Two types of data points related to usage are shown in Zluri's UI.

• "Last Used" information is shown under Application -> Users 

• "Activity" information is shown for each application user

1. "Activity" comes from multiple sources (SSOs, direct integrations, agents), which provide information about some or all actions performed by that user specific to that Application, each with an activity-specific timestamp. 
   
   Activities can be a few different things - logins (either from SSO or direct integration or agent) or specific actions taken on the platform, which some SSOs give us and some integrations give us (opened this page, ran this export, etc.) but not all. Each activity comes with a timestamp with which we plot all activities over time and have a log of the most recent activity.
   
   Zluri shows a log of all activities specific to that Application that comes from all of these sources - 

   1. Most SSOs only provide login activities.

   2. A few direct integrations provide more in-depth activities (viewed a page, downloaded a report, changed a setting, etc.).

   3. Agents provide activity info on the Application being used. 
      
      

2. "Last Used" info is provided directly by some integrations which tell us exactly what the last login or last used date is
   
   Zluri shows the last used date for that application user based on the most recent date we receive from either activity (from point 1) or the last used date from the integration. If we get neither, we indicate that we do not have a last used date for this app user (denoted by a hyphen "-" in the column)
   
   Some integrations give us the Last Used field by itself, but most don’t. We show either this as is or the most recent activity we got, whichever is the most recent date.
   
   

How we validate "last used" data 

Step 1

We compare two data points -

• 'Raw_last_used' (Data from the direct integration)

• 'Db_last_used' (data from all the sources combined: Direct/indirect integration + browsers/desktop agents

Using these two data points, we do an internal validation: 

• db_last_used >= raw_last_used: Validated 

  • This means we're showing the last used date we get from the integration or the most recent activity, whichever is the most recent.

• db_last_used is there, but no raw_last_used: Validated 

  • This means that we're not getting the last used date from the integration, but we have activity data from other sources

• raw_last_used is there, but no db_last_used: Not validated

  • This means that we're getting the last used date from the integration, but we're not processing it accurately

• raw_last_used > db_last_used: Not validated

  • This means we're getting a last-used date from the integration, which is not processed accurately; instead, we're displaying stale data.

• both fields are empty: Validated

  • This means that we're not getting any data from activities from all sources or the last used date from the integration, and we're displaying it as it is.

Step 2

Next, we compare raw_last_used with Client shared data: 

• If raw_last_used >= (date shared by the Client): Validated 

• If raw_last_used < (date shared by the Client): Not validated

Step 3

If the data is validated from both step 1 and step 2, then we confirm that the last used date shown on the UI is validated, else it is incorrect. 

Note: In case we do not get any activity data from a customer for an application's users, we will need to do only the internal validation mentioned in Step 1

Caveats:

Zluri date > Client shared date: 

This can happen when the Client shares the last used date from one source (or they see a different date in their Application); however, we get the last used information from multiple sources. 

For applications where we get the data from multiple sources, the last used date shown in the UI is the most recent of all dates we get from different sources.

We store the activity type that we are getting for that Application. If we don't detect any activity type in the activity file, it is taken as a sign-in activity by default.