Patent ID: 9680938
Date: 2017-06-13
CPC Classifications: H04L

Claim:
1. A method, performed by a computer system comprising one or more computing devices, for associating IT activity events with user logon sessions in order to track user activity during a logon session, including device accesses and user account switches, the method comprising: for each user logged onto the network, maintaining on a storage device a logon session state for the user that reflects events, host devices, and user accounts associated with the user during the logon session, wherein a logon session begins at a user's logon to the network and ends at the user's logout or a specified period of inactivity; for each host device in the network, maintaining on a storage device a device state that reflects all users logged onto the host device and the user accounts used to logon to the host device; performing the following steps on the one or more computing devices: