Add Presence Status and Last IP Address Logged In Features for Velociraptor Users

[GShrub]

I would like to request the addition of two features to enhance user experience, maintenance, and security within our app:

1. Presence Status:

• Feature: Display the online status of users (Online, Away, Offline).
• Purpose: Improve communication and collaboration by allowing users to see the availability of their colleagues. Allow for maintenance to be conducted without impacting users.
• Implementation: Use colored dots or icons next to usernames to indicate their status. Green for online, yellow/orange for away, and gray for offline.

2. Last IP Address Logged In:

• Feature: Show the last IP address from which a user logged in.
• Purpose: Enhance security by providing users with information about their login activity, helping to identify any unauthorized access.
• Implementation: Display the last IP address in the user's profile or account settings.

Benefits:

• Presence Status: Facilitates real-time communication and collaboration, making it easier to know when team members are available.
• Last IP Address Logged In: Adds an extra layer of security, allowing users to monitor their account activity and detect potential security breaches.

[scudette]

This is an interesting suggestion but where would we display this information? We currently show a list of all users in the dashboard - this can be large and also not very upfront because you have to scroll down to see it (and maybe page the table).

Maybe a more useful feature is a list of last logins for the current logged in user? but where to show that so it is both obvious and non-intrusive

Also for basic authentication there is no such thing as "login" because every request is authenticated - we can use it as last login time (maybe show a green status like for clients for currently online "users" as well).

[GShrub]

For basic authentication it sounds like it would show active users as all requests are authenticated, would it also show the same for SSO users?

I agree a presence indicator would be useful and an intuitive way to display active users, if users could be sorted by presence colour it would save the admin scrolling down a long list of users.

For Last Logins IP, I feel a Server Artifact would be appropriate for an admin to run on an as needed basis. For a more scalable automated purpose could velociraptor provide this information via the API to a SEIM for the SOC to respond to impossible travel alerts?

[scudette]

For basic auth every request is authenticated so no logs are shown in the audit log because there is no "login" event as such. For oauth etc there is a login and log out event.

We currently assume there are not too many users so they do all fit in the users management screen

We probably can add an online view there. However this screen is only available to administrators so other users wont be able to see it at all.

The last login address is available in the audit logs so it depends if we want to maintain it separately or just do a log dive for it if needed?

[GShrub]

I feel the online view in the users management screen is suitable, the use case for this feature would fit with the administrators role.
For basic auth could a timer be used since last 'login'?
For oauth would a user need to go through the 'log out' process to create the 'log out' event or would an afk or closing the velociraptor tab in a browser situation be captured?
If afk or closed tab situations are not captured currently, how could the time since the user interacted with the interface be captured?