Skip to main content

- - Knowledge base
Groups
Events

Welcome to Logpoint Community

Community Categories

SIEM

248 topics
519 Replies

UEBA - User and Entity Behaviour Analytics

13 topics
19 Replies

Other Discussions

33 topics
34 Replies

DIRECTOR

23 topics
27 Replies

Training and Certification

3 topics
3 Replies

SOAR

31 topics
50 Replies

Knowledge Base

36 topics
16 Replies

SAP

14 topics
15 Replies

Recently active
Help others

Jerome VosgienLogPoint Team

Masterclass - English

Masterclass - October - Alert Rules

Please find the recording of today’s Masterclass. Thank you for joining in and don't forget to sign up for our next one!Sign up here for the rest of the year: https://www.zoom.us/webinar/83938349142?occurrence=1718094600000

Martin VorstenboschNew Participant

Searching & Analytics

Search query for vulnerability score divided into three different levels.

HI,We are using the Rapid7 fetcher and with the score field I want to make a widget where we divide these score into three different levels namely:Low with a score between 0 and 600. Medium with a score between 600 and 800. High with a score between 800 and 1000.My issue is that I can't find the right search query to let me see this data the way I explained. I hope you may know the right query I need to use to get the result of the divide levels to work.Thanks in advance.

HansHenrikMoerkholtInspiring

Searching & Analytics

LogPoint pySigma Backend

HiJust to draw your attention to this new tool.Though still in preliminary stage, certainly worth trying.GitHub - logpoint/pySigma-backend-logpoint: Logpoint backend for pySigma that enables seamless conversion of Sigma rules into Logpoint queries.

Andreas AndersenNew Participant

Searching & Analytics

File moved and File deleted

Hello Logpoint Community!I’ve recently begun with the process of trying to create a search template to look up a user, and see recently moved files, or recently deleted files. I’m assuming this needs to be two seperate templates.Anyhow, when browsing the file audit logs, I was baffled at the amount of logs generated by moving one file. In our environment, when moving one file, it generates upwards of 14 log entries, all with actions like “requested”, “access” - some log entries have the path of the file, some don’t. Anyways, before I commit what I assume would be a long time trying to create this from scratch, I was wondering if some of you would be able to share a template to look up files moved by a user. In my mind it would look something like this.| Timestamp | Username | File_path_old | File_path_new | Any help at all would be appreciated! Thanks in advance

D. van PuttenNew Participant

Searching & Analytics

Correlate target_id and target_user

Is there an easy way to correlate the target_id and target_user for Windows events that do not have a target_user value?For example: what a user is added to a group, only the target_id is displayed in the event, but we also want to show the target_user in the event or dashboard.

Jerome VosgienLogPoint Team

Masterclass - English

Masterclass - September - Advanced Queries with Enrichment

Please find the recording of today’s Masterclass. Thank you for joining in and don't forget to sign up for our next one! Sign up here for the rest of the year: https://www.zoom.us/webinar/83938349142?occurrence=1718094600000

Julien GarnierNew Participant

Playbook not executed when alert is triggered

Hello,I am trying to set up the launch of a plugin when an alert is triggered.My alert appears to be working correctly; I receive an email every time it is executed. According to the documentation, I've set up the trigger on my Logpoint search node like this:SELECT * FROM LogPoint WHERE alertrule_id = 'xxxxxxxxxxxxxxxxxxx' OR name = 'Detection of a Threat 2'I have also tried SELECT * FROM LogPoint WHERE alertrule_id LIKE '%xxxxxxxxxxxxxx%' Unfortunately, when an alert is triggered, the playbook is not executed. Do you have any idea what might be causing this issue? Am I missing something? Regards,Julien

markus.nebel@8com.deBrainy

Design & Architecture

Running LogPoint as Docker Container

I just managed to run LogPoint as a docker image/container.It is relatively simpel and could help improving testing systems, where you want to start from a fresh logpoint for each test, make the desired configurations, run the test and discard the changes at the end.Our use case was developing a unit testing framework for alert rules.Spin up the docker container Configurate repo, routing policy, normalization policy, processing policy, device and syslog collector Configurate the alert rule to test (test object) Send some pre-defined logs via syslog to the docker-logpoint Wait pre-defined time to see if the behaviour of the alert rule is as expected (triggers or doesn’t trigger) Stop the docker container, discarding all changes (configuration, log storage, etc.) Repeat with the next test scenarioHere is what I did to run logpoint in a container. I did this on a linux machine (debian 12) with docker.io installed:Download latest OVA (here logpoint_7.4.0.ova) Extract the OVA (which is a ta

BabuRajeshNew Participant

ChatGPT integration

Im trying to integrate chatgpt with logpoint and the chatgpt plug in files that i found on the logpoint website are json files. When I tried upladoing them it says that logpoint plugins font support json files. Has anyone been in a similar situation and/or know what to do.Thankyou

Nirmal UnagarNew Participant

Adding IP into LIST

Hi folks, How can I add IP into LIST in playbook? I have created playbook where I am extracting malicious IP and want to add into LIST(SOAR). It would be great if someone have idea which node I should use or any other way?

