Skip to main content
adem_netsys
adem_netsys
Explorer III
June 5, 2024
Question

VPN Report

  • June 5, 2024
  • 2 replies
  • 850 views

Hi guys

 

I want to get the users who vpn in SIEM as a repor with their duration, we use ivanti pulse for vpn and we get the logs to SIEM, but I could not get a report exactly as I wanted from these logs. Has anyone experienced this issue and created a report?

    2 replies

    FSM_FTNT
    Staff
    FSM_FTNT
    Staff
    July 3, 2024

    Hi, do you have a sample login log and a logoff/disconnect log? I wonder if there is a session time on those that we can use to calculate the duration.

    adem_netsys
    adem_netsysAuthor
    Explorer III
    July 4, 2024

    Hi, 

    Information about a user's vpn duration comes to SIEM as connclosed. In this, it transmits after x seconds as event description. The x here specifies the duration of the vpn stay. However, if it provides more than one connection during the day, it transmits the log as a separate session, not the general total time. This makes it difficult to find the total minutes.

    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!