LogPoint Community

Recently active
Help others

New training platform and events calendar

Logpoint is happy to announce an update to Certified Logpoint training. Please see all upcoming session on logpoint.com under events and have a look at our new training platform Logpoint Academy 🤗On Logpoint Academy you will find some free content and if you have purchased training and received a redemption code from your sales representative, this is the place to enter to unlock your next training course!

9 hours ago

AcAmitNew Participant

Searching & Analytics

distinct_count and followed by Issue while fetching Azure AD sign in logs

Office365 logs are sending duplicate events. So the generic usecase doesnt really work[10 label=User label=Login label=Fail having same user] as s1 followed by [label=User label=Login label=Successful] as s2 on s1.user = s2.user[col_type=office365 label=User label=Login label=Fail | chart distinct_count(id) as CNT by user | filter CNT>2] as s1 followed by [col_type=office365 label=User label=Login label=Successful] as s2 on s1.user = s2.user | chart count() by s2.log_ts,s2.user Here "id" represents request id in azure AD, which is unique and thats what i want.Even if there isn't any output from s1, still I get some result from total query Also, i dont exactly get the followed by event, i get all success events in the timeframe

3 days ago

KazYNew Participant

Technical FAQs

Unable to see some Pre-configured Playbook Guides

Hi,I cannot see following Pre-configured Playbook Guides https://docs.logpoint.com/soar?p=Logpoint&page=Pre-configured%20Playbook%20Guides.Brute Force Detected - Multiple Unique Sources Playbookhttps://docs.logpoint.com/docs/brute-force-detected-multiple-unique-sources-playbook/en/latest/ Credential Dumping - Registry Save Playbookhttps://docs.logpoint.com/docs/credential-dumping-registry-save-playbook/en/latest/ Default Brute Force Attempt Multiple Sources Playbookhttps://docs.logpoint.com/docs/default-brute-force-attempt-multiple-sources-playbook/en/latest/ Password Spray Playbookhttps://docs.logpoint.com/docs/password-spray-playbook/en/latest/ PsExec Tool Execution Detected Playbookhttps://docs.logpoint.com/docs/psexec-tool-execution-detected-playbook/en/latest/All links direct to the page showingPermission DeniedYou don't have the proper permissions to view this page. Please contact the owner of this project to request permission. How can I see these pages?Best,Kaz

110

5 days ago

Ayse AltinsoyLogPoint Team

Masterclass - German

🔮 November 2024 Masterclasses : Intro in das Logpoint pySigma Backend

Wir möchten unseren wertvollen Kunden und Partnern die neuesten Erkenntnisse und Entwicklungen bei Logpoint vermitteln. Daher bieten wir diese Masterclass exklusiv für euch an!In dieser Episode behandeln wir die folgende Agenda:Was sind Sigma-Regeln im SIEM-Kontext? Einführung in das Sigma Open-Source-Framework – https://github.com/SigmaHQ/sigma Logpoint pySigma-Backend – https://github.com/logpoint/pySigma-backend-logpoint Ausblick: Zukunftsvision Jetzt Anmelden -> https://logpoint.zoom.us/webinar/register/WN_3Eh_pY6tQdujYpoEO_AAnw?#/registration

120

7 days ago

Jerome VosgienLogPoint Team

Masterclass - English

Masterclass - October - Alert Rules

Please find the recording of today’s Masterclass. Thank you for joining in and don't forget to sign up for our next one!Sign up here for the rest of the year: https://www.zoom.us/webinar/83938349142?occurrence=1718094600000

341

1 month ago

Martin VorstenboschNew Participant

Searching & Analytics

Search query for vulnerability score divided into three different levels.

HI,We are using the Rapid7 fetcher and with the score field I want to make a widget where we divide these score into three different levels namely:Low with a score between 0 and 600. Medium with a score between 600 and 800. High with a score between 800 and 1000.My issue is that I can't find the right search query to let me see this data the way I explained. I hope you may know the right query I need to use to get the result of the divide levels to work.Thanks in advance.

170

1 month ago

HansHenrikMoerkholtInspiring

Searching & Analytics

LogPoint pySigma Backend

HiJust to draw your attention to this new tool.Though still in preliminary stage, certainly worth trying.GitHub - logpoint/pySigma-backend-logpoint: Logpoint backend for pySigma that enables seamless conversion of Sigma rules into Logpoint queries.

