User Activity

Twingate provides comprehensive visibility into user engagement and security through reporting in the Admin Console.

Admins can monitor granular authentication events to track successful and failed sign-in attempts to Twingate Client and Resource Policies. This new functionality allows teams to troubleshoot the root cause of connection issues such as IDP errors, device posture mismatches, or policy blocks while also providing a clear audit trail for MFA setup and reset actions. This data can be manually exported as a JSON file or synced to an S3 bucket.

In addition to event logging, Twingate offers an Active Users Report and an Inactive Users Report to help admins manage user counts and platform adoption. The Active Users Report details recent access timestamps, connection types, and failed attempts, while the Inactive Users Report automatically identifies accounts that haven’t accessed any Resources in the last 90 days. This data can be manually exported as a CSV file.

Exporting User Activity Report

To create an export:

1. Navigate to the Reports page under Settings

2. Select User Activity

3. Click Generate User Activity Report to generate a new report.

4. Select to report on either Authentication Events or User Activity.

5. If selecting authentication events, select the time range you want to export. Only authentication events during this window will be listed in the report. The time range will use your local timezone, even though the export itself will have timestamps in UTC.

6. If selecting user activity, select to report on active or inactive users.

If you select Active Users, you must also select the time range you want to export. Only users that accessed Twingate Resources during this window will be listed in the report. The time range will use your local timezone, even though the export itself will have timestamps in UTC.

The Inactive Users report does not take a time range. It always lists accounts that haven’t accessed a Twingate Resource in the last 90 days.

7. The export will complete in the background and you will be emailed when it’s ready. Most exports will only take a few minutes, though very large ones could take a few hours.

How to view the export

Exports are created in GZIP format. You can use most free compression tools to decompress. After decompression, we recommend you rename the file by adding .csv to the filename, which will make it easier to open in a spreadsheet editor.

If you are using Safari and the file appears to be empty, we recommend Safari’s automatic unpack feature. To do this, navigate to Safari > Preferences > General and uncheck the “Open ‘Safe’ files after downloading” option.

8. Go back to the Reports page to download completed reports. Twingate exports a list of active or inactive users, per the selected report parameters.

9. If desired, set up the Amazon S3 sync to automatically sync and send authentication events.

Report Reference

Active Users Report Columns

Active user reports include the following columns:

Authentication Event Log Schema

Authentication event logs are exported as JSON, in one of the following schemas depending on the action type.

Admin Console sign-in

{
  "version": "1",
  "time": "2021-08-15T14:30:00Z",
  "action": {
    "type": "admin_login",
    "user": {
      "email": "name@example.com",
      "id": "VXNlduw93Tg5NDg="
    },
    "policy": {
      "id": "VXNlduw93Tg5NDg=",
      "name": "Admin Console Sign In"
    }
  }
}

Resource authentication

{
  "version": "1",
  "time": "2021-08-15T14:30:00Z",
  "action": {
    "type": "reauth",
    "user": {
      "email": "name@example.com",
      "id": "VXNlduw93Tg5NDg="
    },
    "policy": {
      "id": "VXNlduw93Tg5NDg=",
      "name": "Default Policy"
    },
    "device": {
      "id": "WIOXlduw93Tg90SDg=",
      "name": "Macbook Pro"
    },
    "resource": {
      "id": "WIOXlduw93Tg90SDg=",
      "name": "API Server"
    }
  }
}