cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 7

ASA AnyConnect Dashboad widget to show active sessions

I wanted a quick way to see current logged in AnyConnect users in a simple table. Used the Custom Query Widget and input the following into both the Custom SWQL Query and the Search SWQL Query boxes:

 

SELECT UserName, IPAddress, ConnectedTime
FROM Orion.ASA.RemoteAccessSessions WHERE SessionStatus = 1

 

This gives a very basic table that only works for small environments but will allow you to see who connected, which IP address they were assigned, and when they connected. The additional options can be found under Orion.ASA.RemoteAccessSessions using SWQL Studio.

Table will look like the following image:

seancmills_0-1592588745179.png

 

(No IP address is shown because I am querying an older session just as an example. None of my users are currently using AnyConnect.)

Hopefully this helps somebody out.

Labels (4)
2 Replies
Level 11

I use a couple of similar ones that shows users currently connected and users that have connected in the last day as well as some statistics. 

vpn3.png

To make it searchable you might also try this in the search box of the custom query resource

SELECT UserName, IPAddress, ConnectedTime
FROM Orion.ASA.RemoteAccessSessions WHERE SessionStatus = 1
and (UserName like '%${SEARCH_STRING}%' or IPAddress like '%${SEARCH_STRING}%')
- Marc Netterfield, Github