Skip to main content
Help Center Logpoint Docs Idea Portal Logpoint.com

Knowledge Base

Welcome to the Knowledge Base community space! Here you can find how to guides created by LogPoint experts based on frequently asked support questions. Feel free to suggest topics or share your own best practices!

36 Topics
A
Anonymous
posted in Knowledge base articles
New in KB: How to handle a repo failed issue

We occasionally encounter cases where we cannot perform search because a particular repo has failed. In that situation, the search UI does not allow to make any searches if that repo is selected.What does "repo failed" mean?The "readiness" status of service responsible for searching in a particular repo (indexsearcher) is kept by central searching service (merger) in "alive" field for each repo. If the "alive" status of a repo is false in the config file of merger service, failed repo issue is seen when making search in that repo. This could happen if index searcher service for that repo is not running as expected or if the config file of the merger service is not updated according to the status of indexsearcher service.Mitigation:Whenever we get repo failed for a particular repo then it is always wise to check the logs for the indexsearcher service of that repo. tail -f -n 50 /opt/immune/var/log/service/indexsearcher_<repo_name>/current#replace <repo_name> with actual repo

5485
Matt Ellis
LogPoint Team
1 year ago
Rasmus Heiselberg Porse
LogPoint Team
Rasmus Heiselberg PorseLogPoint Team
posted in Knowledge base articles
Embracing randomness to detect threats through entropy

Hi All, We are excited to share the latest blog post by Logpoint Security Researcher, Bhabesh Raj Rai. In this blog, we explain how Logpoint analysts use randomness calculations through the entropy plugin to create another layer of defense against attackers. To read the full article please follow the link below:https://www.logpoint.com/en/blog/embracing-randomness-to-detect-threats-through-entropy/

550
Rasmus Heiselberg Porse
LogPoint Team
1 year ago
A
Anonymous
posted in Knowledge base articles
Hive hunter: The tools and tactics to track down Hive ransomware 🐝

Hi All,In our latest blog, Logpoint Security Research blackbelt, Rabindra Dev Bhatta guides you through the steps to analyse, and mitigate HIVE ransomware, which as of November 2022 has targeted more than 1,300 businesses globally and have bagged almost US$100 million in ransom.To read the full article, please follow the link below:https://www.logpoint.com/en/blog/tools-and-tactics-to-track-down-hive-ransomware/

300
A
1 year ago
A
Anonymous
posted in Knowledge base articles
A crowning achievement: Exploring the exploit of Royal ransomware

Hi All,We are excited to share our latest blog written by Logpoint Security Researcher, Anish Bogati this time about Royal Ransomware, and the means to detect, investigate and respond to it with the help of Logpoint. To read the full article, please follow the link below:https://www.logpoint.com/en/blog/exploring-the-exploit-of-royal-ransomware/

610
A
1 year ago
A
Anonymous
posted in Knowledge base articles
Save the date for ThinkIn 2023

We are excited to announce the date for our ThinkIn 2023 conference for global Logpoint users and partners. Here’s some key info: Copenhagen, March 7-8, 2023 @Crowne Plaza Copenhagen Towers  As we are currently working on the official agenda, we encourage you to share your ideas on what kind of workshops and keynotes you would like to participate in. All ideas are welcome in the comment section below or via email to customersuccess@logpoint.com. Participation is free of charge. So all you have to do is get to Copenhagen and find a place to stay. Simple!We are looking forward to seeing you. Click here for pre-registration

700
A
2 years ago
A
Anonymous
posted in Knowledge base articles
Welcome!

Focusing on one use case at a time, the Use Case Catalogue will guide you through the implementation of basic monitoring of specific log sources in a Logpoint SIEM platform.  Furthermore, each piece will focus on enabling you to get an overview of already existing alerts and dashboards in your Logpoint platform and how to apply them in your own environment.

