Collect Pulse Secure logs

This document describes how you can collect Pulse Secure logs by using a Google Security Operations forwarder.

For more information, see Data ingestion to Google Security Operations overview .

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the PULSE_SECURE_VPN ingestion label.

Configure the Pulse Secure VPN

To configure the Pulse Secure VPN, do one of the following:

• Configure the Pulse Secure VPN version 8.3R3 and earlier
• Configure the Pulse Secure VPN version 8.3R4 and later

Configure the Pulse Secure VPN version 8.3R3 and earlier

1. Sign in to the Pulse Connect Secureconsole.
2. In the Pulse Connect Secureconsole, select System > Log/monitoring > Settings. You can select Settingsfrom the Eventstab, the User accesstab, or the Admin accesstab.
3. In the Select events to logsection, select all the checkboxes that correspond to events.
4. In the Syslog serverssection, do the following:
   1. In the Server name/IPfield, specify the Google Security Operations forwarder IP address.
   2. In the Facilitylist, select LOCAL0. The Facilitylist provides eight facilities: LOCAL0 through LOCAL7 . You can use one of these settings to map facilities on your syslog server.
   3. In the Typelist, select UDPor TCP.
5. Click Add.
6. Optional: To add multiple syslog servers for events, admin access, or user access logs repeat steps 2 to 4.
7. Click Save changes.
8. To ensure that the standard log format is set as default, do the following:
   1. Open the Pulse connect secureconsole.
   2. In the Eventstab, the User accesstab, and the Admin accesstab, set Filtersto Standard.
   3. If the standard filter is not defined as the default filter, click Make default.
   4. Click Save.

Configure the Pulse Secure VPN version 8.3R4 and later

1. In the Pulse connect secureconsole, click the Eventstab, the User accesstab, or the Admin accesstab, and then set Filtersto New filter.
2. In the Filter namefield, enter a name for the filter.

3. In the Export formatsection, select Customand enter the following format in the field:

   [SecureConnect] %date% %time% - %node% - [%sourceip%] %user%(%realm%)[%role%] - %msg%

4. Click Save.

5. Based on your device version to enable syslog configuration, do one of the following:

   • Enable syslog logging on Pulse Secure VPN
   • Enable syslog logging on Ivanti Connect Secure

Enable the syslog logging on Pulse Secure VPN

1. In the Pulse connect secureconsole, select System > Log/monitoring > Settings. You can select Settingsfrom the Eventstab, the User accesstab, or the Admin accesstab.
2. In the Select events to logsection, select all the checkboxes except the HTML5 access, Admission control messages, and Unauthenticated requestscheckboxes.
3. In the Syslog serverfield, enter information about the syslog servers.
4. In the Syslog serverssection, do the following:
   1. In the Server name/IPfield, enter the server name or Google Security Operations forwarder IP address.
   2. In the Facilitylist, select LOCAL0.
   3. In the Filterlist, select the filter that you created earlier.
5. Click Add.
6. Optional: To add multiple syslog servers for events, administrator access, or user access logs repeat steps 2 to 4.
7. Click Save changes.

Enable the syslog logging on Ivanti Connect Secure

1. In the Pulse connect secureconsole, click the Eventstab, the User accesstab, or the Admin accesstab, and then select Filters.
2. Click New filtertab.

3. In the Export formatsection, select Customand enter the following format in the field:

   [SecureConnect] %date% %time% - %node% - [%sourceip%] %user%(%realm%)[%role%] - %msg%

4. Click Save.

5. Click System > Log/monitoring, and then select the Settingstab.

6. In the Maximum log sizefield, specify the maximum log size and select the events to be logged.

7. Specify the server configuration as follows:

   1. In the Server name/IPfield, specify the fully qualified domain name or Google Security Operations forwarder IP address for the syslog server.

      If you select Transport Layer Security (TLS) from the type list, the server name must match the CNin the subjectDNin the certificate obtained from the server.

   2. In the Facilitylist, select a syslog server facility level.

   3. In the Typelist, select the connection type to the syslog server as UDP, TCP, or TLS. TLS uses cryptographic protocols to provide a secure communication.

      If you select TLS, select the installed client certificate to use to authenticate the syslog server. Client certificates are defined in the Configuration > Certificates > Client auth certificateswindow. Client certificates must be installed on the device before they can be used. Contact your certificate authority for the certificate.

