I have a need to track VPN access outside the country. I have an alert that triggers when someone accesses the VPN from outside the country but I would like to make another search to track the amount of time they have been outside the country based on the event time stamp.
Current search to alert on OCONUS VPN use:
<My search> | iplocation vpn_remote_ip | search Country!="United States" | dedup vpn_user,Country | table _time,vpn_user,Country,vpn_remote_ip
I would like to modify the above search to create a report that would show something like below:
User OCONUS time
User1 15 days
User2 9 days
We need an example of both a VPN start
event and a VPN stop
event.
Try this
<My search> | iplocation vpn_remote_ip | search Country!="United States" | stats earliest(_time) as logintime by vpn_user | eval duration=now()-logintime | eval Day=strftime(logintime,"%m/%d/%Y") | eval duration=tostring(duration, "duration") | rename logintime AS "OCONUS time" | table vpn_user "OCONUS time"
Try this
<My search> | iplocation vpn_remote_ip | search Country!="United States" | eval Day=strftime(_time,"%m/%d/%Y") | stats dc(Day) as "OCONUS time" by vpn_user