diff --git a/src/detection/users/users.h b/src/detection/users/users.h
index 8ddc2a0cf..38b3cf204 100644
--- a/src/detection/users/users.h
+++ b/src/detection/users/users.h
@@ -10,7 +10,7 @@ typedef struct FFUserResult
     FFstrbuf name;
     FFstrbuf hostName;
     FFstrbuf clientIp;
-    FFstrbuf tty;
+    FFstrbuf sessionName;
     uint64_t loginTime; // ms
 } FFUserResult;
 
diff --git a/src/detection/users/users_linux.c b/src/detection/users/users_linux.c
index 294c69b3e..f10b9559d 100644
--- a/src/detection/users/users_linux.c
+++ b/src/detection/users/users_linux.c
@@ -31,7 +31,7 @@ next:
         FFUserResult* user = (FFUserResult*) ffListAdd(users);
         ffStrbufInitS(&user->name, n->ut_user);
         ffStrbufInitS(&user->hostName, n->ut_host);
-        ffStrbufInitS(&user->tty, n->ut_line);
+        ffStrbufInitS(&user->sessionName, n->ut_line);
         #ifdef __linux__
         if(n->ut_addr_v6[0] || n->ut_addr_v6[1] || n->ut_addr_v6[2] || n->ut_addr_v6[3])
             ffStrbufInitF(&user->clientIp, "%u.%u.%u.%u", n->ut_addr_v6[0], n->ut_addr_v6[1], n->ut_addr_v6[2], n->ut_addr_v6[3]);
diff --git a/src/detection/users/users_windows.c b/src/detection/users/users_windows.c
index 21e4353a1..115f7935d 100644
--- a/src/detection/users/users_windows.c
+++ b/src/detection/users/users_windows.c
@@ -28,7 +28,8 @@ const char* ffDetectUsers(FFlist* users)
         FFUserResult* user = (FFUserResult*) ffListAdd(users);
         ffStrbufInitWS(&user->name, session->pUserName);
         ffStrbufInitWS(&user->hostName, session->pHostName);
-        ffStrbufInitS(&user->clientIp, "0.0.0.0");
+        ffStrbufInitWS(&user->sessionName, session->pSessionName);
+        ffStrbufInit(&user->clientIp);
         user->loginTime = 0;
 
         DWORD bytes = 0;
diff --git a/src/modules/users/users.c b/src/modules/users/users.c
index ba5e6e75c..3565fbe8a 100644
--- a/src/modules/users/users.c
+++ b/src/modules/users/users.c
@@ -75,7 +75,7 @@ void ffPrintUsers(FFUsersOptions* options)
             ffPrintFormat(FF_USERS_MODULE_NAME, users.length == 1 ? 0 : (uint8_t) (i + 1), &options->moduleArgs, FF_USERS_NUM_FORMAT_ARGS, (FFformatarg[]){
                 {FF_FORMAT_ARG_TYPE_STRBUF, &user->name},
                 {FF_FORMAT_ARG_TYPE_STRBUF, &user->hostName},
-                {FF_FORMAT_ARG_TYPE_STRBUF, &user->tty},
+                {FF_FORMAT_ARG_TYPE_STRBUF, &user->sessionName},
                 {FF_FORMAT_ARG_TYPE_STRBUF, &user->clientIp},
                 {FF_FORMAT_ARG_TYPE_UINT64, &user->loginTime},
             });
@@ -86,7 +86,7 @@ void ffPrintUsers(FFUsersOptions* options)
     {
         ffStrbufDestroy(&user->clientIp);
         ffStrbufDestroy(&user->hostName);
-        ffStrbufDestroy(&user->tty);
+        ffStrbufDestroy(&user->sessionName);
         ffStrbufDestroy(&user->name);
     }
 }
@@ -159,11 +159,11 @@ void ffGenerateUsersJson(FF_MAYBE_UNUSED FFUsersOptions* options, yyjson_mut_doc
     FF_LIST_FOR_EACH(FFUserResult, user, results)
     {
         yyjson_mut_val* obj = yyjson_mut_arr_add_obj(doc, arr);
-        yyjson_mut_obj_add_strbuf(doc, obj, "clientIp", &user->clientIp);
-        yyjson_mut_obj_add_strbuf(doc, obj, "hostName", &user->hostName);
-        yyjson_mut_obj_add_uint(doc, obj, "loginTime", user->loginTime);
         yyjson_mut_obj_add_strbuf(doc, obj, "name", &user->name);
-        yyjson_mut_obj_add_strbuf(doc, obj, "tty", &user->tty);
+        yyjson_mut_obj_add_strbuf(doc, obj, "hostName", &user->hostName);
+        yyjson_mut_obj_add_strbuf(doc, obj, "sessionName", &user->sessionName);
+        yyjson_mut_obj_add_strbuf(doc, obj, "clientIp", &user->clientIp);
+        yyjson_mut_obj_add_uint(doc, obj, "loginTime", user->loginTime);
     }
 
 exit:
@@ -171,7 +171,7 @@ exit:
     {
         ffStrbufDestroy(&user->clientIp);
         ffStrbufDestroy(&user->hostName);
-        ffStrbufDestroy(&user->tty);
+        ffStrbufDestroy(&user->sessionName);
         ffStrbufDestroy(&user->name);
     }
 }
@@ -181,7 +181,7 @@ void ffPrintUsersHelpFormat(void)
     ffPrintModuleFormatHelp(FF_USERS_MODULE_NAME, "{1}@{2} - login time {5}", FF_USERS_NUM_FORMAT_ARGS, (const char* []) {
         "User name",
         "Host name",
-        "TTY name",
+        "Session name",
         "Client IP",
         "Login Time"
     });