   4. In the Filterlist, select Custom.

8. Click Add.

Configure the Google Security Operations forwarder to ingest Pulse Secure logs

1. Select SIEM Settings > Forwarders.
2. Click Add new forwarder.
3. In the Forwarder namefield, enter a unique name for the forwarder.
4. Click Submitand then click Confirm. The forwarder is added and the Add collector configurationwindow appears.
5. In the Collector namefield, type a unique name for the collector.
6. Select Pulse Secureas the Log type.
7. Select Syslogas the Collector type.
8. Configure the following mandatory input parameters:
   • Protocol: specify the connection protocol that the collector uses to listen to syslog data.
   • Address: specify the target IP address or hostname where the collector resides and listens to syslog data.
   • Port: specify the target port where the collector resides and listens to syslog data.
9. Click Submit.

For more information about the Google Security Operations forwarders, see Manage forwarder configurations through the Google Security Operations UI .

If you encounter issues when you create forwarders, contact Google Security Operations support .

Field mapping reference

This parser extracts fields from Pulse Secure VPN logs, handling both Windows Event Logs and syslog formats. It normalizes diverse log structures into a common format, categorizing events like logins, logouts, connections, and policy changes, enriching them with contextual data like user agents, IP addresses, and timestamps.

UDM mapping table

Log Field	UDM Mapping	Logic
action	security_result.action_details	Directly mapped from the action field.
application	principal.application	Directly mapped from the application field.
bytes_read	network.received_bytes	Directly mapped from the bytes_read field and converted to unsigned integer.
bytes_written	network.sent_bytes	Directly mapped from the bytes_written field and converted to unsigned integer.
client_host	principal.hostname , principal.asset.hostname	Directly mapped from the client_host field.
cmd	principal.process.command_line	Directly mapped from the cmd field.
connection_status	security_result.detection_fields.value.string_value	Directly mapped from the connection_status field.
data_time	metadata.event_timestamp.seconds	Parsed from the data_time field using various timestamp formats (MM-dd-yyyy HH:mm:ss Z, RFC 3339, ISO8601, MMM d HH:mm:ss, MMM d HH:mm:ss).
devname	principal.hostname , principal.asset.hostname	Directly mapped from the devname field.
dstip	target.ip , target.asset.ip	Directly mapped from the dstip field.
dstport	target.port	Directly mapped from the dstport field and converted to integer.
dstcountry	target.location.country_or_region	Directly mapped from the dstcountry field if it's not "Reserved" or empty.
duration	network.session_duration.seconds	Directly mapped from the duration field and converted to integer.
dvc	intermediary.hostname or intermediary.ip	If the dvc field can be converted to an IP address, it's mapped to intermediary.ip . Otherwise, it's mapped to intermediary.hostname .
dvc_hostname	intermediary.hostname , principal.hostname , principal.asset.hostname or intermediary.ip , principal.ip , principal.asset.ip	If the dvc_hostname field can be converted to an IP address, it's mapped to the respective IP fields. Otherwise, it's mapped to the respective hostname fields.
event_type	metadata.product_event_type	Directly mapped from the event_type field.
failure_reason	security_result.description	Directly mapped from the failure_reason field. If the message contains "because host", the text "host" is prepended to the failure reason.
has_principal	event.idm.read_only_udm.principal (presence)	Set to "true" if any principal fields are populated, "false" otherwise. Derived by parser logic.
has_target	event.idm.read_only_udm.target (presence)	Set to "true" if any target fields are populated, "false" otherwise. Derived by parser logic.
has_target_user	event.idm.read_only_udm.target.user.userid (presence)	Set to "true" if target.user.userid is populated, "false" otherwise. Derived by parser logic.
host_ip	principal.ip , principal.asset.ip	Directly mapped from the host_ip field.
host_mac	principal.mac	Directly mapped from the host_mac field, replacing hyphens with colons.
http_method	network.http.method	Directly mapped from the http_method field.
http_response	network.http.response_code	Directly mapped from the http_response field and converted to integer.
info_desc	about.labels.value	Directly mapped from the info_desc field.
ip_new	target.ip , target.asset.ip	Directly mapped from the ip_new field.
level	security_result.severity , security_result.severity_details	The security_result.severity is derived from the level field ("error"/"warning" -> HIGH, "notice" -> MEDIUM, "information"/"info" -> LOW). The raw value of level is also mapped to security_result.severity_details .
logid	metadata.product_log_id	Directly mapped from the logid field.
locip	principal.ip , principal.asset.ip	Directly mapped from the locip field.
message	metadata.description	Used to extract various fields using grok and kv filters. If the message contains "EventID", it's processed as a Windows event log.
message_info	metadata.description	Directly mapped to metadata.description if not otherwise used in more specific grok patterns.
msg	metadata.product_event_type , metadata.description	If the msg field is present, the product type is extracted and mapped to metadata.product_event_type , and the remaining message is mapped to metadata.description .
