- - Knowledge base
Groups
Events

Community
SIEM
Design & Architecture

Design & Architecture

Stay up to date with the latest & greatest

60 Topics
123 Replies

When you subscribe we will email you when there is a new topic in this category

60 Topics

Recently active

Most replies Most views Newest first

markus.nebel@8com.deBrainy

posted in Design & Architecture

Running LogPoint as Docker Container

I just managed to run LogPoint as a docker image/container.It is relatively simpel and could help improving testing systems, where you want to start from a fresh logpoint for each test, make the desired configurations, run the test and discard the changes at the end.Our use case was developing a unit testing framework for alert rules.Spin up the docker container Configurate repo, routing policy, normalization policy, processing policy, device and syslog collector Configurate the alert rule to test (test object) Send some pre-defined logs via syslog to the docker-logpoint Wait pre-defined time to see if the behaviour of the alert rule is as expected (triggers or doesn’t trigger) Stop the docker container, discarding all changes (configuration, log storage, etc.) Repeat with the next test scenarioHere is what I did to run logpoint in a container. I did this on a linux machine (debian 12) with docker.io installed:Download latest OVA (here logpoint_7.4.0.ova) Extract the OVA (which is a ta

1021

2 months ago

Kai GustafsonKnown Participant

asked in Design & Architecture

Has anyone tried getting log data from Topdesk in paticulare auditdata

This is a cloud services and looking for a solution to get data to our onprem LP servers. Regards Kai

282

2 months ago

Yoshihiro IshikawaNew Participant

posted in Design & Architecture

【Japanese language support】We can provide/support Japanease language menu

Dear Team, Since we need to prepare Japanese Web UI we want to provide it then please incorporate into your source code.Japan’s market is really needed to support our own language.Kindly understand our situation and cooperate with it. Could you do that? regards,Yoshihiro

230

3 months ago

Stefano PrunottoNew Participant

asked in Design & Architecture

Logpoint 7.3.0 upgrade stalled

I have uploaded the logpoint 7.3.0 and 7.3.1 pak on logpoint server 7.2.4.I have started the 7.3.0 pak installation but after some hours is still in “installing” stateChecking the status I see that is blocked on SOAR Plugin upgrade …………………...Checking package status ...install; giving etc/, storage/ and var/ to loginspect only in changed filesinstall; removing old filesinstall; copying filesUpdate; updating plugins....Upgrading SOAR plugin I tried to install the 7.3.1 pak that fails because the 7.3.0 is not installed.I have restarted the server but nothing change.Could you please help me to understand the cause?

3964

8 months ago

mimn2gNew Participant

asked in Design & Architecture

Newbie: Distributed Logpoint

hello guys, good daynewbie here and I am taking overed from our previous employee. correct me if I’m wrong since it is still in final design I need to deploy distributed LP in customer environment, we provide them 2 ESXi and this is our 1st customer migrated from Microfocus. The components are: (current)search head x1 distributed logpoint x1 log collector x2 (collect log for on-prem x1, collect log for cloud but sitting on prem)for windows, planning to use LPA and the rest syslogIssue 1:I do some testing and I realized all the API or Cloud Trail configuration directly into DLP. Reason I am thinking, we do not need the LC on this case and the pros is we have the opportunity to turn on SOAR features also increase the specification/storage for DLP.Do I need to turn on this DLP as collector also?Issue 2:license: 325 nodes (300 servers/security/network and 5 API: sophos, office365 and 1: AWS cloud trail)I believed 325 nodes will be installed inside the DLP and but not sure about SH and LC,

1240

10 months ago

bnelaNew Participant

asked in Design & Architecture

Logpoint Health monitoring through Grafana

Hi All, We do have different clients and we want to create a real time monitoring system. Is it possible to integrate it on Grafana, if yes do you have any idea how? i know that monitoring through email is possible but we want a centralized monitoring system Thanks

1150

11 months ago

alekstaKnown Participant

asked in Design & Architecture

LogPoint [AIO] - import syslog from a syslog server

Hello,I have an archive server were I store some syslog/json logs on. I wonder If It’s possible to send over som of these to LogPoint?Is It possible manually to transfer over some of the logs from the archive → Logpoint AIO? Like use scp or something else. I dont find any related documentation related to this.

