https://community.checkpoint.com/t5/SASE-and-Remote-Access/Creating-Views-Log-in-and-log-out-events-and-user-analysis-VPN/m-p/113617#M9048 <P>Hi everyone,</P><P>I am not an expert in creating views but I would like to share one that I have created and has helped me a lot in analysis of log in, log out and login failures, which can be a brute force attempt to discover the password of any user.</P><P>The functionalities of the four fields are:</P><P><STRONG>Access Result</STRONG>: Identify the number of successful and failed logins.</P><P><STRONG>Top Failed Log In Users</STRONG>: Which users have the most login failures.</P><P><STRONG>Source IP</STRONG>: You can analyze whether successes and failures have the same IP as the source.</P><P><STRONG>Log in and Log Out Events</STRONG>: You cannot use it as a basis to know what time the user is starting and ending the work shift, but you can analyze when he connects and disconnects on the VPN.</P><P>I hope I can help in some way on your day, and if you can answer this post with some improvements that you managed to implement&nbsp;I will be grateful.</P><P>Good luck.</P><P>&nbsp;</P><P>PS:&nbsp;Don't forget to change the extension to .cpr to be able to import into Views.</P> Tue, 16 Mar 2021 05:29:15 GMT Rodrigo_Silva 2021-03-16T05:29:15Z https://community.checkpoint.com/t5/SASE-and-Remote-Access/Creating-Views-Log-in-and-log-out-events-and-user-analysis-VPN/m-p/113617#M9048 <P>Hi everyone,</P><P>I am not an expert in creating views but I would like to share one that I have created and has helped me a lot in analysis of log in, log out and login failures, which can be a brute force attempt to discover the password of any user.</P><P>The functionalities of the four fields are:</P><P><STRONG>Access Result</STRONG>: Identify the number of successful and failed logins.</P><P><STRONG>Top Failed Log In Users</STRONG>: Which users have the most login failures.</P><P><STRONG>Source IP</STRONG>: You can analyze whether successes and failures have the same IP as the source.</P><P><STRONG>Log in and Log Out Events</STRONG>: You cannot use it as a basis to know what time the user is starting and ending the work shift, but you can analyze when he connects and disconnects on the VPN.</P><P>I hope I can help in some way on your day, and if you can answer this post with some improvements that you managed to implement&nbsp;I will be grateful.</P><P>Good luck.</P><P>&nbsp;</P><P>PS:&nbsp;Don't forget to change the extension to .cpr to be able to import into Views.</P> Tue, 16 Mar 2021 05:29:15 GMT https://community.checkpoint.com/t5/SASE-and-Remote-Access/Creating-Views-Log-in-and-log-out-events-and-user-analysis-VPN/m-p/113617#M9048 Rodrigo_Silva 2021-03-16T05:29:15Z https://community.checkpoint.com/t5/SASE-and-Remote-Access/Creating-Views-Log-in-and-log-out-events-and-user-analysis-VPN/m-p/120856#M9049 <P>Thank you for sharing <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 10 Jun 2021 14:24:17 GMT https://community.checkpoint.com/t5/SASE-and-Remote-Access/Creating-Views-Log-in-and-log-out-events-and-user-analysis-VPN/m-p/120856#M9049 Tobias_Karsbo 2021-06-10T14:24:17Z