Connectilogs Panel | Sessions

Connectilogs Panel | Sessions

What is this collection?
The Sessions collection records information related to sessions started in an application or website. A session represents the period during which a user interacts with the application from the moment they start browsing until they leave or the session ends. Each row corresponds to a recorded session and gathers information about when it started, when it ended, how long it lasted, from which IP address the access was made, which user started it, and other useful information for analyzing visitor activity.

This collection provides an overview of application usage, allows you to understand user behavior, and detect possible suspicious access.

It is especially useful when you want to answer questions like:

  • how many sessions have been started
  • which users have accessed the application
  • view the journey they took through the application
  • how long they remain connected
  • from which IP addresses they connect
  • or if there are sessions with anomalous behavior
What is it for?
The Sessions collection allows you to analyze how users use an application and obtain relevant information about their connections. In addition to helping understand usage habits, it is also useful for detecting possible security incidents or unusual access.

For example, this collection allows you to:

  • Analyze application usage: Allows you to know how many sessions are generated and when access occurs, helping to identify peak activity times.
  • Identify connected users: Each session can be associated with the user who started it, facilitating individual activity tracking.
  • Know session duration: Allows you to analyze how long users remain using the application and detect unusually short or long sessions.
  • Detect access from new locations: By recording the IP address and other connection-related information, it is possible to identify access from locations different from the usual ones.
  • Investigate possible security incidents: Session information can help locate suspicious access, connections outside normal hours, or multiple logins from different locations.
How to read this collection in a simple way
A simple way to interpret this collection is to think of it like this:
  • one row = one user session,
  • one user = who started the session,
  • one IP = where the access came from,
  • a start time = when the session began,
  • a duration = how long it remained active.

Not all sessions represent different behavior. The same user can generate multiple sessions throughout the day if they access at different times or from different devices.

Field description
FieldData typeDescription
abuse_scoreNumberScore associated with the risk level or reputation of the IP address that originated the session.
countryCategoricalCountry from which the session originated, based on the geolocation of the IP address. It will not always be available since we usually include information for sessions with potentially fraudulent IPs.
domainCategoricalDomain on which the session was recorded.
durationNumericTotal time the session lasted.
end_timeDate and timeDate and time when the session ended in UTC timezone.
entry_pageCategoricalFirst page visited during the session.
exit_pageCategoricalLast page visited before the session ended.
ipCategoricalIP address from which the session was started.
navigation_pathCategoricalComplete route taken by the visitor during the session, showing the pages visited in order.
page_viewsNumericTotal number of pages viewed during the session.
refererCategoricalPage or website from which the visitor came.
session_idCategoricalUnique session identifier.
start_timeDate and timeDate and time when the session started in UTC timezone.
total_visitsNumericNumber of visits associated with the session.
user_agentCategoricalIdentifying string of the browser, operating system, or application used by the visitor.
utm_campaignCategoricalName of the marketing campaign (utm_campaign) associated with the visit, if any.
utm_contentCategoricalSpecific content of the campaign (utm_content).
utm_kwdCategoricalKeyword (utm_kwd) used to identify the campaign, if available.
utm_mediumCategoricalAcquisition medium (utm_medium), such as email, cpc, or social.
utm_sourceCategoricalCampaign source (utm_source), such as Google, Facebook, or a newsletter.
utm_termCategoricalSearch term (utm_term) associated with the campaign.
mtm_campaignCategoricalMatomo campaign name (mtm_campaign).
mtm_contentCategoricalMatomo campaign content (mtm_content).
mtm_kwdCategoricalMatomo keyword (mtm_kwd).
mtm_mediumCategoricalAcquisition medium recorded via Matomo (mtm_medium).
mtm_sourceCategoricalAcquisition source recorded via Matomo (mtm_source).
abuse_score

Data type: integer

Indicates the risk score associated with the IP address from which the session originated. This score helps identify whether the IP has a known reputation for potentially malicious activities, such as automated attacks, scans, or unauthorized access attempts. A higher value usually indicates a higher risk level.

country
Data type: categorical text

Indicates the country from which the session originated, based on the geolocation of the IP address. This field allows you to know the geographic origin of connections and detect access from unusual locations. Note that IPs with a low abuse score typically do not have location data; however, potentially dangerous ones do.

domain

Data type: categorical text

Indicates the domain on which the session was recorded. It is especially useful when analyzing multiple domains from the same dashboard, as it allows you to differentiate which one each session belongs to.

duration

Data type: duration

Indicates the total time (in seconds) the session remained active. A very short duration may indicate that the visitor quickly left the page, while a longer duration usually reflects more prolonged interaction.

end_time

Data type: date and time

Indicates the date and time when the session ended. Together with start_time, it allows you to know when the visitor's browsing ended and calculate the session duration. This date and time is in UTC timezone.

entry_page

Data type: text

Indicates the first page the user visited when starting the session. This field is useful for knowing which pages act as entry points to the website.

exit_page

Data type: text

Indicates the last page visited before the session ended. It allows you to know where users leave the site and detect possible drop-off points.

ip

Data type: IP address

Indicates the IP address from which the session was started. This field allows you to identify the origin of the connection and relate it to other events recorded in the system. In simple terms, it answers the question: "From which IP address did the visitor connect?"

navigation_path

Data type: text

Shows the complete route taken by the visitor during the session, indicating the order in which they visited different pages. This field helps understand how users navigate the website.

