Help Center Logpoint Docs Idea Portal Logpoint.com

- - Knowledge base
Groups
Events

Community
Search

Unanswered questions

200 Topics

Recently active

Most views Most replies

Georg WittigNew Participant

asked in Searching & Analytics

group logs with same value

Hi everyone, Here is a task that puzzles me: I am looking at events of remote connections and I want to display the connections that are currently active. One Connection has evetns like “login”, “authentication_try”, “session_closed”, etc. and the same session_id. The number of logs with the same session _id may vary, since, for example, there might be more than one authentication_try.So I would like to first group all events with the same session_id and then filter out those, that do not have a “session_closed” event.I tried to implement this with one or two streams (join) but did not come to a solution. With one stream I cannot give an exact number of logs “having same session_id”, with two streams I would need something like “[session_id=*] as first-streamjoin[session_id=*] as second-stream on first-stream.session_id=second-stream.session_id AND first-stream.log_ts!=second-stream.log_ts”. Also a “not followed by” could have been a solution for this, which does not exist. Does any

650

1 year ago

Edgar FastNew Participant

asked in Searching & Analytics

Dynamic Alert Recipient

Hi all,i would like to send an email alert and choose the recipient depending on the triggered alert. For example, when a user changed his active directory password, i want to send him an email, telling that the password for his account was changed and if it was not himself he should contact directly the helpdesk.Bestedgar

971

1 year ago

alekstaKnown Participant

asked in Normalization & Parsing

Re-parse an event for normalization (JSON-event)

Hi !Just a interesting question. I know that other SIEM vendors have problem with this. Maybe LogPoint have a good function for this. So I received a JSON-event that didn’t normalise, due to that no normalization-package was enabled. I enabled this after I received the event. So to my question. Is It possible to parse this event afterwards so that It gets normalized? Or do I have to wait for another event from the same logsource to see If this one gets normalized?

2546

1 year ago

Peter StumpfNew Participant

asked in Design & Architecture

Collector not pushing to data node

Hi,I have a distributed system with dedicated collectors. Now, during setup and configuring a few hundred linux servers via rsyslog to send their logs to one collector, the collector suddenly stopped pushing the data further to the data node. I’ve rebooted the collector, which resulted in temporary relief, however after roughly two hours, the problem resurfaced. Using tcpdump on the collector I can see logs streaming in from the log sources (tcp/514), and also on the data node I see openvpn-udp traffic comming in from the IP of the collector - not sure however if in latter I see only tunnel keepalive traffic, as the packages are very small 65-103 byte. I don’t have a clue on how to understand what is going on and where to look at - seems some resource problem to me, in terms of memory or cpu the system is well equipped and bored :-). The thing is, when doing a search over all repos with "collected_at"="myCollectorName" I don’t get any data at all. As if the thing would not exist.Do you

1371

1 year ago

SubhashNew Participant

asked in Use–cases

Integration with Salesforce Commerce Cloud

Does Logpoint has out of the box integration with Salesforce Commerce Cloud? Has anyone did this from this group? Appreciate if you could help!

281

1 year ago

Olin NGAGOMNew Participant

asked in Use cases

Launch a playbook when an alert is triggered

l have an alert rule that triigers when it detects a web attack like XSS, SQLI.i want my playbook to starts when the alert is triggered. Any idea??

1391

1 year ago

MarketingLogPoint Team

asked in Masterclass - English

Masterclass - Alert Rules

Please find the recording of yesterday's masterclass with the attached presentation deck. Thank you for joining in and don't forget to sign up for our next 4 masterclasses here: https://logpoint.zoom.us/webinar/register/WN_AlKJy3smSxSzX5lmr1wbsA#/registration

370

1 year ago

MicropoleKnown Participant

asked in Operations Monitoring

Information about Disk Storage

Hi,I am reaching out to you regarding an issue I'm experiencing with the disk storage logs. It seems that for the past week, I have not been receiving any logs pertaining to disk storage. I would greatly appreciate it if you could kindly inform me about the possible reasons behind this. Thank you in advance.Siawash

1282

1 year ago

Kai GustafsonKnown Participant

asked in Normalization & Parsing

Have anyone tried to get logs from Kubernetes, maybee a best pratice.

I see that there are no Vendor Apps for Kubernetes, so normalization are maybee going to be written, but how do you get logs to Logpoint, are there a nativ way for this.I found that Auditing of logs are not default turned on, and if they are they only reside for 1 hour. Any one with some god advise in the matter ?Regards Kai

2272

1 year ago

Kamal PaulNew Participant

asked in Use–cases

Help-Query for user logged into multiple systems

Hi,I am looking for a query for finding ‘users logged into multiple machines’. Can someone please help me out.Thanks in Advance,KP

1561

1 year ago

Georg WittigNew Participant

asked in Searching & Analytics

[HOW TO] plot something other than the frequency in search

Dear fellow LogPoint users,I would like to plot a given quantity over time in search and in my dashboards. For example, the GBs of data transferred over time, or the values of a time table. To my understanding chart, as well as timechart does not allow this. These functions only aggregate the number of occurences within the given time-interval (like in a histogram). Is there a way to do this? Best regards,Georg