761

1 month ago

Andreas AndersenNew Participant

Searching & Analytics

File moved and File deleted

Hello Logpoint Community!I’ve recently begun with the process of trying to create a search template to look up a user, and see recently moved files, or recently deleted files. I’m assuming this needs to be two seperate templates.Anyhow, when browsing the file audit logs, I was baffled at the amount of logs generated by moving one file. In our environment, when moving one file, it generates upwards of 14 log entries, all with actions like “requested”, “access” - some log entries have the path of the file, some don’t. Anyways, before I commit what I assume would be a long time trying to create this from scratch, I was wondering if some of you would be able to share a template to look up files moved by a user. In my mind it would look something like this.| Timestamp | Username | File_path_old | File_path_new | Any help at all would be appreciated! Thanks in advance

250

1 month ago

D. van PuttenNew Participant

Searching & Analytics

Correlate target_id and target_user

Is there an easy way to correlate the target_id and target_user for Windows events that do not have a target_user value?For example: what a user is added to a group, only the target_id is displayed in the event, but we also want to show the target_user in the event or dashboard.

230

1 month ago

Jerome VosgienLogPoint Team

Masterclass - English

Masterclass - September - Advanced Queries with Enrichment

Please find the recording of today’s Masterclass. Thank you for joining in and don't forget to sign up for our next one! Sign up here for the rest of the year: https://www.zoom.us/webinar/83938349142?occurrence=1718094600000

270

2 months ago

AcAmitNew Participant

Searching & Analytics

distinct_count and followed by Issue while fetching Azure AD sign in logs

3 days ago

KazYNew Participant

Technical FAQs

Unable to see some Pre-configured Playbook Guides

110

5 days ago

Jerome VosgienLogPoint Team

Masterclass - English

Masterclass - October - Alert Rules

341

1 month ago

Martin VorstenboschNew Participant

Searching & Analytics

Search query for vulnerability score divided into three different levels.

170

1 month ago

Andreas AndersenNew Participant

Searching & Analytics

File moved and File deleted

250

1 month ago

D. van PuttenNew Participant

Searching & Analytics

Correlate target_id and target_user

230

1 month ago

Julien GarnierNew Participant

Technical FAQs

Playbook not executed when alert is triggered

Hello,I am trying to set up the launch of a plugin when an alert is triggered.My alert appears to be working correctly; I receive an email every time it is executed. According to the documentation, I've set up the trigger on my Logpoint search node like this:SELECT * FROM LogPoint WHERE alertrule_id = 'xxxxxxxxxxxxxxxxxxx' OR name = 'Detection of a Threat 2'I have also tried SELECT * FROM LogPoint WHERE alertrule_id LIKE '%xxxxxxxxxxxxxx%' Unfortunately, when an alert is triggered, the playbook is not executed. Do you have any idea what might be causing this issue? Am I missing something? Regards,Julien

541

3 months ago

BabuRajeshNew Participant

Configuration

ChatGPT integration

Im trying to integrate chatgpt with logpoint and the chatgpt plug in files that i found on the logpoint website are json files. When I tried upladoing them it says that logpoint plugins font support json files. Has anyone been in a similar situation and/or know what to do.Thankyou

401

3 months ago

Nirmal UnagarNew Participant

Technical FAQs

Adding IP into LIST

Hi folks, How can I add IP into LIST in playbook? I have created playbook where I am extracting malicious IP and want to add into LIST(SOAR). It would be great if someone have idea which node I should use or any other way?

381

3 months ago

Kai GustafsonKnown Participant

Design & Architecture

Has anyone tried getting log data from Topdesk in paticulare auditdata

This is a cloud services and looking for a solution to get data to our onprem LP servers. Regards Kai

292

3 months ago

Events Calendar

Community Feedback

Share your feedback or suggestions to improve LogPoint Community.

Leave feedback

Badge winners

Gustav Elkjær Rødsgaardhas earned the badge Valued Contributor
Gustav Elkjær Rødsgaardhas earned the badge Easy talker
Gustav Elkjær Rødsgaardhas earned the badge Conversation starter
Gustav Elkjær Rødsgaardhas earned the badge Innovator
markus.nebel@8com.dehas earned the badge Silver Contributor

Welcome to Logpoint Community

Community Categories

Events Calendar

Badge winners

Leaderboard

Community Statistics

Welcome to Logpoint Community

Community Categories

Events Calendar

Community Feedback

Badge winners

Leaderboard

Community Statistics

Sign up

Already a Partner or Customer? Login with your LogPoint Support credentials. Don‘t have a LogPoint Support account? Ask your local LogPoint Representative. Only visiting? Login with LinkedIn to gain read–access.

Login to the community

Already a Partner or Customer? Login with your LogPoint Support credentials. Don‘t have a LogPoint Support account? Ask your local LogPoint Representative. Only visiting? Login with LinkedIn to gain read–access.

Scanning file for viruses.

This file cannot be downloaded