VPN Report

[adem_netsys]

Hi guys

I want to get the users who vpn in SIEM as a repor with their duration, we use ivanti pulse for vpn and we get the logs to SIEM, but I could not get a report exactly as I wanted from these logs. Has anyone experienced this issue and created a report?

[FSM_FTNT]

Hi, do you have a sample login log and a logoff/disconnect log? I wonder if there is a session time on those that we can use to calculate the duration.

[adem_netsys]

Hi, 

Information about a user's vpn duration comes to SIEM as connclosed. In this, it transmits after x seconds as event description. The x here specifies the duration of the vpn stay. However, if it provides more than one connection during the day, it transmits the log as a separate session, not the general total time. This makes it difficult to find the total minutes.