OpenVPN
Free · OSSVPN & remote access
The classic SMB remote-access VPN — connection + auth events that matter.
OpenVPN homepage ↗The classic OSS VPN — still the #1 remote-access vector for SMBs. Connection + authentication events are critical for credential-stuffing detection on the perimeter.
Code complete and exposed in the dashboard, but rough edges remain. Do not pin compliance claims to this pack.
What it watches
- Connection + disconnection events per user
- Authentication success / failure
- Real-IP → VPN-IP assignment + changes
- Concurrent-session anomalies
- Certificate + config events
MITRE ATT&CK coverage
Tactics this connector gives CyberCLI visibility into.
Every alert this connector surfaces
9 event types
Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix.
The right column shows the operator-friendly phrase the dashboard renders. High-severity
AI-lane signals are summarized in What it watches above (Warden + Herald
handle those); the rest take the substrate's passthrough lane (no AI tokens burned).
| event_type | dashboard renders |
|---|---|
| vpn_connect | VPN client connected on openvpn |
| vpn_disconnect | VPN client disconnected on openvpn |
| vpn_handshake_ok | VPN handshake on openvpn |
| vpn_auth_failed | VPN auth failed on openvpn |
| vpn_cert_failed | VPN cert verify failed on openvpn |
| vpn_tls_failed | VPN TLS handshake failed on openvpn |
| vpn_spoof_anomaly | VPN spoof anomaly on openvpn |
| vpn_server | VPN server activity on openvpn |
| vpn_other | VPN activity on openvpn |
What it helps you catch
What you'd see in CyberCLI
illustrativeCatches credential-stuffing on the #1 SMB remote-access vector by the auth-failure burst.
Routed to Warden (triage) → Knight (detection)
⛓ every step hash-chained · replayable
What CyberCLI reads from OpenVPN
audit our mathOpenVPN's --verb 3 server log is free-form text with one event per line; we parse it into 10 normalized fields. The peer-prefix yields src_ip + src_port + acct (the username from `<user>/<ip>:<port>`), VERIFY lines yield cert_cn, and token-presence classification assigns vpn_event + event_type + rule_level + action across auth/cert/TLS failures, MULTI spoof anomalies, connects, handshakes, and disconnects. Enough to answer who tried to connect, from where, with what cert, and whether the gate held — without going back to the raw log.
Full field index · 10 fields ↓
.action.cybercli_class.cybercli_low_signal.cybercli_parse_status.cybercli_wire_format.event_id.event_type.openvpn_unclassified.rule_level.vpn_event MITRE techniques typically mapped
- T1133 ↗
External Remote ServicesInitial Access · Persistence
- T1110 ↗
Brute ForceCredential Access
- T1078 ↗
Valid AccountsInitial Access · Persistence
- T1021 ↗
Remote ServicesLateral Movement
- T1556 ↗
Modify Authentication ProcessCredential Access · Defense Evasion
- T1090 ↗
ProxyCommand and Control
Trust Ladder ceiling · L0 → L4
- ·L0–L2: digest auth/cert/TLS failures, notify on brute-force patterns and spoof anomalies, summarize the peer's connect history for the case
- ·L3 (Knight verification): geo-IP + reputation lookup on src_ip, correlate the acct/cert_cn with M365 + Wazuh sign-in events — read-only
- ·L4 (Paladin containment, Pro+): peer-IP block at the upstream firewall connector when the OpenVPN server itself has no native peer-ban surface
- ·L5+: revoking the user's cert / pushing a new CRL, disabling the account across identity providers
- ·Any change to the OpenVPN server config, CA, or PKI material — the cert authority stays operator-owned
Full ladder semantics · /trust →
Field count + sample event auto-derived from src/cybercli/connectors/openvpn/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.
Close more of the kill chain
OpenVPN covers 2 of 14 ATT&CK tactics. Pair it with these to widen coverage:
How to connect
- 1 Enable OpenVPN status + management logging.
- 2 Ship logs to CyberCLI (file / syslog).
- 3 Run `cybercli onboard openvpn`.
- 4 Confirm connection events in the dashboard's Connectors panel.
curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh && sudo bash openvpn-install.sh
Fully local. OpenVPN logs ship to CyberCLI over your own network.