Just built an alert system for when VPN user counts spike abnormally

After implementing Barracuda CloudGen Firewall VPN for our remote workforce, I identified a potential blind spot in our security observability: anomalous concurrent user connections. A steady baseline is expected, but a sudden spike could indicate credential stuffing, a compromised account being used from multiple locations, or even a misconfigured client application DDoSing our own VPN gateways. The built-in CloudGen reporting is excellent for historical trends, but I needed real-time alerting with a statistically sound threshold.

I built a monitoring pipeline that extracts VPN user count metrics, applies anomaly detection, and triggers alerts. Here's the core architecture:

* **Data Extraction:** The Barracuda CloudGen REST API (`/api/v1/vpn_status`) is polled every minute via a lightweight Python service. We parse the JSON response to get the total `current_users`.
* **Anomaly Baseline:** Instead of a static threshold, the system maintains a 24-hour rolling window of user counts. It calculates a moving average and standard deviation for the same time-of-day period over the past seven days to account for daily/weekly patterns.
* **Detection Logic:** An alert triggers if the current user count deviates by more than 3 standard deviations from the baseline OR if the absolute change from the previous check exceeds a percentage of our total licensed seats (e.g., a 30% jump in 5 minutes).
* **Orchestration & Alerting:** The service logs each poll with metrics to a dedicated time-series database (we use TimescaleDB). The anomaly logic is a PostgreSQL function. Upon detection, it pushes an alert to a dedicated Slack channel and creates a low-severity incident in PagerDuty for tracking.

Here's the key function that calculates the Z-score anomaly:

```sql
CREATE OR REPLACE FUNCTION check_vpn_anomaly(current_count INT, time_bucket TIMESTAMPTZ)
RETURNS BOOLEAN AS $$
DECLARE
historical_avg FLOAT;
historical_stddev FLOAT;
z_score FLOAT;
BEGIN
SELECT avg(user_count), stddev_samp(user_count)
INTO historical_avg, historical_stddev
FROM vpn_metrics_history
WHERE time_bucket::time = time::time
AND time > time_bucket - INTERVAL '7 days';

IF historical_stddev > 0 THEN
z_score := (current_count - historical_avg) / historical_stddev;
RETURN abs(z_score) > 3.0;
END IF;
RETURN FALSE;
END;
$$ LANGUAGE plpgsql;
```

**Initial Findings & CloudGen Specifics:**
- The API is reliable but required careful handling of the session cookie for authentication. The `current_users` field is consistently accurate.
- We discovered a benign "spike" caused by our CI/CD system spinning up multiple temporary VPN tunnels for load testing, which the system correctly flagged. This was valuable operational insight.
- The main pitfall was not accounting for planned scaling events. We now integrate with our internal calendar API to suppress alerts during known maintenance or rollout windows.

This moves us from reactive to proactive monitoring on a critical perimeter control plane. I'm curious if others in the community have implemented similar anomaly detection for Barracuda VPN or other NGFW platforms, and what metrics beyond raw user count you've found valuable (e.g., failed login rate, geographic distribution of connections).

-- elliot