This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject
Register Now
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
NetWitness Discussions

Is there an event ID or msg ID for Juniper VPN failed host check

Go to solution
EricSchwartz1
Contributor
Contributor

‎2019-07-18 03:53 PM

I am attempting to find failed login event id for juniper vpn?  Would there be a msg or event id so we can use it in a query

Labels:
0 Likes
1 ACCEPTED SOLUTION

Accepted Solutions

Go to solution
JamesMoon
Frequent Contributor Frequent Contributor
Frequent Contributor

‎2019-07-23 08:47 PM

Hi Eric,

 

These are the messages IDs that are associated with failed/rejected login events as shown in /etc/netwitness/ng/envision/etc/devices/junipervpn/v20_junipervpnmsg.xml.

 

Login failed: 000154, 000155, 000157, 000159, 000160, 000162, 000163, 000165, 000168

Login rejected: 000161, 000164, 000167, 000169

 

Thanks.

View solution in original post

1 REPLY 1

Go to solution
JamesMoon
Frequent Contributor Frequent Contributor
Frequent Contributor

‎2019-07-23 08:47 PM

Hi Eric,

 

These are the messages IDs that are associated with failed/rejected login events as shown in /etc/netwitness/ng/envision/etc/devices/junipervpn/v20_junipervpnmsg.xml.

 

Login failed: 000154, 000155, 000157, 000159, 000160, 000162, 000163, 000165, 000168

Login rejected: 000161, 000164, 000167, 000169

 

Thanks.

© 2022 RSA Security LLC or its affiliates. All rights reserved.