---
title: "Occurrences by user"
slug: "occurrences-by-user"
updated: 2026-11-03T14:48:14Z
published: 2026-11-03T14:48:14Z
canonical: "docs.senhasegura.io/occurrences-by-user"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Occurrences by user

This document provides information about the **Occurrences by user** report screen, which displays a ranking of sessions based on audited commands, target devices, credentials, and Segura™ accounts used.

## Path to access

1. On Segura™, in the navigation bar, hover over the **Products menu** and select **User Behavior.**
2. In the side menu, select **Audited command logs > Occurrences by user.**

## Actions menu

| Item | Type | Description |
| --- | --- | --- |
| **Actions** | Dropdown menu | Displays the options *Print report, Export CSV,* and *Schedule report.* |

## Search fields

| Item | Type | Description |
| --- | --- | --- |
| **Command** | Dropdown menu | Filters commands by their name. |
| **Action of session** | Dropdown menu | Filters commands by the action executed according to the audited command record. The available options are *Allow, Lock, Interrupt*, and *Force*. Clear the field to enable the **All** option. |
| **Remote device** | Dropdown menu | Filters commands by the command's target device. |
| **Credential** | Text field | Filters commands by the credential used. |
| **Local user** | Text field | Filters commands by the Segura™ username. |
| **Session date** | Date picker | Filters commands by the session date. Use this field to enter the start date of the period. |

## Report fields

- **Command.**
- **Action during session.**
- **Remote device.**
- **Credential.**
- **Local user.**
- **Sessions:** number of sessions in which this command was executed.
- **Actions:**
  - **View credential history**: opens the [Sessions with occurrences detected](/v4-2/docs/sessions-with-occurrences-detected) screen.

          **Info**

          

By default, the report displays 30 records per screen. To go to the next screen, click the forward buttons at the end of the report.