Ingesting Proofpoint vpn logs into splunk cloud

[jorge_1800]

Hello there, 

our shop uses proofpoint vpn for our remote users to access on-prem resources. I've been looking into splunkbase to see if there's a published app, I don't see any add-on for vpn data ingestion. I see there's a proofpoing email security add on, but it doesn't seem to relate to vpn logs. 

Any ideas what add-on\apps will work for it?

thanks. 

[PickleRick · Accepted solution]

I suppose you're talking about Proofpoint Secure Access (formerly Zero Trust Network Access, formerly Proofpoint Meta).

I doubt that you're gonna find anything relevant. Firstly, it's not a very popular soultion, secondly, it's a cloud-based service so you'll most probably need some API-pulling modular input (maybe there's some on-prem component but I didn't touch the stuff so I have no experience here). And thirdly - it's getting retired at the end of 2024.

[jorge_1800]

That's right. I never liked that solution either, and we have plans to move away from it in the near future.

Thank you for your input. 

[marnall]

Indeed there is no direct app for it on Splunkbase, even if you look through the archive. Do you have any logging settings in the Proofpoint VPN interface, or any specific API documentation on the VPN service of Proofpoint?

[jorge_1800]

Thank you for your input. Proofpoint does not much useful information about this product. We're planning to move away from it so it's not worth the effort.

thank you for your input.