470
A
2 years ago
A
Anonymous
posted in Knowledge base articles
A Spool’s Gold: CVE-2022-21999 – Yet another Windows Print Spooler Privilege Escalation

Hi All,SpoolFool, also known as CVE-2022-21999, is a local privilege escalation flaw in Microsoft Windows’ print spooler service, which controls print operations. Read Logpoint´s take on it along with detailed steps to protect your organisation in the article below, written by Nilaa Maharjan.https://www.logpoint.com/en/blog/a-spools-gold-cve-2022-21999-yet-another-windows-print-spooler-privilege-escalation-2/

530
A
2 years ago
A
Anonymous
posted in Knowledge base articles
New in Knowledge Base

Hi All,I would like to draw your attention to a recently released KB article discussing things that need to be looked into if the connection from the collector to backend server isn't being created while working with distributed Logpoints. To read the full article, please follow the link below: https://servicedesk.logpoint.com/hc/en-us/articles/5139550813213-Connection-issues-with-distributed-collector-in-logpoint  

320
A
2 years ago
A
Anonymous
posted in Knowledge base articles
New in KB: How to handle diskfull issues

Occasionally, we encounter issues where one of the mount point in LogPoint is full. The disk full conditions can be because of various reasons and it is of utmost importance to immediately free some disk so that LogPoint can function normally.Under disk full situations for /opt and primary repo path /opt/immune/storage locations, the log collection of LogPoint will be affected. DetectionTo detect the disk full situations, we can use the df command. df -hIn the output of this command, we can either look for the percent usage of each mount point or the available storage space. These indicators will help us detect disk full scenarios.MitigationNow, once we find out the problem in LogPoint is because of lack of storage space, we can dive deeper./opt path has 100% storage usedThe /opt mount point generally stores the necessary config files, service log files, mongoDB data and executables of LogPoint. For normal functioning of LogPoint it is critical to have some storage space available. Sin

13865
Nils Krumey
LogPoint Team
2 years ago
Brian Hansen
LogPoint Team
Brian HansenLogPoint Team
posted in Knowledge base articles
SpringShell - Research conducted on the emerging SpringShell family of vulnerabilities

Read latest blogpost where LogPoint provides an overview of the research conducted on the emerging SpringShell family of vulnerabilities – A Remote Code Execution(RCE) based exploit found in the popular JAVA framework, Spring. The blog post is accompanied by a Logpoint Emerging Threats Protection report, covering detection methods, investigation playbooks, and recommended responses and best practices.Enjoyhttps://www.logpoint.com/en/blog/springshell-not-spring4shell-a-blooming-hype/ / Brian

390
Brian Hansen
LogPoint Team
2 years ago
A
Anonymous
asked in Knowledge base articles
New in KB: How to locate internal logs in LogPoint?

LogPoint stores its internal logs in the /opt/immune/var/log/ directory. Here is the description of the most useful log types inside that directory. Service logs/opt/immune/var/log/service/<service_name>/current This holds the internal service logs for each of the service of LogPoint. The current is the file in which logs are currently being written. The log files are regularly rolled over and are kept in the same directory as current.   Benchmarker Logs/opt/immune/var/log/benchmarker/<service_name>.log This contains the benchmarker data for various services. Not all services are benchmarked but important services like norm_front, normalizers, storehandlers, indexsearchers, premerger, various collector & fetchers have benchmarker data in this location.   System Metrics Logs/opt/immune/var/log/system_metrics/system_metrics.log This contains the operating system metrics that is regularly benchmarked in the system. It contains the information of CPU Usage, Memory Usage, N

5190
A
2 years ago
A
Anonymous
posted in Knowledge base articles
New in KB: How to handle report generation failed ?

When we encounter cases when report fails to generate, There might be several reasons why this happened. Here are the list of things that can be attempted to handle report generation issues:Try running the report again Sometimes, report might fail when there is high load in the system. And just trying to run the report again after sometime might result successful generation of report.    Try increasing the heap_size of the report There is an option in the report template (in the right side) to increase the heap_size of the report job. Large reports (reports with more number of queries and large time ranges) require larger memory. So, increasing the heap_size incrementally from 512 MB to few GBs (up to 4GB) can be helpful.   Try searching for each of the query in the report in search, if they are working fine or not This is kind of a brute force way to figure out the problematic query or query which might be causing the report failure. If any of the repo is down or if any of the query h

