how to create an alert detect when there is a VPN connecting from the outside
What data do you have in your events?
How do you identify if the connection is from "outside"?
Hi @quangtran,
your rerquest is a little vague, could you share more information, some example of your logs and a description of the values to understand sender (src-ip, username, ect...)?
Ciao.
Giuseppe
if one answer solves your need, please accept one answer for the other people of Community or tell us how we can help you.
Ciao and happy splunking
P.S.: Karma Points are appreciated by all the Contributors;-)
sorry, because this warning does not have enough log sources at the moment, i have not continued writing
ok, let us know if we can help you more.
Ciao and happy splunking.
P.S.: Karma Points are appreciated by all the Contributors 😉
