Inquiry About Third-Party VPN Logs and Analytics Alerts in XSIAM

[Hisashi_Abe]

Hi All,

■Background
I would like to inquire about the Ivanti VPN logs ingested into XSIAM.
I have installed the data model rules from the content pack. However, I encountered the following issues:

Analytics Alerts: No Analytics alerts related to third-party VPNs have been generated.
Datasets: The logs are not displayed in the "vpn_logs" or "xdr_data" datasets either.

■Questions
I would appreciate it if you could clarify the following points:

1.Regarding the data sources for Analytics alerts:
・Are the data sources for third-party VPNs targeted by Analytics alerts fixed?
・If they are not fixed, are there any required schema conditions for the data model rules?

2.Regarding the "vpn_logs" dataset:
・Are the data sources for third-party VPNs targeted by the "vpn_logs" dataset fixed?
・If they are not fixed, are there any required schema conditions for the data model rules?

Cortex XSIAM  

[amcdonal363]

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Analytics-Alert-Reference-by-da...

• Requires one of the following data sources:
  • Palo Alto Networks Global Protect
    OR
  • Third-Party VPNs

It would be nice if they listed  which Third-Party VPNs are expected to be supported.