Disclaimer: This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.

---

Overview 

This Recommended Reads describes how to generate a list of users consuming ZTNA Licenses with Live Discover (XDR)

XDR Live Discover

With XDR Live Discover, we can query a report of all users and the last time they used ZTNA within one click. 
https://central.sophos.com/manage/threat-analysis-center/live-query

Enable the Designer Mode

Create a new Query

The SQL Query

SELECT DISTINCT user_name, max(timestamp) AS last_used
FROM ztna_data 
WHERE user_name <> ''
GROUP BY user_name

Run this query for the Last 30 Days, as ZTNA stores the license information for 30 Days. 

---

Edited Title, TAGs
[edited by: emmosophos at 11:06 PM (GMT -7) on 1 Apr 2024]