Inquiry About Third-Party VPN Logs and Analytics Alerts in XSIAM

Hisashi_Abe — Mon, 21 Jul 2025 19:17:02 GMT

Hi All,

■Background
I would like to inquire about the Ivanti VPN logs ingested into XSIAM.
I have installed the data model rules from the content pack. However, I encountered the following issues:

Analytics Alerts: No Analytics alerts related to third-party VPNs have been generated.
Datasets: The logs are not displayed in the "vpn_logs" or "xdr_data" datasets either.

■Questions
I would appreciate it if you could clarify the following points:

1.Regarding the data sources for Analytics alerts:
・Are the data sources for third-party VPNs targeted by Analytics alerts fixed?
・If they are not fixed, are there any required schema conditions for the data model rules?

2.Regarding the "vpn_logs" dataset:
・Are the data sources for third-party VPNs targeted by the "vpn_logs" dataset fixed?
・If they are not fixed, are there any required schema conditions for the data model rules?

Cortex XSIAM

Re: Inquiry About Third-Party VPN Logs and Analytics Alerts in XSIAM

amcdonal363 — Thu, 31 Jul 2025 09:27:17 GMT

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Analytics-Alert-Reference-by-data-source/Third-Party-VPNs

Requires one of the following data sources:
- Palo Alto Networks Global Protect
  OR
- Third-Party VPNs

It would be nice if they listed which Third-Party VPNs are expected to be supported.

topic Inquiry About Third-Party VPN Logs and Analytics Alerts in XSIAM in Cortex XSIAM Discussions

Inquiry About Third-Party VPN Logs and Analytics Alerts in XSIAM

Re: Inquiry About Third-Party VPN Logs and Analytics Alerts in XSIAM