topic Qradar CheckPoint Logs :: User VPN Duration in SASE and Remote Access

Qradar CheckPoint Logs :: User VPN Duration

JasminThejojo — Thu, 29 Jun 2023 17:09:29 GMT

Hi,

We fetch Checkpoint logs in Qradar. I'm looking for a way to find active ldap users and duration of active vpn from CheckPoint logs.

What is the correct way to do that?

Any advice would be appreciated.

Best

Jasmin

Re: Qradar CheckPoint Logs :: User VPN Duration

PhoneBoy — Thu, 29 Jun 2023 18:38:14 GMT

As there is no explicit "log out" logged, there is no way to directly know (short of analyzing all logs generated by the user) which users are currently active and connected.