PulseSecure Content Pack

PulseSecure Content Pack


Download from Github
View on Github
Open Issues

This PulseSecure content pack can be used to collect and enrich your log data for a efficent analyzing and visibility of the user lgoings. This conetent pack only handling messages from your PulseSecure who are related to user logins.


  • UDP Input on port 1514 with a grok extractor
  • PulseSecure grok patttern
  • “PulseSecure Global” Stream with all extracted messages with one filter rule
  • Stream “PulseSecure Failed Logins” contains all messages with status failed based on a filter rule
  • Dashboards named “PulseSecure”


  • A PulseSecure gateway which is forwarding messages to the graylog-server on port 514
  • Portforwarding for incoming messages on port 514 to port 1514
  • Leading Wildcard Searches enabled in graylog.conf: allow_leading_wildcard_searches = true