Security Compliance

Monitor Cisco VPN Logon / Logoff Activity using SEM

This article provides information on how to monitor Logon and Logoff activity through a Cisco ASA firewall.

First published date

11/29/2018 10:33 PM

Last published date

11/29/2018 10:33 PM

Overview


This article applies to Security Event Manager (formerly Log & Event Manager).

This article provides information on how to monitor Logon and Logoff activity through a Cisco ASA firewall.
 

Product section

Security Event Manager

Resolution

For a list of all Cisco IOS/ASA Syslog events, please see: http://www.cisco.com/c/en/us/td/docs...s/logsevp.html  

According to the document above, the Event ID a WebVPN logon is ASA-6-716001, a WebVPN logoff is ASA-6-716002, and an AnyConnect logon would be ASA-6-113039.

 

You can search for these by creating one of the following queries in nDepth:

SystemStatus.ProviderSID = *716001



SystemStatus.ProviderSID = *716002



SystemStatus.ProviderSID = *113039

 

 

It is also possible that there are VPN-related logon/logoff events that use other Event IDs, such as ASA-4-113004. Please refer to the above Cisco reference page for more information on their Syslog events.