msg_hostname	principal.hostname , principal.asset.hostname	Directly mapped from the msg_hostname field.
msg_ip	principal.ip , principal.asset.ip	Directly mapped from the msg_ip field.
msg_user_agent	network.http.user_agent , network.http.parsed_user_agent , metadata.product_version	The user agent string is mapped to network.http.user_agent , the parsed user agent is mapped to network.http.parsed_user_agent , and the product version (if present) is mapped to metadata.product_version .
network_duration	network.session_duration.seconds	Directly mapped from the network_duration field and converted to integer.
policyid	security_result.rule_id	Directly mapped from the policyid field.
policyname	security_result.rule_name	Directly mapped from the policyname field.
policytype	security_result.rule_type	Directly mapped from the policytype field.
priority_code	about.labels.value	Directly mapped from the priority_code field and also used to derive about.labels.value for the "Severity" key (see Logic).
prod_name	metadata.product_name	Directly mapped from the prod_name field.
product_type	metadata.product_event_type	Directly mapped from the product_type field.
product_version	metadata.product_version	Directly mapped from the product_version field.
proto	network.ip_protocol	Mapped to network.ip_protocol after being converted to an IP protocol name using a lookup.
pwd	principal.process.file.full_path	Directly mapped from the pwd field.
realm	principal.group.attribute.labels.value	Directly mapped from the realm field.
rcvdbyte	network.received_bytes	Directly mapped from the rcvdbyte field and converted to unsigned integer.
remip	target.ip	Directly mapped from the remip field.
resource_name	target.resource.name	Directly mapped from the resource_name field after removing leading/trailing whitespace and hyphens.
resource_status	security_result.description	Directly mapped from the resource_status field.
resource_user_group	principal.user.group_identifiers	Directly mapped from the resource_user_group field.
resource_user_name	principal.user.userid	Directly mapped from the resource_user_name field.
roles	principal.user.group_identifiers	Directly mapped from the roles field.
sentbyte	network.sent_bytes	Directly mapped from the sentbyte field and converted to unsigned integer.
session_id	network.session_id	Directly mapped from the session_id field.
sessionid	network.session_id	Directly mapped from the sessionid field.
srcip	principal.ip , principal.asset.ip	Directly mapped from the srcip field.
srcport	principal.port	Directly mapped from the srcport field and converted to integer.
srccountry	principal.location.country_or_region	Directly mapped from the srccountry field if it's not "Reserved" or empty.
subtype	metadata.product_event_type	Used in conjunction with type to form metadata.product_event_type .
target_file	target.file.full_path	Directly mapped from the target_file field.
target_host	target.hostname , target.asset.hostname	Directly mapped from the target_host field.
target_ip	target.ip , target.asset.ip	Directly mapped from the target_ip field.
target_port	target.port	Directly mapped from the target_port field and converted to integer.
target_url	target.url	Directly mapped from the target_url field.
time	metadata.event_timestamp.seconds	Parsed from the time field using the "yyyy-MM-dd HH:mm:ss" format.
type	metadata.product_event_type	Used in conjunction with subtype to form metadata.product_event_type .
u_event_source_ip	principal.ip , principal.asset.ip or target.ip	If target_ip or target_host are present, u_event_source_ip is mapped to principal.ip and principal.asset.ip . Otherwise, if target_ip , target_host , and target_url are all empty, u_event_source_ip is mapped to target.ip .
u_observer_ip	observer.ip	Directly mapped from the u_observer_ip field.
u_prin_ip	principal.ip , principal.asset.ip	Directly mapped from the u_prin_ip field.
user	target.user.userid	Directly mapped from the user field.
user_agent	network.http.user_agent , network.http.parsed_user_agent	The user agent string is mapped to network.http.user_agent , and the parsed user agent is mapped to network.http.parsed_user_agent .
user_group_identifier	target.user.group_identifiers or principal.user.group_identifiers	Mapped to target.user.group_identifiers in most cases. Mapped to principal.user.group_identifiers in the IP change (USER_UNCATEGORIZED) and Realm restrictions events.
user_ip	principal.ip , principal.asset.ip	Directly mapped from the user_ip field. If empty and u_event_source_ip is not empty, it takes the value of u_event_source_ip .
username	principal.user.userid or target.user.userid	Mapped to principal.user.userid in most cases. Mapped to target.user.userid in some specific scenarios (e.g., when detect_user_logout_failed is false and detect_policy_change_failed is false).
username_removed	target.user.userid	Directly mapped from the username_removed field.
vd	principal.administrative_domain	Directly mapped from the vd field.

metadata.vendor_name , metadata.product_name , metadata.event_type , metadata.log_type , network.ip_protocol , security_result.action , security_result.severity , and extensions.auth.type are derived or set by the parser logic based on the conditions described in the Logic column.

Need more help? Get answers from Community members and Google SecOps professionals.