VPN and SIEM: collection, normalization and event checks

For SIEM, start with UTC time, user ID, event type, outcome and session ID. Test delivery, deduplication and clock synchronization; validate correlation rules with a test event rather than an invented case study.

Key Types of VPN Logs

• Authentication: successful and failed logins, failure reasons (wrong password, MFA denial, forbidden group, device policy non-compliance).
• Sessions: start/stop, duration, assigned IP, inbound/outbound bytes, tunnel protocol, split/full-tunnel mode.
• Administration: configuration changes, certificate updates, firmware uploads, module enable/disable, admin login attempts.
• Infrastructure: interface status, hardware acceleration failures, IPSec errors (negotiations, SA), TLS failures, daemon restarts.

Minimum Normalization Scheme

• event.category: authentication, session, configuration
• event.action: vpn_auth_success, vpn_auth_failure, vpn_session_start, vpn_session_stop, vpn_config_change
• user.name, user.domain, user.id
• src.ip, src.port, src.geo.country, src.asn
• dst.ip (gateway), assigned.ip (client VPN address), session.id
• tunnel.protocol (openvpn, wireguard, ikev2, ssl-vpn, l2tp, sstp), mfa.result, device.os, device.id
• bytes.in, bytes.out, duration, reason, status

Why It’s Critical

• Access Management: visibility into who connects, from where, and when. Combined with IdP, PAM, and EDR for contextual control.
• Threat Detection: password spraying, brute force, impossible travel, sessions from TOR/proxies, traffic spikes, device-policy violations.
• Investigation: reconstruct event timeline, correlate with email, proxy, DNS, and EDR logs.
• Compliance: audit trails, proof of MFA enforcement, access policies, and response measures.

Practical checks

Start with an inventory of users, applications, branches and data flows. Assign access ownership and responsibility for revoking privileges. A VPN supplies a network channel; it does not replace device management, identity, resilience or an assessment of applicable requirements. Do not promise legal compliance based only on a protocol or server country.

Verify compatibility of the exact gateway, client and identity-provider versions before rollout. Allow only required routes and roles; successful authentication must not open the entire network. Use supported MFA, certificate verification and protected secrets storage. Confirm integrations in product documentation rather than assuming support from a technology name.

Pilot with a limited group and test resources. Check normal login, denied access, device changes, user revocation, node failure and recovery. Agree acceptance criteria first: recovery time, permitted loss, application availability and log completeness. Keep the original configuration and a step-by-step rollback. Define the minimum log fields, retention and viewer permissions; avoid unnecessary collection of user traffic content.

Official documentation

• Splunk Documentation