3080
A
2 years ago
A
Anonymous
posted in Knowledge base articles
New in KB: Troubleshooting LPAgent issues

Please follow the documentation for LPAgent at https://docs.logpoint.com/docs/logpoint-agent/en/latest/index.html carefully. Sometimes simple steps like processing policy or even the collector/fetcher are missed while configuring devices. Important Considerations for LPAgent:https://docs.logpoint.com/docs/logpoint-agent/en/latest/Important%20Considerations.htmlLogs should be coming into the system in few minutes once the setup is done, but sometimes we don't see any logs in the search. Below we have described few common issues faced on customer environment and their debugging procedures. Service Status:Check if lpagent process is running on windows side & lpa_manager and lpanx_collector services are running on LogPoint. > netstat -nap | egrep ':7998|:7999'____________________________________________________________tcp 0 0 0.0.0.0:7999 0.0.0.0:* LISTEN 30445/lpanx_collecttcp 0 0 10.10.1.74:7999 10.10.1.67:50459 ESTABLISHED 30445/lpanx_collect tcp 0 0 10.10.1.74:7998 10.10.1.6:646

11320
A
2 years ago
A
Anonymous
posted in Knowledge base articles
Logpoint's status on CVE-2022-22965

CVE Summary : A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.CVE Reference : https://nvd.nist.gov/vuln/detail/CVE-2022-22965Logpoint Summary :LogPoint uses spring framework in report engine, to connect with MongoDB using Spring-Mongo api. So, as transitive dependencies, spring-beans-3.1.2.RELEASE.jar is used. LogPoint does not have external exposure with this spring library as we are not using controller and accepting web requests via spring framework. Thus, we are not directly impacted by this vulnerability. We are also safe because of the following:We are not using any spring web framework. We are using Java 8 not Java 9 and beyond. We are not packaging in WAR and not using any servlet containers.DirectorFor LPSM, the impact is the same as for LogPoint. For other components in Director, we are not using spring libraries. We are still using Java 8 all across the product line.SoarCurrently any SOAR containe

610
A
2 years ago
A
Anonymous
posted in Knowledge base articles
New in KB: Ethernet interface name changes on reboot

The predictable naming scheme on interface is disabled due to the line below in grub configurationGRUB_CMDLINE_LINUX="net.ifnames=0 biosdevname=0"as a result the system with more than one network interface cards can change for example eth0 can become eth5 or eth3 can become eth2 and so on across reboots. Reference for getting back legacy scheme here.Note: Following activity requires sudo access/run as root user.Inside  /etc/udev/rules.d/70-persistent-net.rules, change the entry like this with proper mac address:-Include all physical network interfaces:- for example(assuming the system as 6 interfaces). Here eth0 with mac address 28:05:Ca:d8:fc:1a has active link.SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="28:05:Ca:d8:fc:1a", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth0"SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="31:e1:71:6b:68:ad", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="ether1"SUBSYSTEM=="net", ACTION=="ad

2440
A
2 years ago
A
Anonymous
posted in Knowledge base articles
New in KB: Optimization of Process ti() based queries

Process ti is used in Logpoint to use the search time enrichment functionality from the threat intelligence database. This can be done by using | process ti(field_name) in the query.Example:source_address=* | process ti(source_address)  This query will enrich all the logs which match the source_address field with the ip_address column present in the threat_intelligence table. This source_address to ip_address (and other) mappings can be configured from the threat intelligence plugin's configuration settings.  The search query above takes a large amount of time to complete if there are a large number of logs present within the search time frame. We can optimize queries by filtering logs before piping to process ti() part in the query.Example:norm_id=* source_address=* | process ti(destination_address)This query can be optimized by using another query:norm_id=* source_address=* destination_address=* | process ti(destination_address)This query will select only the logs that have destinati

