Pulse Connect Secure Integration

 { "@timestamp": "2021-10-19T09:10:35.000+02:00", "agent": { "ephemeral_id": "59d9a27c-2780-41a3-b336-00bff722f3ec", "id": "d2a14a09-96fc-4f81-94ef-b0cd75ad71e7", "name": "docker-fleet-agent", "type": "filebeat", "version": "8.13.0" }, "client": { "address": "89.160.20.156", "as": { "number": 29518, "organization": { "name": "Bredband2 AB" } }, "geo": { "city_name": "Linköping", "continent_name": "Europe", "country_iso_code": "SE", "country_name": "Sweden", "location": { "lat": 58.4167, "lon": 15.6167 }, "region_iso_code": "SE-E", "region_name": "Östergötland County" }, "ip": "89.160.20.156" }, "data_stream": { "dataset": "pulse_connect_secure.log", "namespace": "47711", "type": "logs" }, "ecs": { "version": "8.11.0" }, "elastic_agent": { "id": "d2a14a09-96fc-4f81-94ef-b0cd75ad71e7", "snapshot": false, "version": "8.13.0" }, "event": { "agent_id_status": "verified", "category": [ "network" ], "created": "2021-10-19T09:10:35.000+02:00", "dataset": "pulse_connect_secure.log", "ingested": "2024-06-12T03:21:05Z", "kind": "event", "original": "Oct 19 09:10:35 pcs-node1 1 2021-10-19T09:10:35+02:00 10.5.2.3 PulseSecure: - - - 2021-10-19 09:10:35 - pcs-node1 - [89.160.20.156] user.name(REALM)[REALM_ROLES] - Agent login succeeded for user.name/REALM (session:sid74fa8e00ca601280318287f67dfaee7cc6da40db0be6ac75) from 89.160.20.156 with Pulse-Secure/9.1.13.11723 (Windows 10) Pulse/9.1.13.11723.", "outcome": "success", "timezone": "+02:00" }, "host": { "hostname": "pcs-node1" }, "input": { "type": "udp" }, "log": { "source": { "address": "172.19.0.5:42415" } }, "message": "Agent login succeeded for user.name/REALM (session:sid74fa8e00ca601280318287f67dfaee7cc6da40db0be6ac75) from 89.160.20.156 with Pulse-Secure/9.1.13.11723 (Windows 10) Pulse/9.1.13.11723.", "observer": { "ip": [ "10.5.2.3" ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", "vendor": "Pulse Secure" }, "pulse_secure": { "realm": "REALM", "role": "REALM_ROLES", "session": { "id": "sid74fa8e00ca601280318287f67dfaee7cc6da40db0be6ac75" } }, "source": { "address": "89.160.20.156", "as": { "number": 29518, "organization": { "name": "Bredband2 AB" } }, "geo": { "city_name": "Linköping", "continent_name": "Europe", "country_iso_code": "SE", "country_name": "Sweden", "location": { "lat": 58.4167, "lon": 15.6167 }, "region_iso_code": "SE-E", "region_name": "Östergötland County" }, "ip": "89.160.20.156" }, "tags": [ "preserve_original_event", "forwarded", "pulse_connect_secure-log" ], "user": { "name": "user.name" }, "user_agent": { "device": { "name": "Other" }, "name": "Other", "original": "Pulse-Secure/9.1.13.11723 (Windows 10) Pulse/9.1.13.11723", "os": { "full": "Windows 10", "name": "Windows", "version": "10" } } }