User Activity

Twingate provides comprehensive visibility into user engagement and security through reporting in the Admin Console.

Admins can monitor granular authentication events to track successful and failed sign-in attempts to Twingate Client and Resource Policies. This new functionality allows teams to troubleshoot the root cause of connection issues such as IDP errors, device posture mismatches, or policy blocks while also providing a clear audit trail for MFA setup and reset actions. This data can be manually exported as a JSON file or synced to an S3 bucket.

In addition to event logging, Twingate offers an Active Users Report and an Inactive Users Report to help admins manage user counts and platform adoption. The Active Users Report details recent access timestamps, connection types, and failed attempts, while the Inactive Users Report automatically identifies accounts that haven’t accessed any Resources in the last 90 days. This data can be manually exported as a CSV file.

Exporting User Activity Report

To create an export:

1. Navigate to the Reports page under Settings

2. Select User Activity

3. Click Generate User Activity Report to generate a new report

4. Select to report on either Authentication Events or User Activity

5. If selecting authentication events, select the time range you want to export

Only authentication events during this window will be listed in the report. The time range will use your local time zone, even though the export itself will have timestamps in UTC.

6. If selecting user activity, select to report on active or inactive users and the time range you want to export

Only users that accessed Twingate Resources during this window will be listed in the report. The time range will use your local timezone, even though the export itself will have timestamps in UTC.

7. The export will complete in the background and you will be emailed when it’s ready

Most exports will only take a few minutes, though very large ones could take a few hours.

8. Go back to the Reports page to download completed reports

Twingate exports a list of active or inactive users, per the selected report parameters.

9. If desired, set up the Amazon S3 sync to automatically sync and send authentication events

Active user reports include the following columns:

• user_email: email address of the user that accessed Twingate during the defined time period
• last_access_date: the last time of Resource access
• total_connections: total number of connections during the defined time period
• success_connections: number of successful connections during the defined time period
• failed_connections: number of failed connections during the defined time period
• failed_connections_dns: number of failed connections due to DNS errors during the defined time period
• failed_connections_other: number of failed connections due to non-DNS errors during the defined time period
• total_bytes: total bytes transferred during the defined time period
• bytes_transferred: bytes transferred to Resources during the defined time period
• bytes_received: bytes received by the user during the defined time period
• percent_relay: percent of connections going through a Twingate relay
• percent_p2p: percent of connections using a peer-to-peer connection
• active_devices: number of active devices (at time of report generation)
• num_of_client_ip: number of client IPs used to access Twingate Resources during the defined time period
• top_10_client_ips: top 10 client IPs used to access Twingate Resources during the defined time period