vpn-login
July 1, 2024 · View on GitHub
Description
A user logged in to a VPN
Parameters
| Parameter | Value |
|---|---|
| Subject | vpn |
| Activity | login |
| Activity Type | vpn-login |
| Pretty Name | Vpn Login |
Legacy Names
| Success | Fail |
|---|---|
| vpn-login vpn-connection authentication-successful | failed-vpn-login vpn-connection authentication-failed |
Fields
The possible fields for this activity type will vary depending on whether the activity was a success or a fail.
vpn-login:success
| Field | Core | Detection | Informational |
|---|---|---|---|
| os | ✓ | ||
| login_type | ✓ | ||
| src_zone | |||
| domain | ✓ | ||
| dest_ip | ✓ | ||
| dest_host | ✓ | ||
| realm | ✓ | ||
| domain_user_name | |||
| src_host | ✓ | ||
| user | ✓ | ✓ | |
| dest_zone |
vpn-login:fail
| Field | Core | Detection | Informational |
|---|---|---|---|
| failure_code | ✓ | ||
| os | ✓ | ||
| login_type | ✓ | ||
| domain_user_name | |||
| failure_reason | ✓ | ||
| src_host | ✓ | ||
| dest_zone | |||
| src_zone | |||
| domain | ✓ | ||
| dest_ip | ✓ | ||
| dest_host | ✓ | ||
| realm | ✓ | ||
| user | ✓ | ✓ |