Data Visualisation for admin logins against time

[SwapnilC]

I want to visualise how many times admin users have logged in each day, for past month/ year. How to do this using performance analytics? Is there a table which stores the history of admin logins? 

These tables show only a week data: v_user_session, sys_user_session and sysevent

Thanks

[Mark Manders]

No, there is no such table. You could create one, if you want to. 

But you already gave your own answer: use PA. If you run it daily, you will get daily scores. And those scores will remain in the system, so you can run it on any of the tables you mentioned.

[JC Moller]

The data is available in your ServiceNow instance, and Performance Analytics metrics are already set up. All the requested features are ready.

To view the data:

• Open the ServiceNow Security Center on your instance

• Go to /now/security-center/my_security_metrics

• Click on "Privileged Identity" and then "Admin logins"

This will show you the security metrics you need.

The data is stored in the sn_vsc_login_event table. We have developed integrations that retrieve this and other security-related data into Splunk. The table also includes a user column that supports dot-walking, allowing you to create user or group specific reports. There is no table cleaner for this or other Security Center-specific tables, so data is retained indefinitely.

BR, Jan