Once you toggle Allow user authentication data on in Control Hub, user sign-ins and sign-outs are logged and can be retrieved through the public API. You can then view and analyze the data in security applications such as UEBA and SIEM, which can run their machine learning algorithms to discover suspicious and malicious behaviors, detect attack vectors, and identify compromised passwords.

Webex stores the data for 12 months.

View user activities through Webex API

This feature is only available to customers with Pro Pack for Control Hub.
1

Sign in to Control Hub, then under Management, select Organization Settings.

2

In the User authentication data section, toggle Allow user authentication data on.

3

Go to List Security Audit Events to retrieve the data.

View user activities in Control Hub

You can also view and troubleshoot sign-in issues for your users by reviewing their sign-in and sign-out activities in Control Hub.

1

Sign in to Control Hub and go to Management > Security > Audit.

2

Click the Authentication activities tab.

admin end-user sign-in/sign-out activities
3

Filter by user activity, specific dates, email address, IP address, or service, to narrow your search results.