In much the same way as you joined
cwd_attributes in your query, you can also join in
cwd_membership and then check to see if the joined data meets your criteria.
Your query with an additional
SELECT u.user_name as "Username" , u.display_name as "Full Name" , to_timestamp(CAST(a.attribute_value as bigint)/1000) as "Last Login" FROM cwd_user u INNER JOIN cwd_membership m ON m.child_name=u.user_name AND m.parent_name='hr' LEFT JOIN cwd_user_attributes a ON u.id = a.user_id AND attribute_name = 'login.lastLoginMillis' WHERE a.attribute_value >= '1598824800000' OR a.attribute_value IS NULL ORDER BY a.attribute_value;
CLICK HERE to find out more related problems solutions.