Deployment Architecture

Create Splunk Alert for fortinet VPN tunnel status

mufthmu
Path Finder

Hi fellow Splunkers,

I want to create alert with these conditions:

  1. alert triggered when any of the VPNs go down.
  2. alert triggered when someone brings down the tunnel.

Thanks in advance

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
Do you have VPN and tunnel states logged in Splunk? If not, there is nothing you can do until that data is available. If you have the data, search the appropriate index(es) for events showing a down VPN or tunnel. Then save the search as an alert.
I'd like to be more specific, but vague questions beget vague answers.
---
If this reply helps you, Karma would be appreciated.
0 Karma

mufthmu
Path Finder

@richgalloway yes I do, we have events coming in (assume index=fortinet).

However, I do not know how to write specific search query that can capture an event when the VPN is down. Also if I simply search "index = fortinet", how do you narrow the search to find events that shows a down VPN or tunnel? I could not find those events.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This is when it helps to understand your data.  If you're not familiar with the Fortinet logs I suggest you reach out to someone in your company who is familiar with them so he or she can tell you what to look for.

Some basic searches to get started include looking for the word "down"

index=fortinet "down"

or the name of a VPN or tunnel

index=fortinet "<VPN or tunnel name>"
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...