Lastlog data will contain an entry normally from /var/log/lastlog on the remote host for the user account flagged. Lastlog contains the last login time of the user along with where they logged in from and on what terminal.

{
	"username": "",
	"uid": 0,
	"date": {
		"created": "",
		"created_minutes": 0
	},
	"terminal": "",
	"hostname": ""
}

Previous Article: User Data

Next Article: UTMP Log Data