How to create an Alert Connection VPN from foreign source

[quangtran]

how to create an alert detect when there is a VPN connecting from the outside

[ITWhisperer]

What data do you have in your events?

How do you identify if the connection is from "outside"?

[gcusello]

Hi @quangtran,

your rerquest is a little vague, could you share more information, some example of your logs and a description of the values to understand sender (src-ip, username, ect...)?

Ciao.

Giuseppe

[gcusello]

Hi @quangtran,

if one answer solves your need, please accept one answer for the other people of Community or tell us how we can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors;-)

[quangtran]

sorry, because this warning does not have enough log sources at the moment, i have not continued writing 

[gcusello]

Hi @quangtran,

ok, let us know if we can help you more.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