Skip to main content

Ivanti Pulse Secure VTM

The Pulse Secure Virtual Traffic Manager (VTM) provides application-centric traffic management and load balancing solutions in a range of software, appliance-ready, virtual appliance, and cloud-compute product variants.

Ivanti Pulse Secure VTM

This pack includes Cortex XSIAM content.

Configuration on Server Side

You need to configure the Virtual Traffic Manager (VTM) to forward Syslog messages.

Open the VTM UI;

For forwarding Event logs:

  1. Click the System tab and click Alerting.
  2. In the Alert Mappings section, make sure Audit Events are kept in Syslog (action).
  3. Click the Global Settings tab and click Logging.
  4. Mark the Whether to mirror the audit log to EventID checkbox as Yes.
  5. Under the Apply Changes section, click Update.

Setup for forwarding requests logging per Virtual Server (VS):

  1. Click the Services tab, and under Virtual Servers, select a VS.
  2. Click the Request Logging section for the relevant VS.
  3. Under Remote Request Logging, make sure to preform the following;
    3.1. Mark the checkbox for syslog!enabled as Yes.
    3.2. In the syslog!ipendpoint section, fill the remote IP and Port of your syslog collector.
    3.3. In the syslog!msg_len_ limit section, set the limit for a syslog message to 2048.
    3.4. In the syslog!format section, set the relevant syslog format.
    • For HTTPS, traffic inspection based VSs, select the Simple connection log format.
    • For HTTP, traffic inspection based VSs, select the custom format, input-
      bash %t|%T|%h|%m %U|%{Content-Type}o|%s|%u|%b|%{Cookie}i|%{Referer}i|%{User-Agent}i
  4. In the Apply Changes section, click Update.

Collect Events from Vendor

In order to use the collector, use the Broker VM option.

Broker VM

To create or configure the Broker VM, use the information described here.

You can configure the specific vendor and product for this instance.

  1. Navigate to Settings > Configuration > Data Broker > Broker VMs.
  2. Right-click, and select Syslog Collector > Configure.
  3. When configuring the Syslog Collector, set the following values:
    • vendor as vendor - ivanti
    • product as product - vtm




Cortex XSIAM


CertificationRead more
Supported ByCortex
CreatedJune 18, 2023
Last ReleaseJuly 23, 2023

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.