450

11 months ago

HansHenrikMoerkholtInspiring

posted in Design & Architecture

Sylog message sizing

HiWhat are your opinions on increasing the size of the syslog message.Increasing syslog message size will potentially have a negative impact on the performance in log collection, normalization and parsing.On the other hand it is important to be able to extract the necessary information from collected log messages, and some windows evenLog messages have increased over time.Take for example event ID 4662 ‘An operation was performed on an object’, it can exceed 34000 in message size.Another example is custom application logs, where developers might have another opinion, of what meaningful logs should contain.RegardsHans

1092

1 year ago

Peter StumpfNew Participant

asked in Design & Architecture

Collector not pushing to data node

Hi,I have a distributed system with dedicated collectors. Now, during setup and configuring a few hundred linux servers via rsyslog to send their logs to one collector, the collector suddenly stopped pushing the data further to the data node. I’ve rebooted the collector, which resulted in temporary relief, however after roughly two hours, the problem resurfaced. Using tcpdump on the collector I can see logs streaming in from the log sources (tcp/514), and also on the data node I see openvpn-udp traffic comming in from the IP of the collector - not sure however if in latter I see only tunnel keepalive traffic, as the packages are very small 65-103 byte. I don’t have a clue on how to understand what is going on and where to look at - seems some resource problem to me, in terms of memory or cpu the system is well equipped and bored :-). The thing is, when doing a search over all repos with "collected_at"="myCollectorName" I don’t get any data at all. As if the thing would not exist.Do you

1311

1 year ago

Brian HansenLogPoint Team

posted in Design & Architecture

New Logpoint 7.2.0 is ready

The 7.2.0 version is out. Read about it here: https://servicedesk.logpoint.com/hc/en-us/articles/10065818192669-Logpoint-v7-2-0.During April, Logpoint will host a Webinar giving more insights into the new features. Look for it in your e-mail inbox or here on the Community/ Brian Hansen, Logpoint

4971

1 year ago

markus.nebel@8com.deBrainy

posted in Design & Architecture

New Ideas in Ideas Portal

Hello together!I hope you all look regularly in the idea portal?I have submitted some ideas that I wanted to draw attention to here:Separate SOAR from SIEM Installation- and Update Packages The update and installation packages have grown in size a lot since SOAR was introduced. The idea asks to un-bundle the SOAR package so that you don’t have to transfer and install 1.5 GB of update package, while the SOAR uses 1.4 GB of it. Preselect Dropdown Values if there is only one option In the UI there are some dropdowns where usually you have only one selection option. If so, this should be preselected, so you can save some click-work. Implement Overview for Live Searches It would be helpful to know how fast the responses of the live searches in your system are available to estimate which live searches can be optimized or consume the most resources. Director: Add configuration object overview and filtering In the Director Console UI we need a better overview of all available configuration obj

1031

1 year ago

Douglas AmesinuNew Participant

asked in Design & Architecture

Custom Layout Template in search Master?

Trying to create a custom layout template for a report for a client using the LPSM but unable to.

992

1 year ago

Mads PedersenInspiring

asked in Design & Architecture

Excel Exports contain HTML encoding - How to avoid?

When exporting to Excel the field ‘msg’ contains the same HTML encoding as the GUI.This is how some example data are shown in the GUI: This is how the Excel Speadsheet looks like for the same data: This is the sourcecode for the tabel in the GUI, which shows that it contain the same html <span> tags:Is it possible to get the Excel Export without html encoding in the msg field?Perhaps it could be an option to enable/disable html <tags> in exports in the preferences menu?

12910

1 year ago

Sandesh BushalLogPoint Team

posted in Design & Architecture

Fetching logs from Google Workspace

Some of our customers have requested logs from Google Workspace. The logs requirements range anywhere from email logs to drive usage logs. What features do we have currently to work on these sort of logs?I could not see any features mentioned in the LP Help center. Are we working on this one?

1362

1 year ago

HansHenrikMoerkholtInspiring

posted in Design & Architecture

Universal Normalizer

Think this is good news that should incite more people to take on the task of creating their own normalization packagehttps://servicedesk.logpoint.com/hc/en-us/articles/8874831748253-Universal-Normalizer

1501

1 year ago

Anonymous

posted in Design & Architecture

SAML Authentication v.6.0.1 is now available on the Logpoint Help Center

Dear all, The newest version of the SAML authentication application enabling users to log into LogPoint using the SAML Identity Providers (IdPs) is now publicly released on the Logpoint Help Center. For more information and downloading instructions, please visit the link below.https://servicedesk.logpoint.com/hc/en-us/articles/360002185778

1000

1 year ago

Edgar FastNew Participant

asked in Design & Architecture

Merge Repos

Hi all,we started using LogPoint and created repos for every device type. Now that we have 20+ repos i want to optimize this process and group devices by functionality (e.g. email, remote access). So my intention is to create an new repo for every functionality and modify the routing policies. I think this should work but there is a great time span where i have to search in the “new” and the “old” repo because of retention times of 90 or more days.Is there a smart way to copy the content from one repo to another so that i can get the optimizing done in a short time and this will not take 90+ days?Bestedgar

1624

1 year ago

Andre KurtzInspiring

asked in Design & Architecture

Incident Management - Is it possible to automatically close cases ?

