Email Login Sessions collection contains the history of authentications and accesses made to email accounts. Each row represents an event related to an email account, such as a successful login, a failed access attempt, or an authentication performed through email protocols like IMAP or POP3.This collection allows you to know who is accessing email accounts and whether there are problems or failed authentication attempts.
Email Login Sessions collection serves to analyze access activity to email accounts.Although some of the information is technical, it is very useful for understanding the real usage of the email service and detecting potential security issues.
For example, this collection allows you to:
Review email account accesses: It allows you to identify which users connect to their mailboxes and when they do so. This is useful for verifying legitimate activity or investigating incidents related to a specific account.
Detect failed access attempts: If an account is receiving multiple incorrect authentication attempts, this collection records it. This can help detect brute force attacks, configuration errors, or credential issues.
Identify suspicious accesses: The combination of IP and abuse score allows you to detect potentially malicious or unusual connections.
Analyze email protocol usage: Through the process field, it is possible to know if accesses are made via IMAP, POP3, or other email-related services. This helps understand how users use their email accounts.
Investigate authentication incidents: When a user reports that they cannot access their email, this collection allows you to review if there are login errors and what type of problem has occurred.
one row = one email access attempt,
a user = the email account used,
an IP = where the access came from,
an action = what happened,
a failed login = if the access was not completed successfully,
a date = when the event occurred.
| Field | Type | Description |
|---|---|---|
| abuse_score | Numeric | IP risk level (0–100). |
| action | Categorical | Action recorded during access (successful login, failure, disconnection, etc.). |
| ip | Categorical | IP from which the connection was made. |
| login_failed | Numeric | Indicates whether the login failed (0 = no, 1 = yes). |
| login_failed_type | Categorical | Reason for the authentication failure. |
| process | Categorical | Protocol used: IMAP or POP3. |
| user | Categorical | Email account used. |
| utc_date | Date and time | Time of the event in UTC timezone. |
Data type: numeric
This field indicates a risk score associated with the IP that performed the access. The higher the value, the greater the probability that the IP has been related to suspicious behaviors or malicious activities. It does not necessarily mean that the access is dangerous, but it does deserve additional review.
Data type: categorical text
Indicates the action recorded by the email server. It will usually show events related to authentications or accesses to email accounts. It allows you to quickly identify what type of activity has occurred.
Data type: categorical text
This is the IP address from which the email access was made. This field is especially important for security investigations and access auditing.
Examples of use:
Data type: numeric
Indicates whether the authentication attempt failed.
Typically:
It is one of the most important fields for detecting access problems or intrusion attempts.
Data type: categorical text
Describes the reason for the authentication failure when it exists. Depending on the recorded event, it may indicate password errors, non-existent user, or other problems related to the login process. When the access was successful, this field usually appears empty.
Indicates the process or service that managed the connection.
The most common values usually correspond to email protocols such as:
This field allows you to understand how users access their mailboxes.
For example:
Data type: categorical text
Indicates the email account used during the access. It allows you to identify which mailbox generated the recorded activity. It is one of the most used fields for investigating incidents related to a specific account.
Data type: date and time
This is the exact date and time when the event occurred. It allows you to reconstruct the activity of an email account over time, detect activity spikes, or investigate specific incidents.
You can filter by the affected account and check if there are records with login_failed = 1 to identify when the problem started and what the reason was.
user and count the number of registered accesses.ip field to understand the origin of the registered connections.