Insight VM API for user accountability

I am looking for a way to report on the user’s last login date. The data is available in the nexpose core application but, somehow, this has been omitted from the API and the database schema. How does anyone report on such data, when it is not available?

Hi Keith,
Unfortunately, you are correct - last logon date is not accessible from the UI or console database at this time. It is accessible via the auth.log file on the console itself. Default location is /opt/rapid7/nexpose/nsc/logs/ and the line will contain the phrase “Authentication attempt succeeded”

As an example, from my test system, I have a user called steve and from the console it shows:
image

Looking at the auth.log, the corresponding login line follows:
2021-08-11T21:32:59 [INFO] [Thread: http-nio-3780-exec-5=/api/1.1/xml] [Principal: steve] Authentication attempt succeeded.

Note that the log timestamp entries are in GMT.
Hope this helps,
Steve