Monitored Events & Triggers

Login AlertX continuously monitors system authentication and session channels on Windows and Linux to detect local and remote access in real time. This guide outlines all 25+ monitored events, how intelligent deduplication works, and when alerts are dispatched.

Event Deduplication & Noise Reduction

To eliminate alert fatigue and ensure you only receive meaningful notifications, Login AlertX incorporates built-in filtering:

Logon vs. Unlock Suppression: When you start your computer and type your password, operating systems fire both a Logon and a Screen Unlock event within milliseconds. Login AlertX suppresses duplicate secondary events so you receive exactly one alert per physical session.
Rapid Event Throttling: Identical system events occurring within 10 seconds are deduplicated and summarized.
Fast-Path Media Bypass: For power and exit events (such as Screen Lock, Sleep, Hibernate, or Shutdown), alerts are dispatched immediately as text payloads without media capture delays to ensure the alert leaves your device before the network adapter enters standby.

Key Distinctions: Login vs. Unlock vs. First Login

Login vs. First Login: A standard Login triggers whenever any user session begins (e.g., fast user switching). First Login triggers only on the very first cold login of the calendar day.
Screen Unlock vs. Login via Lock: A Screen Unlock triggers when waking from screensavers or display standby. Login via Lock triggers specifically after a user explicitly locked the workstation (e.g., Win + L).

1. Logins & Authentication

Event Trigger	Platform	Description & Behavior
Login (Session Logon)	Win Linux	Triggers whenever a user successfully authenticates into an account from a cold boot, display manager, or user switch.
First Login	Win Linux	Triggers only on the initial successful login of the calendar day for that machine.
Failed Login	Win Linux	Triggers when an incorrect password or PIN is submitted at the lock screen, console, or display manager. 📷 Webcam photo capture is supported at the lock screen when hardware is present.
Brute-Force Spike	Win Linux	Triggers when multiple consecutive failed password attempts occur within a tight rolling time window, indicating active credential guessing.
Login via Lock	Win	Triggers when an account is unlocked after being explicitly locked by the user (`Win + L`).
AI Risk Anomaly	Win Linux	Triggers when the Ensemble ML engine detects unusual hour access, unknown IP subnets, foreign geolocations, or activity on dormant accounts.

2. Remote & Network Sessions (RDP & SSH)

Event Trigger	Platform	Description & Behavior
RDP Connect	Windows	Triggers when a remote desktop connection is established (Logon Type 10), capturing connecting IP, client hostname, and geo-IP.
RDP Disconnect	Windows	Triggers when an active Remote Desktop session is terminated or connection is dropped.
SSH Key Login	Linux	Triggers when an SSH session is established via public key authentication (captures key fingerprint, source IP, and user).
SSH Password Login	Linux	Triggers when an SSH session is established via interactive password authentication.
SSH Disconnect	Linux	Triggers when an active SSH terminal connection is closed.
Console / TTY Logon	Linux	Triggers when an interactive terminal or direct virtual console session (TTY1–TTY6) logs in.

3. Privilege Escalation & Administrative Actions

Event Trigger	Platform	Description & Behavior
Privilege Elevation (UAC)	Windows	Triggers when User Account Control elevated credentials are successfully granted for administrative tasks.
sudo Command Execution	Linux	Triggers when a user executes a command with elevated `sudo` root privileges, including command name and target user.
Failed sudo Attempt	Linux	Triggers when an unauthorized user attempts to execute `sudo` or inputs an incorrect root/sudo password.

4. Session Lifecycle & Workstation State

Event Trigger	Platform	Description & Behavior
Screen Lock	Win Linux	Triggers when a session is manually locked (e.g., `Win + L` or screensaver lock).
Screen Unlock	Win Linux	Triggers when a user inputs credentials to return to an active locked session.
Logoff (Session End)	Win Linux	Triggers when a user signs out or closes their desktop session completely.

5. Power & System State Events

Event Trigger	Platform	Description & Behavior
Powered On (System Start)	Win Linux	Triggers when the computer finishes booting and initializes the Login AlertX background daemon.
Shut Down	Win Linux	Triggers when a graceful system shutdown or reboot is initiated.
Sleep / Suspend	Win Linux	Triggers when the machine enters a low-power sleep or suspend state.
Hibernated	Windows	Triggers when system memory is written to disk and the PC powers down into hibernation.
Resumed (Wake)	Win Linux	Triggers the moment hardware components power back on from sleep or hibernation.
Sleep Login	Windows	Triggers when a user unlocks the session specifically after the computer wakes from sleep.
Unexpected Reboot	Win Linux	Triggers retroactively on next startup if the previous shutdown was dirty (e.g., sudden power loss or kernel panic).

Customizing Event Toggles

You can selectively enable or disable any event trigger to suit your monitoring needs:

On Windows: Open the Login AlertX tray icon, go to Notification Preferences > Notify Me For, and toggle individual events.
On Linux CLI: Run sudo loginalertx configure or edit /etc/loginalertx/config.json to toggle specific event rules.