Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fortigate vpn auth logs config changes #712

Merged
merged 6 commits into from
Feb 7, 2025
Merged

fortigate vpn auth logs config changes #712

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
0ec5e5b
fortigate vpn auth logs config changes
hardikhdholariya Feb 6, 2025
e4271e7
review changes
hardikhdholariya Feb 7, 2025
fbea90b
review changes
hardikhdholariya Feb 7, 2025
a6079d2
action field changes for the fortigate vpn logs
hardikhdholariya Feb 7, 2025
e5726b3
review changes
hardikhdholariya Feb 7, 2025
d153502
review changes
hardikhdholariya Feb 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion cyences_app_for_splunk/default/data/ui/views/cs_asset_intelligence.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -339,7 +339,7 @@
<search>
<query>| tstats `cs_summariesonly_authentication` values(Authentication.src) as src_ip from datamodel=Cyences_Authentication where Authentication.dest_category="vpn_auth" AND $tkn_filter_authentication$ AND `cs_vpn_indexes` by _time Authentication.action Authentication.user span=1s | rename Authentication.* as *
| iplocation src_ip
| eval Country = if(isnull(Country) OR Country="", "Unknown", Country)
| eval Country = if(isnull(Country) OR Country="", "Unknown", Country), action = if(action="added", "success", action)
| eval City = if(isnull(City) OR City="", "Unknown", City) | fields _time user action src_ip City Country
| rename user as User, action as Status, src_ip as "SourceIP"
| sort - _time</query>
Expand Down
3 changes: 2 additions & 1 deletion cyences_app_for_splunk/default/data/ui/views/cs_vpn_reports.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
<query>
| tstats `cs_summariesonly_authentication` values(Authentication.src) as src_ip from datamodel=Cyences_Authentication where Authentication.dest_category="vpn_auth" AND `cs_vpn_indexes` by _time Authentication.action Authentication.user Authentication.dest span=1s
| rename Authentication.* as *
| eval action=if(action="added", "success", action)
</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
Expand Down Expand Up @@ -231,7 +232,7 @@
<table>
<title>Successful Session</title>
<search>
<query>`cs_vpn_indexes` dest_category="vpn_auth" action="success" user IN $User$ dest=$tkn_dest$ src=$tkn_public_ip$
<query>`cs_vpn_indexes` dest_category="vpn_auth" action IN ("success", "added") user IN $User$ dest=$tkn_dest$ src=$tkn_public_ip$
| fields _time dest user action private_ip src City Country
| eval private_ip = if(private_ip="0.0.0.0", null(), private_ip)
| fillnull value="Unknown" private_ip
Expand Down
12 changes: 6 additions & 6 deletions cyences_app_for_splunk/default/eventtypes.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,14 +30,14 @@ search = sourcetype="pan:system" object="RSA_Radius" dest_category="radius_auth"
#####################
### Fortigate VPN ###
#####################
[cs_fortigate_vpn_auth]
search = sourcetype IN ("fgt_event", "fortigate_event") subtype="vpn" vendor_action IN ("negotiate", "ssl-login-fail")
[cs_fortigate_vpn_login]
search = sourcetype IN ("fgt_event", "fortigate_event") subtype="vpn" AND ((vendor_action="tunnel-up" AND reason="login successfully") OR vendor_action="ssl-login-fail")

[cs_fortigate_vpn_start]
search = sourcetype IN ("fgt_event", "fortigate_event") subtype="vpn" vendor_action IN("tunnel-up", "install_sa", "ssl-new-con", "ssl-web-pass")
[cs_fortigate_vpn_connected]
search = sourcetype IN ("fgt_event", "fortigate_event") subtype="vpn" vendor_action IN ("tunnel-up") reason="login successfully"

[cs_fortigate_vpn_end]
search = sourcetype IN ("fgt_event", "fortigate_event") ((subtype=vpn AND vendor_action IN("tunnel-down", "delete_ipsec_sa", "ssl-web-close")) OR (logid=0107045061 AND connection_type="sslvpn"))
[cs_fortigate_vpn_logout]
search = sourcetype IN ("fgt_event", "fortigate_event") subtype="vpn" vendor_action IN ("tunnel-down") logdesc="SSL VPN tunnel down"


#################
Expand Down
2 changes: 1 addition & 1 deletion cyences_app_for_splunk/default/macros.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -611,7 +611,7 @@ iseval = 0

[cs_current_week_login_count_vpn]
definition = eval main_event="1" \
| append [ | tstats count, values(Authentication.org_country) as org_country from datamodel=Cyences_Authentication where Authentication.dest_category="vpn_auth" AND Authentication.action="success" AND Authentication.user!="unknown" AND `cs_public_ips(Authentication.src)` AND earliest="@w" latest="@d" by Authentication.app, Authentication.user, Authentication.src \
| append [ | tstats count, values(Authentication.org_country) as org_country from datamodel=Cyences_Authentication where Authentication.dest_category="vpn_auth" AND Authentication.action IN ("success", "added") AND Authentication.user!="unknown" AND `cs_public_ips(Authentication.src)` AND earliest="@w" latest="@d" by Authentication.app, Authentication.user, Authentication.src \
| `cs_drop_dm_object_name(Authentication)` \
| iplocation src \
| eval Country = if(isnotnull(org_country), org_country, Country) \
Expand Down
6 changes: 3 additions & 3 deletions cyences_app_for_splunk/default/props.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,13 +210,13 @@ EXTRACT-src_ip_for_radius = \sfrom \'(?<src_ip>[^\']+)\',

