How to Check if a User Accessed an Application such as a VPN in ControlUp

The user asked if it was possible to see if a user had used an application such as a VPN. @member recommended checking stopped processes and authentication logs, then provided a script to check the VPN default gateway. It was suggested that an alert could be set, but the user noted they were looking for a report. An update was provided, detailing how the user found the information they needed by looking at the user’s login and logout times and logs. @member was thanked, and Blair was asked to set up a customer testimonial about it.

Read the entire ‘How to Check if a User Accessed an Application such as a VPN’ thread below:

Good day , Is there way to see if a user used an application Today ?

Eg VPN , if he/she opened it and connected ?

Currently im checking under Application Usage Statistics

Check the stopped processes index

For VPN it is harder, I would look at a recurring script that checks the VPN status and log it to a custom indez

OK , Is it possible to see the Network history of the day , see if the IP changed ?

Hm, not easily I think

For vpn, could you check authentication logs? MFA usage? We check RSA token logs.

Not easily @member?

If you have a traceroute enable for one of your network target, you just need to look for your VPN default gateway with this script:

“`$apikey = ‘APIKEY’

$tenant = ‘TenantName’

Create header

[hashtable]$headers = @{}

$headers.Add(‘x-api-key’, $APIKey)

$page = 1

$results = $null

$TotalResults = $null

$APICallDuration = Measure-Command{

do {

$deviceuri = "https://$[tenant.sip.controlup.com/api/data/traceroute?page=$page&size=5000](http://tenant.sip.controlup.com/api/data/traceroute?page=$page&size=5000)"

$results = Invoke-RestMethod -Method GET -Uri $deviceuri -Headers $headers

$TotalResults += $results.rows

write-output "Retrieved page number $page – ($($results.end_row)/$($results.rows_available))"

$page++

}

until(($results.end_row) -ge ($results.rows_available))

}“`

Sorry, I was thinking "alerting", making it too complicated

The interesting info is here: $TotalResults | where {$_.hop_number -eq 1}

hard to set a condition

The question is more to create a report from what I understand

But for the alert, I guess, this should work…

Hi

This is awesome

Just wanted to provide a small update , and not to make a long story can’t share to much

The users login and logout time and logs gave us the info needed for this incident

But digging around I was able to see if the uses was on the VPN based on the stopped process thanks @member

I’ll get Blair on the case to setup a customer testimonial about it 😄

😄

Continue reading and comment on the thread ‘How to Check if a User Accessed an Application such as a VPN in ControlUp’.  Not a member? Join Here!