Example use cases:

  • analyze the usual visitor journey,
  • identify the most frequent paths to conversion.
page_views

Data type: integer

Indicates the total number of pages visited during the session. This data allows you to measure the visitor's level of interaction with the website.

Example use cases:

  • know how many pages each user visits,
  • detect sessions with particularly intense browsing.
referer

Data type: text

Indicates the page or website from which the visitor came before accessing the domain. This field helps identify the traffic source.

Example use cases:

  • know if the visitor came from a search engine,
  • identify access from other websites,
  • analyze traffic generated by external campaigns.
session_id

Data type: categorical text

Unique session identifier. It allows you to distinguish each session from the rest and relate it to other events recorded during browsing.

start_time

Data type: date and time

Indicates the date and time when the session started in UTC timezone. It allows you to know when browsing began and analyze periods of peak activity.

total_visits

Data type: integer

Indicates the total number of pages recorded for the session. This field allows you to count the visits associated with each session and perform aggregated analysis of site activity.

user_agent

Data type: text

Contains the identification string sent by the visitor's browser or application. From this information it is possible to know the browser used, the operating system, and in some cases, the type of device.

Example use cases:

  • identify the most used browsers,
  • detect access by bots or automated applications,
  • analyze site compatibility with different platforms.
utm_campaign

Data type: categorical text

Indicates the name of the marketing campaign from which the visitor came, when the URL contains the utm_campaign parameter. This field allows you to measure the performance of specific campaigns.

utm_content

Data type: categorical text

Indicates the specific content of a marketing campaign using the utm_content parameter. It is commonly used to differentiate ads or variants within the same campaign.

utm_kwd

Data type: categorical text

Indicates the keyword associated with the campaign when the utm_kwd parameter is used. It allows you to identify which term or segmentation criterion originated the visit.

utm_medium

Data type: categorical text

Indicates the medium through which the visitor arrived using the utm_medium parameter.

For example:

  • email
  • cpc
  • social
  • banner

This field helps analyze which channels generate the most traffic.

utm_source

Data type: categorical text

Indicates the acquisition source using the utm_source parameter.

For example:

  • Google
  • Facebook
  • LinkedIn
  • Newsletter

It allows you to identify where visitors are coming from.

utm_term

Data type: categorical text

Indicates the search term or keyword used in marketing campaigns using the utm_term parameter. It is mainly used in search engine advertising campaigns.

mtm_campaign

Data type: categorical text

Indicates the campaign name recorded using Matomo's tracking parameters (mtm_campaign). Its purpose is equivalent to utm_campaign, but using Matomo's own nomenclature.

mtm_content

Data type: categorical text

Indicates the specific content of a campaign recorded using mtm_content. It allows you to differentiate different variants within the same campaign.

mtm_kwd

Data type: categorical text

Indicates the keyword recorded using the mtm_kwd parameter. It is used to identify the term associated with the campaign.

mtm_medium

Data type: categorical text

Indicates the medium through which the visitor arrived using the mtm_medium parameter. It allows you to analyze the different acquisition channels configured in Matomo.

mtm_source

Data type: categorical text

Indicates the acquisition source recorded using the mtm_source parameter. It allows you to know from which platform, website, or channel the visitor came before starting the session.

    • Related Articles

    • Connectilogs Panel | Mail Login History

      What is this collection The Email Login Sessions collection contains the history of authentications and accesses made to email accounts. Each row represents an event related to an email account, such as a successful login, a failed access attempt, or ...
    • ConnectiLogs Panel | Log Management

      What is ConnectiLogs? ConnectiLogs is the visualization, analysis, and exploration platform for activity and security data from cdmon products. Its goal is to centralize all the information generated by the different services in order to facilitate ...
    • ConnectiLogs Panel | Dashboards

      Dashboards in ConnectiLogs are customizable panels that allow you to easily visualize the most relevant information from your data. Their main advantage is that they let you access the information you need quickly and directly, without having to ...
    • ConnectiLogs Panel | Query Generator

      The query builder is a tool that allows you to explore your ConnectiLogs data in a customized way, without needing to use code or technical language. With it, you can create filters, combine conditions, visualize results with different types of ...
    • ConnectiLogs Panel | Filter Configuration

      Filters allow you to reduce and control the data returned by a query, showing only the records that meet specific conditions. They are one of the most important tools in the query builder, as they help you move from large volumes of logs to concrete, ...