[fgt_event]
# fgt_event for old Fortigate Add-on (1.6.2)
EVAL-dest_category = if(subtype="vpn" AND vendor_action IN ("negotiate", "ssl-login-fail"), "vpn_auth", dest_category)
EVAL-dest_category = if(subtype="vpn" AND ((vendor_action="tunnel-up" AND reason="login successfully") OR vendor_action="ssl-login-fail"), "vpn_auth", dest_category)


[fortigate_event]
# fortigate_event for the new Fortigate Add-on (1.6.5)
EVAL-dest_category = if(subtype="vpn" AND vendor_action IN ("negotiate", "ssl-login-fail"), "vpn_auth", dest_category)
# Note - eval action is not working because Fortigate Add-on's lookup is overriding the action field, hence we need to make changes in the data-model definition
EVAL-dest_category = if(subtype="vpn" AND ((vendor_action="tunnel-up" AND reason="login successfully") OR vendor_action="ssl-login-fail"), "vpn_auth", dest_category)
# Note - eval action is not working because Fortigate Add-on's lookup is overriding the action field, hence we need to make changes in the data-model & dashboard queries
# action field update in the Authentication data-model -> case(sourcetype="fgt_event" AND subtype="vpn" AND vendor_action IN ("tunnel-up", "phase2-up"), "success", sourcetype="fgt_event" AND subtype="vpn" AND vendor_action="ssl-login-fail", "failure", isnull(action) OR action="", "unknown", 1==1, action)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need to change this as per new logic for action field - failure & success?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

as per note, action field is overriding from fortigate addon. so I'm testing it and after will change.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's write a note here that fortigate Add-on is overriding the action field, hence we are not writing the props config here and instead writing it in the data-model & dashboard queries.



Expand Down
8 changes: 4 additions & 4 deletions cyences_app_for_splunk/default/savedsearches.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5786,7 +5786,7 @@ display.page.search.tab = statistics
display.page.search.mode = fast
request.ui_dispatch_app = cyences_app_for_splunk
request.ui_dispatch_view = search
search = | tstats `cs_summariesonly_authentication` count from datamodel=Cyences_Authentication where Authentication.dest_category="vpn_auth" AND Authentication.action="success" AND `cs_public_ips(Authentication.src)` by Authentication.app, Authentication.user, Authentication.src, Authentication.dest, _time \
search = | tstats `cs_summariesonly_authentication` count from datamodel=Cyences_Authentication where Authentication.dest_category="vpn_auth" AND Authentication.action IN ("success", "added") AND `cs_public_ips(Authentication.src)` by Authentication.app, Authentication.action, Authentication.user, Authentication.src, Authentication.dest, _time \
| `cs_drop_dm_object_name(Authentication)` \
| eval user = lower(user) \
| iplocation src \
Expand All @@ -5798,11 +5798,11 @@ search = | tstats `cs_summariesonly_authentication` count from datamodel=Cyences
| `cs_authentication_successful_vpn_login_from_unusual_country_filter`
action.cyences_notable_event_action = 1
action.cyences_notable_event_action.param.filter_macro_name = cs_authentication_successful_vpn_login_from_unusual_country_filter
action.cyences_notable_event_action.contributing_events = index=* `cs_vpn_indexes` tag=authentication action="success" dest_category="vpn_auth" `cs_public_ips(src)` | iplocation src | `cs_country_login_percentage`
action.cyences_notable_event_action.contributing_events = index=* `cs_vpn_indexes` tag=authentication action IN ("success", "added") dest_category="vpn_auth" `cs_public_ips(src)` | iplocation src | `cs_country_login_percentage`
action.cyences_notable_event_action.system_compromised_search = | stats count by dest
action.cyences_notable_event_action.system_compromised_drilldown = index=* `cs_vpn_indexes` dest=$row.dest$ tag=authentication action="success" dest_category="vpn_auth" `cs_public_ips(src)` | iplocation src | `cs_country_login_percentage`
action.cyences_notable_event_action.system_compromised_drilldown = index=* `cs_vpn_indexes` dest=$row.dest$ tag=authentication action IN ("success", "added") dest_category="vpn_auth" `cs_public_ips(src)` | iplocation src | `cs_country_login_percentage`
action.cyences_notable_event_action.attacker_search = | stats count by user
action.cyences_notable_event_action.attacker_drilldown = index=* `cs_vpn_indexes` user=$row.user$ tag=authentication action="success" dest_category="vpn_auth" `cs_public_ips(src)` | iplocation src | `cs_country_login_percentage`
action.cyences_notable_event_action.attacker_drilldown = index=* `cs_vpn_indexes` user=$row.user$ tag=authentication action IN ("success", "added") dest_category="vpn_auth" `cs_public_ips(src)` | iplocation src | `cs_country_login_percentage`
action.cyences_send_email_action = 1
action.cyences_notable_event_action.products = VPN
action.cyences_notable_event_action.teams = SOC, Compliance
Expand Down
6 changes: 3 additions & 3 deletions cyences_app_for_splunk/default/tags.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,17 +39,17 @@ end = enabled
#####################
### Fortigate VPN ###
#####################
[eventtype=cs_fortigate_vpn_auth]
[eventtype=cs_fortigate_vpn_login]
authentication = enabled
vpn = enabled

[eventtype=cs_fortigate_vpn_start]
[eventtype=cs_fortigate_vpn_connected]
vpn = enabled
network = enabled
session = enabled
start = enabled

[eventtype=cs_fortigate_vpn_end]
[eventtype=cs_fortigate_vpn_logout]
vpn = enabled
network = enabled
session = enabled
Expand Down