The agent overview page now shows the last user to log into a macOS endpoint, so you can attribute a host to an individual user during triage and asset review. Previously, this field was only available on Windows.
The value reflects the most recent interactive (console/GUI) login, collected during the agent's routine survey. System-owned login windows and shutdown records are excluded, so you see the last real user rather than a service account. The field populates as endpoints check in on Agent v0.14.196 or later.