https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-Connection-VPN-from-foreign-source/m-p/586174#M13521 <P><SPAN class="">how to create an alert detect when there is a VPN connecting from the outside</SPAN></P> Wed, 23 Feb 2022 16:35:43 GMT quangtran 2022-02-23T16:35:43Z https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-Connection-VPN-from-foreign-source/m-p/586174#M13521 <P><SPAN class="">how to create an alert detect when there is a VPN connecting from the outside</SPAN></P> Wed, 23 Feb 2022 16:35:43 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-Connection-VPN-from-foreign-source/m-p/586174#M13521 quangtran 2022-02-23T16:35:43Z https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-Connection-VPN-from-foreign-source/m-p/586178#M13522 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/243319">@quangtran</a>,</P><P>your rerquest is a little vague, could you share more information, some example of your logs and a description of the values to understand sender (src-ip, username, ect...)?</P><P>Ciao.</P><P>Giuseppe</P> Wed, 23 Feb 2022 09:31:39 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-Connection-VPN-from-foreign-source/m-p/586178#M13522 gcusello 2022-02-23T09:31:39Z https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-Connection-VPN-from-foreign-source/m-p/586179#M13523 <P>What data do you have in your events?</P><P>How do you identify if the connection is from "outside"?</P> Wed, 23 Feb 2022 09:33:01 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-Connection-VPN-from-foreign-source/m-p/586179#M13523 ITWhisperer 2022-02-23T09:33:01Z https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-Connection-VPN-from-foreign-source/m-p/608809#M14128 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/243319">@quangtran</a>,</P><P>if one answer solves your need, please accept one answer for the other people of Community or tell us how we can help you.</P><P>Ciao and happy splunking</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated by all the Contributors;-)</P> Tue, 09 Aug 2022 08:09:01 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-Connection-VPN-from-foreign-source/m-p/608809#M14128 gcusello 2022-08-09T08:09:01Z https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-Connection-VPN-from-foreign-source/m-p/608811#M14129 <P>sorry, because this warning does not have enough log sources at the moment, i have not continued writing&nbsp;</P> Tue, 09 Aug 2022 08:15:35 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-Connection-VPN-from-foreign-source/m-p/608811#M14129 quangtran 2022-08-09T08:15:35Z https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-Connection-VPN-from-foreign-source/m-p/608815#M14130 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/243319">@quangtran</a>,</P><P>ok, let us know if we can help you more.</P><P>Ciao and happy splunking.</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated by all the Contributors <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Tue, 09 Aug 2022 08:20:29 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-Connection-VPN-from-foreign-source/m-p/608815#M14130 gcusello 2022-08-09T08:20:29Z