3530
A
2 years ago
Brian Hansen
LogPoint Team
Brian HansenLogPoint Team
posted in Knowledge base articles
Detecting Log4Shell requires more than just a SIEM

I addition to the blog-post about LogPoint and Log4j update here: https://www.logpoint.com/en/blog/status-on-log4j-vulnerability-in-logpoint/ - LogPoint also created another Blog-Post on how a combination of tools and a defense-in-depth mindset will give organizations the ability to detect post-compromise activity and put a stop to the attackRead it here: https://www.logpoint.com/en/blog/detecting-log4shell-requires-more-than-just-a-siem/ Regards,Brian Hansen, LogPointVP, Customer Success    

1440
Brian Hansen
LogPoint Team
2 years ago
A
Anonymous
posted in Knowledge base articles
LPA configuration not being pushed

There may be numerous reasons for the LPA configuration to not be pushed from LogPoint to the agents. The following are some of the things that you can easily check before contacting LogPoint Support.Check if the Windows machine is actually running or not. This might seem trivial, but there are instances where the windows machines are not functioning in the first place. Run the telnet command on the device for port 7994 and 7995. Since these are the ports via which the configurations are pushed, this might be an issue with the lpagents which are deployed on the log source. You can also check if  ports 7994 or 7995 are open on the device's end as well. Verify that the configured device is not configured as NAT IP. If NAT IPs are being used, then the configuration will need to be copied manually to the correct directory; C:\Program Files (x86)\lpagent\conf\lpagent.conf If the configuration is still not being pushed, create a support ticket with the below information: LPAgent log files pr

2163
Kai Albarus
3 years ago
Kai Albarus
Kai AlbarusInspiring
posted in Knowledge base articles
VulnerabilityManagement_5.1.0 Hack - Rapid7 - InsightVM Site Scans

 → I’m not responsible if anyone Brick the System! ←For everyone who is using Rapid7 InsightVM:We upgraded the provided LogPoint Script with the ability to import SITE Scans instead of normal Scan Reports.The Reason is that SITE Scans are scheduled on the IVM so the complete Vulnerability Scan and Import into LogPoint is without any manual interaction - there is no need to run the Report manually.What to do on LogPoint: Just replace the script attached here with the Script installed on your DataNode and configure the Rapid7 integration.What to do on Rapid7 Machine:1. Create user with following permissions:- Appear on Ticket and Report Lists: Appear on user lists in order to be assigned remediation tickets and view reports.- View Site Asset Data: View discovered information about all assets in accessible sites, including IP addresses, installed software, and vulnerabilities.- Create Reports: Create and own reports for accessible assets. Configure all attributes of owned reports, except

1591
A
3 years ago
A
Anonymous
posted in Knowledge base articles
ThinkIn - Alerts and Widgets

Please find the material presented during the 2021 ThinkIn session on Alerts and Widgets attached to this article as well as the complete video recording from the session on Youtube via this link:https://www.youtube.com/watch?v=I2OvY72XtrYThe scripts mentioned during the presentation can also be downloaded from here.A few words on each of the scripts.pm_analyzer.pyThe primary purpose of the pm_analyzer.py script is to provide information about the performance of each livesearch. It is usually run interactively from the shell on systems experiencing performance issues with livesearches - widgets not updating, or alerts not firing as they should.Although the script will need to run for as long as the longest update cycle for any livesearch takes (which it doesn't inform about - yet) to provide complete information on all livesearches - on most systems the issues would probably become evident sooner as the performance would most likely be impacted by resource hogs that are updating freque

