Which logs will capture the new VPN admin creation?

Announcements
Attention: The LIVEcommunity is experiencing an interruption with videos in some areas. We apologize for any inconvenience this may cause. Thank you for your patience as we work towards a solution to restore videos.
Reply
Highlighted
L0 Member

Which logs will capture the new VPN admin creation?

Hi Team,

 

We need to capture new VPN administrator creation at our LogRhythm SIEM end. We wanted to know in which log will we get that information.

 

For Example, for login and logout we get logs in the below ones:

GlobalProtect gateway user login succeeded.
GlobalProtect gateway user logout succeeded.
 
Please help with the log pattern for "new VPN administrator creation". Also, whether we get any eventID generated on VPN for this event?
 
Also, we believe the Palo Alto FW admin users will be admin users for GlobalProtect VPN as well. Do we have any option to give admin access to only VPN and not FW/Proxy modules.
 
Please help. Thanks in Advance.
 
Regards,
Mitesh Agrawal
 
Tags (2)
Highlighted
L7 Applicator

Re: Which logs will capture the new VPN admin creation?

Hi @MiteshAgrawal 

 

are you creating new vpn users as local users, or are they created on a remote system like radius or ldap?

in the latter, you will need to have those systems forward their logs to your siem as tha palo alto will not capture new users created that way

 

for the former, this is a configuration action so you will need to get that from forwarded configuration log2020-04-02_09-43.png

reaper - PANgurus.com
I drink and I know things
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!