Qradar CheckPoint Logs :: User VPN Duration

[JasminThejojo]

Hi,

We fetch Checkpoint logs in Qradar. I'm looking for a way to find active ldap users and duration of active vpn from CheckPoint logs.

What is the correct way to do that? 

Any advice would be appreciated.

Best

Jasmin

[PhoneBoy · Accepted solution]

As there is no explicit "log out" logged, there is no way to directly know (short of analyzing all logs generated by the user) which users are currently active and connected.