Ivanti Connect Secure
You can integrate Ivanti Connect Secure with Sophos XDR so that it sends data to Sophos for analysis.
This page gives you an overview of the integration.
Ivanti Connect Secure product overview
Ivanti Connect Secure (formerly Pulse Connect Secure, and originally Juniper Pulse Secure) is an SSL VPN that provides secure remote access to on-premises and cloud-based corporate resources for remote and mobile users, with per-application and always-on VPN options and identity- and device-based access control.
What we ingest
Sophos XDR collects Ivanti Pulse Secure syslog data by listening for messages your Pulse Secure management interface forwards to a Sophos XDR data collector. The following log categories are collected:
- Authentication and VPN access: User and administrator sign-in, session, and VPN tunnel events.
Event and data types
We ingest the following event and data types from Ivanti Connect Secure:
- Authentication and VPN access: User and administrator authentication, session start and end, and VPN tunnel events, including sign-in successes, failures, logouts, and tunnel termination, with the user and result. Normalized to authentication telemetry.
Data provided by this integration
Data provided by Ivanti Connect Secure gets normalized to the following schemas:
auth
For more information about using schemas in Data Lake Search, see Schemas and logical types.