Jerome VosgienLogPoint Team

Masterclass - English

Masterclass - October - Alert Rules

Please find the recording of today’s Masterclass. Thank you for joining in and don't forget to sign up for our next one!Sign up here for the rest of the year: https://www.zoom.us/webinar/83938349142?occurrence=1718094600000

Martin VorstenboschNew Participant

Searching & Analytics

Search query for vulnerability score divided into three different levels.

HI,We are using the Rapid7 fetcher and with the score field I want to make a widget where we divide these score into three different levels namely:Low with a score between 0 and 600. Medium with a score between 600 and 800. High with a score between 800 and 1000.My issue is that I can't find the right search query to let me see this data the way I explained. I hope you may know the right query I need to use to get the result of the divide levels to work.Thanks in advance.

Andreas AndersenNew Participant

Searching & Analytics

File moved and File deleted

Hello Logpoint Community!I’ve recently begun with the process of trying to create a search template to look up a user, and see recently moved files, or recently deleted files. I’m assuming this needs to be two seperate templates.Anyhow, when browsing the file audit logs, I was baffled at the amount of logs generated by moving one file. In our environment, when moving one file, it generates upwards of 14 log entries, all with actions like “requested”, “access” - some log entries have the path of the file, some don’t. Anyways, before I commit what I assume would be a long time trying to create this from scratch, I was wondering if some of you would be able to share a template to look up files moved by a user. In my mind it would look something like this.| Timestamp | Username | File_path_old | File_path_new | Any help at all would be appreciated! Thanks in advance

D. van PuttenNew Participant

Searching & Analytics

Correlate target_id and target_user

Is there an easy way to correlate the target_id and target_user for Windows events that do not have a target_user value?For example: what a user is added to a group, only the target_id is displayed in the event, but we also want to show the target_user in the event or dashboard.

Julien GarnierNew Participant

Playbook not executed when alert is triggered

Hello,I am trying to set up the launch of a plugin when an alert is triggered.My alert appears to be working correctly; I receive an email every time it is executed. According to the documentation, I've set up the trigger on my Logpoint search node like this:SELECT * FROM LogPoint WHERE alertrule_id = 'xxxxxxxxxxxxxxxxxxx' OR name = 'Detection of a Threat 2'I have also tried SELECT * FROM LogPoint WHERE alertrule_id LIKE '%xxxxxxxxxxxxxx%' Unfortunately, when an alert is triggered, the playbook is not executed. Do you have any idea what might be causing this issue? Am I missing something? Regards,Julien

BabuRajeshNew Participant

ChatGPT integration

Im trying to integrate chatgpt with logpoint and the chatgpt plug in files that i found on the logpoint website are json files. When I tried upladoing them it says that logpoint plugins font support json files. Has anyone been in a similar situation and/or know what to do.Thankyou

Nirmal UnagarNew Participant

Adding IP into LIST

Hi folks, How can I add IP into LIST in playbook? I have created playbook where I am extracting malicious IP and want to add into LIST(SOAR). It would be great if someone have idea which node I should use or any other way?

Kai GustafsonKnown Participant

Design & Architecture

Has anyone tried getting log data from Topdesk in paticulare auditdata

This is a cloud services and looking for a solution to get data to our onprem LP servers. Regards Kai

Syed Faisal QadriNew Participant

search current hash of kaspersky into logpoint

we need to search hash in logpoint of our current endpoint and servers. how we can do that. is there any package we need to install for particular application or anything elsealso we have edr kaspersky and imported its package in logpoint. we are getting teh windows logs only nott he hashes from kaspersky. we need to configure to recieve hashes from kasper sky

Syed Faisal QadriNew Participant

search current hash into logpoint without adding or connecting with threat feeds

we need to search hash in logpoint of our current endpoint and servers. how we can do that. is there any package we need to install for particular application or anything else.

Events Calendar

Community Feedback

Share your feedback or suggestions to improve LogPoint Community.

Badge winners

Gustav Elkjær Rødsgaardhas earned the badge Valued Contributor
Gustav Elkjær Rødsgaardhas earned the badge Easy talker
Gustav Elkjær Rødsgaardhas earned the badge Conversation starter
Gustav Elkjær Rødsgaardhas earned the badge Innovator
markus.nebel@8com.dehas earned the badge Silver Contributor

Show all badges

Leaderboard

Show full leaderboard

Community Statistics

454: Topics
705: Replies
1,134: Members

Powered by Gainsight

Terms & Conditions Cookie settings

Sign up

Already have an account? Login

Already a Partner or Customer? Login with your LogPoint Support credentials. Don‘t have a LogPoint Support account? Ask your local LogPoint Representative. Only visiting? Login with LinkedIn to gain read–access.

LOGIN AS PARTNER OR CUSTOMER Login with LinkedIn

Login to the community

Already a Partner or Customer? Login with your LogPoint Support credentials. Don‘t have a LogPoint Support account? Ask your local LogPoint Representative. Only visiting? Login with LinkedIn to gain read–access.

LOGIN AS PARTNER OR CUSTOMER Login with LinkedIn

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

OK

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

OK