1 Reply Latest reply on Jan 15, 2014 3:26 PM by mepplin

    HIPAA Report - All VPN Logins

    docdriza

      I am trying to review data from the All VPN Logins report in the HIPAA compliance dashboard view. I am not able to see data in this view, but I can see on my asa events that users are connecting to the VPN. I can see this through the "AAA user successfully connected" event. When I review the query on this view, I see a filter on Device type ID with [CLASS:VPN] selected. Is there something that I am missing? Do i need to classify my ASAs?

        • 1. Re: HIPAA Report - All VPN Logins
          mepplin

          The ASA would be classified as a Firewall and not a VPN. The report will make a nice template but you will need to modify it to meet your needs. I would suggest you add filters to the dashboard query to accomplish this. The following steps should help.

           

          1. Open the view, and select the Count - VPN Login Events element.

          2. To the right select edit query.

          3. From the Query Wizard select filters.

          4. Scroll to the device class and add firewall to the filter list shown.

          5. The normalized ID shown is for the login group, so this should be correct as the events you are looking for will be normalized as a 'login'.

          6. From the Query Wizard select finish.

           

          You should be able to see those events now. If you find you have other firewall events for console logins and other types, you may need to get the correct signature ids for the AAA event and add those to the filter list.