter more than this field.
Why does a UserLogon have no matching UserLogoff?
The session may still be open, or the host may have shut down, crashed or gone offline before the sensor reported the end. Treat a missing logoff as an unknown end, not as proof that someone is still connected, and check for later activity in that session through ProcessRollup2 and AuthenticationId.

Find every UserLogoff in your own Falcon export

Load a Falcon Data Replicator or event-stream export into the free browser analyzer: suspicious command lines, LSASS access, logon failures, reverse-shell ports and Falcon's own detections are flagged, with event names linked to their pages here. Nothing is uploaded.

Open the free analyzer → Analyze your own logs

Investigating something right now? LogTriage checks every address in the file against threat intelligence and writes the incident report: 10 analyses a month free. The incident pack adds the in-depth AI analysis and files up to 100 MB: 25 analyses for $19, one payment, no subscription. Pricing