Purpose
This guide explains how to configure the Pulse Secure Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, manage local users and roles, and inspect and terminate active VPN sessions on a Pulse Secure (Ivanti Connect Secure) appliance. Terminating a session is the primary containment action for this integration: it forcibly logs out a user's active VPN connection, for example after detecting a compromised credential being used. This is a Response (action) integration, configured under Settings > Integrations > Responses > +Device.
Prerequisites
- A Pulse Secure / Ivanti Connect Secure appliance with its admin API reachable from the Logsign server.
- An administrator account with permission to manage local users, roles, and active sessions.
- Use least privilege. Create a dedicated administrator role for this integration scoped to user/role/session management if your Pulse Secure version supports restricted admin roles, rather than a full super-admin account.
Step 1: Prepare Pulse Secure for API Access
- Log in to the Pulse Secure / Ivanti Connect Secure admin console with an administrator account.
- Create (or designate) a dedicated administrator account for Logsign to use.
- Note the appliance's hostname/IP and the username/password for the account.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Pulse Secure, click Configure then +Device, and fill in:
| Field | Description |
|---|---|
| Device Name | Free-text label identifying this Pulse Secure device in Logsign. |
| Host | Hostname or IP address of the appliance. |
| Username | The admin account username from Step 1. |
| Password | Password for that account. Stored encrypted at rest. |
All three fields above are functionally required to connect, even though the underlying configuration schema does not mark them with an explicit required flag. Click Create to save the device.
Available Methods
Session management
- get-active-sessions (Analysis) — lists currently active VPN sessions.
- active-session-details-by-username (Analysis) — looks up active session details for a specific username.
- delete-active-session-by-session-id (Containment) — terminates a specific active session by its session ID. This is the primary containment action: it forces the user to reconnect and re-authenticate, immediately cutting off the current VPN session.
User and role management
- create-user — creates a local user.
- delete-user — deletes a local user (useful for immediately revoking access for a compromised or offboarded account, as an alternative or complement to session termination).
- create-user-role — creates a role assignment.
- delete-user-role — removes a role assignment.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong Username/Password. | Re-enter the Username and Password fields and confirm the account can log in to the admin console directly. |
| 403 Forbidden | The account's admin role does not permit user/role/session management. | Confirm the account's assigned role in Pulse Secure includes the permissions this integration needs. |
| delete-active-session-by-session-id fails to find the session | The session ID is stale (the user already disconnected or reconnected, generating a new session ID). | Re-run get-active-sessions or active-session-details-by-username immediately before terminating, to get a current session ID. |
Notes and Limits
- Terminating a session (delete-active-session-by-session-id) does not by itself prevent the user from immediately reconnecting and authenticating again; if you need to fully block access, pair it with delete-user or a role change, or block the account at your identity provider.
- The exact admin console navigation path and role-naming for a least-privilege account were not independently verified against a live Pulse Secure appliance during this research (not independently verified); the field names and method behavior above are taken directly from Logsign's integration code.