Current activities - Live users; is it possible to save current users ?

Hi Petr Odvarka 

Sophos Firewall will show the Live User list of the users authenticated with the firewall.

Live users tab in STAS software will display the users authenticate via STAS in AD server.

WMI query is a polling method to check for Logoff detection.

Authentication logs available in Log viewer

Windows security logs include all authentication logs performed on AD server.

Please share the use case behind your requirement, there is no feature available to compare them or save them.

Hello Keyur,

info about WMI and AD security logs was just for explanation of my intent. I am able to pre-set tool for comparing. But I need to have input data in some usable form.

To get data from XG or STAS console I need to save list of users. But I not see button "save the list" in neither tool. Is there any other possibility how to do it ? For instance REST API  for XG ? If so, what string to use ?

Best regards,

Petr

Hi Petr Odvarka 

You can export user list- https://community.sophos.com/kb/en-us/133982

STAS does not have such a feature to export users.

Hello Keyur,

please, can you explain me how export of all users from section :

Configure - Authentication - Users

will help me ?

I need to export list of currently alive users from section :

Monitor & Analyze - Current activities - Live users

Best regards,

Petr

Hello Keyur,

please, can you explain me how export of all users from section :

Configure - Authentication - Users

will help me ?

I need to export list of currently alive users from section :

Monitor & Analyze - Current activities - Live users

Best regards,

Petr

Hi Petr Odvarka 

Unfortunately, there is no mechanism/feature available to export Live Users.

You can export users as described in the KB article provided.

Or you can go to Backup & Firmware >> Import export >> Export >> Export selective configuration >> Search for User and it will download each user in XML format file available in the firewall but not to specific only live user, you can submit your idea to https://ideas.sophos.com/