class_docstr: A class defines contains matchers for Osquery events
docstr: Capture user logins from the osquery last table
  This matcher assumes we use default osquery pack shipped with osquery package
  located at /usr/share/osquery/packs/incident-response.conf on the linux host.
  Update the pack name (rec['name']) if it is different.
docstr_tok: ["Capture","user","logins","from","the","osquery","last","table","This","matcher","assumes","we","use","default","osquery","pack","shipped","with","osquery","package","located","at","\/usr\/share\/osquery\/packs\/incident-response.conf","on","the","linux","host",".","Update","the","pack","name","(","rec","[","'name","'","]",")","if","it","is","different","."]
code: def user_login(cls, rec):
      """Capture user logins from the osquery last table
      This matcher assumes we use default osquery pack shipped with osquery package
      located at /usr/share/osquery/packs/incident-response.conf on the linux host.
      Update the pack name (rec['name']) if it is different.
      """
      return (
          rec["name"] == "pack_incident-response_last"
          and int(rec["columns"]["type"]) == cls._EVENT_TYPE_LOGIN
          and (rec["columns"]["username"] not in cls._RUNLEVELS)
      )
  
file_path: streamalert/matchers/default.py
label_desc: Use image node_id 2 for calling the OsqueryMatcher obj's underlying member method code with example usage: obj.user_login(cls, rec) and returns: unknown