Web & Access

Palo Alto GlobalProtect VPN

Palo Alto Networks GlobalProtect VPN log events covering the full remote access lifecycle — portal prelogin, LDAP/SAML/certificate authentication, gateway configuration, IPSec tunnel establishment, HIP compliance checks, latency monitoring, and session logout.

View on GitHub

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/vpn-paloalto-globalprotect/generator.yml \
  --id vpn-paloalto-globalprotect \
  --live-mode true

Event Types

Event ID	Description	Frequency	Category
portal-prelogin	Portal SSL handshake and auth method discovery	~9.1%	network
portal-auth	User authenticates to GlobalProtect portal (LDAP/SAML/Certificate/RADIUS)	~9.1%	authentication
portal-getconfig	Client retrieves portal configuration and gateway list	~9.1%	configuration
gateway-auth	User authenticates to VPN gateway	~12%	authentication
gateway-auth-failure	Failed gateway authentication attempt	~3%	authentication
gateway-getconfig	Client retrieves gateway VPN configuration	~9.1%	configuration
gateway-setup-ipsec	IPSec tunnel establishment between client and gateway	~9.1%	network
gateway-hip-check	Host Information Profile compliance check	~12%	security
gateway-tunnel-latency	Periodic pre/post-tunnel latency measurement	~12%	network
gateway-config-release	Gateway pushes configuration to connected client	~6.5%	configuration
gateway-logout	VPN session termination with duration tracking	~9%	network

Realism Features

Weighted authentication methods (LDAP 50%, SAML 30%, Certificate 15%, RADIUS 5%)
Correlated device fields (hostname, host ID, serial, MAC, OS platform)
Exponential session duration distribution (mean ~4 hours)
Gaussian latency distributions for tunnel measurements
Multiple gateway locations with priority-based selection
Connect method distribution (pre-logon, user-logon, on-demand, manual)

Sample Output

{
  "@timestamp": "2026-03-06T09:14:32.000000+00:00",
  "event": {
    "action": "globalprotect-gateway-auth",
    "category": [
      "authentication",
      "network"
    ],
    "dataset": "panw.globalprotect",
    "outcome": "success",
    "type": [
      "start"
    ]
  },
  "source": {
    "ip": "198.51.100.87",
    "user": {
      "name": "jdoe",
      "domain": "corp.example.com"
    }
  },
  "observer": {
    "hostname": "PA-GP-01",
    "serial_number": "012345678901",
    "product": "PAN-OS",
    "type": "firewall",
    "vendor": "Palo Alto Networks"
  },
  "paloalto": {
    "globalprotect": {
      "virtual_sys": "vsys1",
      "auth_method": "LDAP",
      "client_os": "Windows",
      "client_version": "6.2.1",
      "connect_method": "user-logon",
      "gateway": "gw-us-east-1"
    }
  }
}

Parameters

Parameter	Default	Description
hostname	PA-GP-01	Firewall hostname
serial_number	012345678901	Firewall serial number
domain	corp.example.com	Corporate domain
virtual_sys	vsys1	Virtual system name
agent_id	a1b2c3d4-...	Filebeat agent ID
agent_version	8.17.0	Filebeat version

Related Generators

Web & Access

Nginx Access & Error Logs

Nginx reverse proxy and web server — access logs with upstream timing, error logs with module context, bot/crawler traffic, scanner probes, and correlated 4xx/5xx error entries.

Web & Access

Apache HTTP Server

Apache httpd access and error logs — page/asset/API requests, bot crawlers (Googlebot, GPTBot), scanner probes, 3xx redirects, and correlated 4xx/5xx error log entries with module context.

Web & Access

Cisco AnyConnect VPN

Cisco ASA AnyConnect SSL VPN — session lifecycle from RADIUS authentication through tunnel establishment, IP assignment, DAP policy evaluation, session roaming between gateways, to graceful disconnection.