Skip to main content
Help Center Logpoint Docs Idea Portal Logpoint.com

Data-sources (UEBA)

Stay up to date with the latest & greatest

  • 4 Topics
  • 5 Replies
4 Topics
A
Anonymous
posted in Data-sources (UEBA)
Public release of GoogleCloudPlatform v.6.0.0.

Hi All,We are excited to share the release of GoogleCloudPlatform v.6.0.0.Google Cloud Platform (GCP) is a suite of cloud computing services that provides infrastructure as a service, platform as a service and serverless computing environments. Alongside a set of management tools, it offers a series of modular cloud services including computing, data storage,  data analytics and big data processing. To read more on this release, please follow the link below: https://servicedesk.logpoint.com/hc/en-us/articles/8956510332061 

170
A
1 year ago
J
JohannNew Participant
asked in Data-sources (UEBA)
Cisco Ironport eMail Security Appliance integration with UEAB. Why did it not work?

Hi,I´m struggeling with the integration of the Cisco Ironport eMail Security Appliance as UEBA source.The LogPoint documenation - Data Sources For UEBA — UEBA Guide latest documentation (logpoint.com) - indicates the ESA is supported.The corresponding UEBA matching query is  - device_category=Email* sAMAccountName=* receiver=* datasize=* | fields,log_ts,sender,receiver,userPrincipalName,sAMAccountName,datasize,subject,status,file,file_countThe ESA never sends a combination of receiver and datasize. The ESA only logs a combination auf sender and datazize.   The ESA´s  sender & receiver logs are linked only via the MID “message_identifier”Has anyone seen or did  this integration with Cisco´s ESA and UEBA?  Is it running in the correct way? Thanks.BRJohann

4313
J
2 years ago
Nils Krumey
LogPoint Team
Nils KrumeyLogPoint Team
asked in Data-sources (UEBA)
What models are there for the "Active Directory Authentication" in UEBA?

Does anyone have some examples of the models that are used for the “Active Directory Authentication” data source? For example, does this depend on certain Event IDs being present in the logs, and if so how do they map to the models?

851
Jerome Perrin
LogPoint Team
3 years ago
Prabesh Bhatta
LogPoint Team
Prabesh BhattaLogPoint Team
asked in Data-sources (UEBA)
What are currently supported data sources for UEBA ?

One of our customers was asking if it's possible to add VPN logs as a data source for UEBA. 

531
Rupsan Shrestha
LogPoint Team
3 years ago
Terms & ConditionsCookie settings