Hi
I would like to know if i can user the last seen metric of a user in a YARA rule , if yes while i am using i am not seeing the result 
My YARA rule is this
rule Inactive_Account {
meta:
author = "Rahul"
description = "Discovers previously inactive accounts ."
severity = "Medium"
events:
$login.metadata.event_type = "USER_LOGIN"
$login.metadata.vendor_name ="Microsoft"
$login.metadata.product_event_type = "4624"
$login.target.user.userid != /.*\\$/ nocase
$login.target.user.userid = $user
$entity.graph.metadata.entity_type = "USER"
$entity.graph.entity.user.userid = $user
$entity.graph.metric.last_seen.seconds = $secondlastseen
match:
$user over 24h
condition:
$login and $entity
}