1791
P
LogPoint Team
3 years ago
A
Anonymous
posted in Knowledge base articles
Your thoughts on Printnightmare?

Bhabesh Raj,  our Associate Security Analytics Engineer at LogPoint recently shared his thoughts on how to prepare to fend off  PrintNightmare with LogPoint.  Do you have any experience with PrinterNightmare? If so, share your  advise or input for your fellow LogPoint users :) The blog post can be reached on the link below:Preparing your defenses against the terror of PrintNightmare (5 minutes read)

430
A
3 years ago
A
Anonymous
posted in Knowledge base articles
How to correct blank dashboard widgets?

A dashboard can go blank for various reasons,  check the following things to correct the blank dashboard before contacting LogPoint Support.Hit the query that is being used by the dashboard in the search bar and check if it has any matching logs. If you do not find any matching logs, then there is a chance that correct normalization packages are not in place for the corresponding normalization policy. If logs are shown and the dashboard is still blank,  check if the source devices are configured to the correct time zone from the device configuration settings. If  the widget is still empty even after correcting the timezone of a device,  try to add a “dummy dashboard“ or try to edit that specific dashboard. It will trigger the dashboard engine to regenerate the config and also helps to check if there is a problem with a single dashboard or in dashboards in general. If  the widget is still blank, create a support ticket with the below information: The query being used in the dashboard.

2941
Shiva
3 years ago
A
Anonymous
posted in Knowledge base articles
How to configure a new Zpool?

1. Decide the mode you want to configure zpool in (normal, mirror, raidz) and prepare the disks accordingly.2. Set all the disks label to GPT:    parted /dev/sdX   # get disk-id or disk-path from /dev/disk/by-id or /dev/disk/by-path    mklabel gpt3. Create a new zpool with following command:   zpool create -o ashift=12 -O atime=off -O canmount=off -O compression=lz4 data_pool /dev/disk/by-id/<disk-id>   if in raidz mode, at least 3 disks are needed:  zpool create -o ashift=12 -O atime=off -O canmount=off -O compression=lz4 data_pool   raidz /dev/disk/by-id/<disk1-id> /dev/disk/by-id/<disk2-id> /dev/disk/by-id/<disk3-id>  in mirror mode, at least two disks are needed.  zpool create -o ashift=12 -O atime=off -O canmount=off -O compression=lz4 data_pool mirror /dev/disk/by-id/<disk1-id> /dev/disk/by-id/<disk2-id>4. Mount the pool to appropriate mountpoint:   zfs create -o mountpoint=<mount_point>  <poolName>/<filesystemName>eg.  zfs cr

3060
A
3 years ago
A
Anonymous
posted in Knowledge base articles
Creation of a new normalization request

When creating a new normalization request, please include the following information to accelerate the norm package creation process:Name and version of the log source Logging documentation for the version of the log source (can be obtained from the device vendor) Sample logs from the device (The sample logs can be anonymised before being provided on the request) Notes: You can use the following query to extract the un-normalized sample logs from the UI of LogPoint            device_ip='xx.xx.xx.xx' -norm_id=* | norm <ALL:.*> | fields ALL

450
A
3 years ago
A
Anonymous
posted in Knowledge base articles
Logpoint Patch Update Failed

Before running any upgrades, it is always recommended that you go through the release notes, and check up on any important notices that have been included. It is also important that you verify the upgrade pak file's SHA256 present on the release notes to that on LogPoint.If you are using a virtual machine to run LogPoint, it is highly advised that you take a snapshot before running the upgrade. This is to make sure that you have a point to rollback if the upgrade runs into any issues.If the upgrade does fail, please reach out to the LogPoint support team with the output of the following commands provided on a new HelpCenter request:tail -n 20 /opt/immune/var/patches/log/*6.10.0*.log (Replace the version of the LogPoint upgrade which failed) tail -n 20 /var/log/*6.10.0*.log (Replace the version of the LogPoint upgrade which failed)Note: Please do not attempt a server reboot during the upgrade process, unless discussed prior with the support team.

1480
A
3 years ago

Badge winners

Show all badges
Terms & ConditionsCookie settings