The application relates to a login auditing method, device and equipment and a storage medium. The method collects multi-
source data on a terminal side, wherein the multi-
source data comprises network session data and window input data; whether the multi-
source data meets an analysis requirement is judged according to a preset analysis rule, if yes, login behavior related information is extracted from the multi-source data based on the analysis rule; the login behavior related information is matched with a preset
security policy to obtain a matching result; a
risk level is determined according to the matching result, a corresponding response operation is executed according to the
risk level, and an audit
record is generated; compared with the prior art, the technical scheme of the application can realize full-process closed-loop management of terminal-side login auditing from multi-source data collection,
information analysis to strategy matching, risk response and audit
record keeping, can comprehensively extract login behavior information, accurately determine login risks and complete traceable audit records, and improves the overall effectiveness of login auditing.