PulseSecure Content Pack
Download from Github
View on Github
Open Issues
Stargazers
This PulseSecure content pack can be used to collect and enrich your log data for a efficent analyzing and visibility of the user lgoings. This conetent pack only handling messages from your PulseSecure who are related to user logins.
Includes
- UDP Input on port 1514 with a grok extractor
- PulseSecure grok patttern
- “PulseSecure Global” Stream with all extracted messages with one filter rule
- Stream “PulseSecure Failed Logins” contains all messages with status failed based on a filter rule
- Dashboards named “PulseSecure”
Requirements
- A PulseSecure gateway which is forwarding messages to the graylog-server on port 514
- Portforwarding for incoming messages on port 514 to port 1514
- Leading Wildcard Searches enabled in graylog.conf: allow_leading_wildcard_searches = true