index="REPLACE_WITH_AUTH_INDEX" sourcetype="REPLACE_WITH_AUTH_SOURCETYPE" earliest=-24h latest=now
| where lower(user)=lower("REPLACE_WITH_EXACT_USER")
| sort 500 + _time
| table _time user action src dest app authentication_method signature