login_history

{“what”:“Unique numeric identifier for each login event.”,“why”:“Without it, rows cannot be uniquely referenced for updates or joins.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-23T00:03:57.789461230+00:00”}

{“what”:“Moment the login event occurred, in UTC with timezone.”,“why”:“Without it, order and timing of logins is unknown, breaking audit trails and anomaly detection.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-23T00:03:57.827170928+00:00”}

{“what”:“Internal ID of the user account attempting login.”,“why”:“Without it, cannot attribute logins to a specific user, making per-user security review impossible.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-23T00:03:57.839238317+00:00”}

{“what”:“Opaque token assigned to the authenticated session, if login succeeded.”,“why”:“Without it, cannot link login event to subsequent session activity or revoke sessions.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-23T00:03:57.852446685+00:00”}

{“what”:“Short code identifying the device type or class (e.g., ‘M’, ‘D’, ‘T’).”,“why”:“Without it, cannot distinguish device categories for risk scoring or device-specific policies.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-23T00:03:57.871921836+00:00”}

{“what”:“Free-text description of the device, such as browser and OS.”,“why”:“Without it, support staff cannot identify the exact client used, hindering troubleshooting.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-23T00:03:57.883513119+00:00”}

{“what”:“Source IP address of the login request, in dotted-decimal or IPv6 format.”,“why”:“Without it, cannot geolocate or block malicious sources, weakening security monitoring.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-23T00:03:57.900054226+00:00”}