EDR: Why login type is captured as -1?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Why login type is captured as -1?

Environment

• EDR: All versions

Resolution

LOGON = {'NotQueried': -2, 'Failed': -1, 'System': 0, 'Interactive': 2, 'Network': 3, 'Batch': 4, 'Service': 5,
'Proxy': 6, 'Unlock': 7, 'NetworkCleartext': 8, 'NewCredentials': 9, 'RemoteInteractive': 10,
'CachedInteractive': 11, 'CachedRemoteInteractive': 12, 'CachedUnlock': 13}