https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/xsiam-vpn-analytics/m-p/1264394#M481 <P>How do i get third party vpn logs to work with the xsiam analytics rules (<A href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/third-party-vpns" target="_blank">https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/third-party-vpns</A>). These are vpn products for which xsiam doesn't have an in platform data model rule so I would have to create one. I need to know how to create one so that the analytics rules work with them. Appreciate any help on this</P> <P>&nbsp;</P> <P><LI-PRODUCT title="Cortex XSIAM" id="Cortex_XSIAM"></LI-PRODUCT>&nbsp;</P> Tue, 15 Sep 2026 12:46:01 GMT bridgetlitt 2026-09-15T12:46:01Z https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/xsiam-vpn-analytics/m-p/1264394#M481 <P>How do i get third party vpn logs to work with the xsiam analytics rules (<A href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/third-party-vpns" target="_blank">https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/third-party-vpns</A>). These are vpn products for which xsiam doesn't have an in platform data model rule so I would have to create one. I need to know how to create one so that the analytics rules work with them. Appreciate any help on this</P> <P>&nbsp;</P> <P><LI-PRODUCT title="Cortex XSIAM" id="Cortex_XSIAM"></LI-PRODUCT>&nbsp;</P> Tue, 15 Sep 2026 12:46:01 GMT https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/xsiam-vpn-analytics/m-p/1264394#M481 bridgetlitt 2026-09-15T12:46:01Z