LogPoint Community

Recently active
Help others

Search query for vulnerability score divided into three different levels.

HI,We are using the Rapid7 fetcher and with the score field I want to make a widget where we divide these score into three different levels namely:Low with a score between 0 and 600. Medium with a score between 600 and 800. High with a score between 800 and 1000.My issue is that I can't find the right search query to let me see this data the way I explained. I hope you may know the right query I need to use to get the result of the divide levels to work.Thanks in advance.

3 days ago

HansHenrikMoerkholtInspiring

Searching & Analytics

LogPoint pySigma Backend

HiJust to draw your attention to this new tool.Though still in preliminary stage, certainly worth trying.GitHub - logpoint/pySigma-backend-logpoint: Logpoint backend for pySigma that enables seamless conversion of Sigma rules into Logpoint queries.

7 days ago

Jerome VosgienLogPoint Team

Masterclass - English

Masterclass - October - Alert Rules

Please find the recording of today’s Masterclass. Thank you for joining in and don't forget to sign up for our next one!Sign up here for the rest of the year: https://www.zoom.us/webinar/83938349142?occurrence=1718094600000

9 days ago

Andreas AndersenNew Participant

Searching & Analytics

File moved and File deleted

Hello Logpoint Community!I’ve recently begun with the process of trying to create a search template to look up a user, and see recently moved files, or recently deleted files. I’m assuming this needs to be two seperate templates.Anyhow, when browsing the file audit logs, I was baffled at the amount of logs generated by moving one file. In our environment, when moving one file, it generates upwards of 14 log entries, all with actions like “requested”, “access” - some log entries have the path of the file, some don’t. Anyways, before I commit what I assume would be a long time trying to create this from scratch, I was wondering if some of you would be able to share a template to look up files moved by a user. In my mind it would look something like this.| Timestamp | Username | File_path_old | File_path_new | Any help at all would be appreciated! Thanks in advance

13 days ago

D. van PuttenNew Participant

Searching & Analytics

Correlate target_id and target_user

Is there an easy way to correlate the target_id and target_user for Windows events that do not have a target_user value?For example: what a user is added to a group, only the target_id is displayed in the event, but we also want to show the target_user in the event or dashboard.

17 days ago

Jerome VosgienLogPoint Team

Masterclass - English

Masterclass - September - Advanced Queries with Enrichment

Please find the recording of today’s Masterclass. Thank you for joining in and don't forget to sign up for our next one! Sign up here for the rest of the year: https://www.zoom.us/webinar/83938349142?occurrence=1718094600000

1 month ago

Julien GarnierNew Participant

Technical FAQs

Playbook not executed when alert is triggered

Hello,I am trying to set up the launch of a plugin when an alert is triggered.My alert appears to be working correctly; I receive an email every time it is executed. According to the documentation, I've set up the trigger on my Logpoint search node like this:SELECT * FROM LogPoint WHERE alertrule_id = 'xxxxxxxxxxxxxxxxxxx' OR name = 'Detection of a Threat 2'I have also tried SELECT * FROM LogPoint WHERE alertrule_id LIKE '%xxxxxxxxxxxxxx%' Unfortunately, when an alert is triggered, the playbook is not executed. Do you have any idea what might be causing this issue? Am I missing something? Regards,Julien

2 months ago

markus.nebel@8com.deBrainy

Design & Architecture

Running LogPoint as Docker Container

I just managed to run LogPoint as a docker image/container.It is relatively simpel and could help improving testing systems, where you want to start from a fresh logpoint for each test, make the desired configurations, run the test and discard the changes at the end.Our use case was developing a unit testing framework for alert rules.Spin up the docker container Configurate repo, routing policy, normalization policy, processing policy, device and syslog collector Configurate the alert rule to test (test object) Send some pre-defined logs via syslog to the docker-logpoint Wait pre-defined time to see if the behaviour of the alert rule is as expected (triggers or doesn’t trigger) Stop the docker container, discarding all changes (configuration, log storage, etc.) Repeat with the next test scenarioHere is what I did to run logpoint in a container. I did this on a linux machine (debian 12) with docker.io installed:Download latest OVA (here logpoint_7.4.0.ova) Extract the OVA (which is a ta

2 months ago

BabuRajeshNew Participant

Configuration

ChatGPT integration

Im trying to integrate chatgpt with logpoint and the chatgpt plug in files that i found on the logpoint website are json files. When I tried upladoing them it says that logpoint plugins font support json files. Has anyone been in a similar situation and/or know what to do.Thankyou

2 months ago

Nirmal UnagarNew Participant

Technical FAQs

Adding IP into LIST

Hi folks, How can I add IP into LIST in playbook? I have created playbook where I am extracting malicious IP and want to add into LIST(SOAR). It would be great if someone have idea which node I should use or any other way?

2 months ago

Martin VorstenboschNew Participant

Searching & Analytics

Search query for vulnerability score divided into three different levels.

3 days ago

Jerome VosgienLogPoint Team

Masterclass - English

Masterclass - October - Alert Rules

9 days ago

Andreas AndersenNew Participant

Searching & Analytics

File moved and File deleted

13 days ago

D. van PuttenNew Participant

Searching & Analytics

Correlate target_id and target_user

17 days ago

Julien GarnierNew Participant

Technical FAQs

Playbook not executed when alert is triggered

2 months ago

BabuRajeshNew Participant

Configuration

ChatGPT integration

2 months ago

Nirmal UnagarNew Participant

Technical FAQs

Adding IP into LIST

2 months ago

Kai GustafsonKnown Participant

Design & Architecture

Has anyone tried getting log data from Topdesk in paticulare auditdata

This is a cloud services and looking for a solution to get data to our onprem LP servers. Regards Kai

2 months ago

Syed Faisal QadriNew Participant

Deployment

search current hash of kaspersky into logpoint

we need to search hash in logpoint of our current endpoint and servers. how we can do that. is there any package we need to install for particular application or anything elsealso we have edr kaspersky and imported its package in logpoint. we are getting teh windows logs only nott he hashes from kaspersky. we need to configure to recieve hashes from kasper sky

3 months ago

Syed Faisal QadriNew Participant

Use–cases

search current hash into logpoint without adding or connecting with threat feeds

we need to search hash in logpoint of our current endpoint and servers. how we can do that. is there any package we need to install for particular application or anything else.

3 months ago

Events Calendar

Community Feedback

Share your feedback or suggestions to improve LogPoint Community.

Leave feedback

Badge winners

Gustav Elkjær Rødsgaardhas earned the badge Valued Contributor
Gustav Elkjær Rødsgaardhas earned the badge Easy talker
Gustav Elkjær Rødsgaardhas earned the badge Conversation starter
Gustav Elkjær Rødsgaardhas earned the badge Innovator
markus.nebel@8com.dehas earned the badge Silver Contributor

Welcome to Logpoint Community

Community Categories

Events Calendar

Badge winners

Leaderboard

Community Statistics

Welcome to Logpoint Community

Community Categories

Events Calendar

Community Feedback

Badge winners

Leaderboard

Community Statistics

Sign up

Already a Partner or Customer? Login with your LogPoint Support credentials. Don‘t have a LogPoint Support account? Ask your local LogPoint Representative. Only visiting? Login with LinkedIn to gain read–access.

Login to the community

Already a Partner or Customer? Login with your LogPoint Support credentials. Don‘t have a LogPoint Support account? Ask your local LogPoint Representative. Only visiting? Login with LinkedIn to gain read–access.

Scanning file for viruses.

This file cannot be downloaded