For our customer we currently have several alerts implemented. The customer has a rather small security team only interested in receiving email notification whenever an incident is triggered. So, the build in management incident of LogPoint is not used and all and i delete all open cases on a regular basis.However, for auditing reasons, for some incidents posing a major risk they would now like the security personal to use the incident management system by LogPoint and want them to resolve the cases there. All other incidents should, if possible, not be visible to them. Right now, i would assign these high risk alerts to the security personal so that are able to read and resolve them within LogPoint. Incidents with a lower risk would be assigned to me or a dummy group, and i would continue to regularly delete them manually. But i am wondering whether there is a better way: Does triggering an alert automatically have to create an incident, or is it possible to configure that only alerts

1501

1 year ago

Piotr MorozNew Participant

asked in Design & Architecture

Support Connection GDPR compliance

Hi,can anyone point me to terms & conditions describing compliance with GDPR regarding LogPoint support access using Support Connection functionality in LogPoint & Director? Or description what data can be accessible by support?Best Regards,Piotr

1001

1 year ago

Srijan KafleInspiring

asked in Design & Architecture

Logpoint collector behind NAT

Hi Community, We have a distributed collector in a remote location. We have established a Site-to-site VPN between locations. The scenario is that the IP Address of the collector is in NAT and mapped to a different IP than that of the actual host IP. For E.g the system IP of collector is 172.29.20.80 and the IP of the collector as seen by the Remote Logpoint is 172.22.2.2. We have made the necessary configuration and ensured the Collector is visible in the logpoint. However, the IP as recorded by Logpoint is the actual system IP (Not the IP Logpoint should recognize it as). The issue is the status is Inactive stage. Is this due to the difference in host IP and NAT address?

1407

1 year ago

HeretoforeNew Participant

asked in Design & Architecture

Backup best practices

Hello,I’m designing my backup. So far in the documentation, I’ve read two options: application snapshot and application backup, both are writing to the local disk.Let’s put aside the configuration backup as it’s less than 1 GB. The real challenge comes with backing up repos.In an on-prem infrastructure, backups are stored in the backup infrastructure, with VTL and so on. There’s no way I can request to double the size of the repo disk just to store a consistent backup that I will have, then, to transfer to the backup infrastructure.In a cloud infrastructure, the backup would go directly to the object storage such as S3 Glacier. Neither would we rent a disk space used only during backup, though it might be easier to do in a cloud environment.In addition to the backup and snapshot methods from the documentation, I should add the option of disk snapshot, either from the guest OS or from the disk array (only for on-prem infrastructure). These would provide a stable file system onto which t

6482

1 year ago

Brandon AkalNew Participant

asked in Design & Architecture

Qualys vulnerability management integration

Hello, We’re looking at integrating our Qualys VM scans into our Logpoint instance. I was hoping to pick someone's brain about this. Does this only work on singular Qualys accounts, or will it work on MSSP/Consultant editions? Many thanks,

742

2 years ago

JohannNew Participant

asked in Design & Architecture

LogPoint SIEM HDFS support and configuration

Hi, does Logpoint support HDFS do store data e.g. on an DELL ECS object storage?If yes, how must this be configured in best practice?Thanks.Best Regards,Johann

1421

2 years ago

HansHenrikMoerkholtInspiring

asked in Design & Architecture

device export script

HiToday I have a Python script for exporting devices in to a csv-file with the following fields:device_name,device_ips,device_groups,log_collection_policies,distributed_collector,confidentiality,integrity,availability,timezoneDoes a script exist that also extract the additional fiels:uses_proxy, proxy_ip, hostnameThis will make moving devices from LogPoint 5 to LogPoint 6 considerably more easy. RegardsHans

2829

2 years ago

HansHenrikMoerkholtInspiring

asked in Design & Architecture

The use of certificates in LogPoint

HiI need a description of the usage of cerificates in LogPointWhat are the recomandations?Which certificate are stored where?Which cautions should be taken when replacing certificates?the location of each respective certificateHTTPS Syslog SSL LPARegardsHans

10503

2 years ago

Page 1 / 3

Badge winners

Gustav Elkjær Rødsgaardhas earned the badge Valued Contributor
Gustav Elkjær Rødsgaardhas earned the badge Easy talker
Gustav Elkjær Rødsgaardhas earned the badge Conversation starter
Gustav Elkjær Rødsgaardhas earned the badge Innovator
markus.nebel@8com.dehas earned the badge Silver Contributor

Show all badges

Terms & Conditions Cookie settings

Sign up

Already have an account? Login

Already a Partner or Customer? Login with your LogPoint Support credentials. Don‘t have a LogPoint Support account? Ask your local LogPoint Representative. Only visiting? Login with LinkedIn to gain read–access.

Login to the community

Already a Partner or Customer? Login with your LogPoint Support credentials. Don‘t have a LogPoint Support account? Ask your local LogPoint Representative. Only visiting? Login with LinkedIn to gain read–access.

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.