Hi Team, We need to capture new VPN administrator creation at our LogRhythm SIEM end. We wanted to know in which log will we get that information. For Example, for login and logout we get logs in the below ones: GlobalProtect gateway user login succeeded. GlobalProtect gateway user logout succeeded. Please help with the log pattern for "new VPN administrator creation". Also, whether we get any eventID generated on VPN for this event? Also, we believe the Palo Alto FW admin users will be admin users for GlobalProtect VPN as well. Do we have any option to give admin access to only VPN and not FW/Proxy modules. Please help. Thanks in Advance. Regards, Mitesh Agrawal
... View more