Security Onion Console (SOC) includes an Administration page which shows current users:
The Role(s) column lists roles assigned to the user as defined in the Role-Based Access Control (RBAC) section.
The Status column indicates whether the user account is enabled or disabled. Accounts are enabled by default and indicated by a checkmark icon. A lock icon indicates that user account has been disabled via the
so-user-disable command as described in the Disabling Accounts section.