EDR: Why login type is captured as -1?

[#1]

Environment

• EDR: All versions

Question

Why login type is captured as -1?

Answer

LOGON = {'NotQueried': -2, 'Failed': -1, 'System': 0, 'Interactive': 2, 'Network': 3, 'Batch': 4, 'Service': 5,
'Proxy': 6, 'Unlock': 7, 'NetworkCleartext': 8, 'NewCredentials': 9, 'RemoteInteractive': 10,
'CachedInteractive': 11, 'CachedRemoteInteractive': 12, 'CachedUnlock': 13}