640

1 year ago

MicropoleKnown Participant

asked in Operations Monitoring

FileRecycled

Hi!I have a question about signification “FileRecycled”. In fact, in my dashboard I see action=FileRecycled but I can’t understand what exacly it means ! Could please explain me what it means ?Thank you in advance for your reply. Best regards,Siawash

993

1 year ago

alekstaKnown Participant

asked in Normalization & Parsing

Windows SCCM send logs to LogPoint

Hi!I’m curious into how to collect logs from SCCM. Logs related to endpoint protection, virus alarms, quarantind threats etc.Found out that nxlog provides a configuration file for this. Missing some fields in the configuration file, example <Output out_syslog>. To point out the syslog dst. Microsoft System Center Configuration Manager :: NXLog DocumentationHas anyone any experience about this?Thankful for replies.

6107

1 year ago

alekstaKnown Participant

asked in Searching & Analytics

PowerExchange Malware backdoor - Exchange servers

Hi!Is there anyone in this community thas has some knowledge about the recently malware backdoors on Microsoft Exchange servers?I would like to investigate this further and do some threat hunting. Does anyone here has some threat hunting querys in LogPoint?

970

1 year ago

MarketingLogPoint Team

asked in Masterclass - German

Masterclass recording - Agent X (German Language)

Hallo zusammen,das Recording der Masterclass vom 17.5.23 zu “Agent X ” finden Sie hier:

500

1 year ago

Ahmad KhilfiNew Participant

asked in Technical FAQs

Capture Raw Logs into SOAR Parameter

Is there a way to capture raw logs and use them as field parameter?

530

1 year ago

Nayan BhattaraiNew Participant

asked in APIs & automation

Jira Integration in LogPoint

Hi team,Has anyone integrate Logpoint SOAR with Jira’s incident management?. The goal is to have two way integration with LP incident to work with Jira’s ticketing system.

1982

1 year ago

alekstaKnown Participant

asked in Normalization & Parsing

Cisco Firepower logs not normalized

Hi!Been struggling with the normalization of Cisco Firepower logs, were I expect better normalization and a better enrichment. The syslog is configured from the Firepower Management Center.Everything should be correct in LogPoint were we’ve put in all the normalization policys for the log source. Compiled Normalizer:- Cisco FirepowerNormalizer- CiscoPIXASACompiledNormalizerNormalization Packages:- LP_Cisco Firepower- LP_Cisco Fiirepower Management Center- LP_Cisco Fiirepower Management Center v6_2- LP_Cisco PIX/ASA Generic- LP_Cisco PIXASAIs there any problem with the format syslog? Had the same issue with CheckPoint FW, but this got solved when we changed the format to CEF. Only the problem that Cisco Firepower only support the format syslog.Is there someone that has any tips on how to move on forward with this?

1822

1 year ago

Ranjan LamaNew Participant

asked in Configuration

how to add remote logpoint through distributed logpoint feature?

Hello community,I am trying to create a connection between two logpoint server. I followed the documentation but I failed to create a connection. First, I created the open door on the remote logpoint and then tried to create a connection from another logpoint server using distributied logpoint feature after entering ip, password and private ip. I get a notification stating its already exists but I don’t see new connection in a list,to a remote logpoint server under distributed logpoint. I further notified IT team to open prot 1194/upd but still no success.IT team can not see any attempts I have made to connect two logpoint servers on their firewall. I would appreciate assistance if anyone in the community have tried this or knows how do it. I had a session with LogPoint but resulted in unsuccessful attempts. thank you very much.Ranjan

1261

1 year ago

alekstaKnown Participant

asked in Use–cases

Cisco Stealthwatch send syslog to LogPoint

Hi!I’m wondering If It’s possible to configure Stealthwatch to communicate with LogPoint. I want Stealthwatch to forward events, even better If It also can forward flows to the SIEM.Is this possbile?All I can find regarding this is the integration with LogPoints SOAR to configure different types of actions.Adding the Vendors — Cisco Secure Network Analytics (Stealthwatch) SOAR Integration latest documentation (logpoint.com)

7855

1 year ago

Birendra SahNew Participant

asked in Searching & Analytics

330

1 year ago

24Solutions SupportNew Participant

asked in Normalization & Parsing

Multi line parser for Java applications.

Hi.We are trying to push multi-line logs to Logpoint, for example a stack trace.They are created by Java applications like Jboss, Tomcat and few more. Where we have some debug information in logs such as content of XML messages processes by the system etc.When such logs are displayed in Logpoint, we need to preserve the line breaks along with indentation to make them readable by a human.Can you please show a complete recipe on how to achieve that?I saw this topichttps://community.logpoint.com/normalization-parsing-43/multi-line-parser-147and understood that there are some pre-compiled normalizers which can be used, can you please explain how they gonna work and how exactly we need to: 1. send logs to Logpoint 2. process logs in logpointIn order to be able to present properly formatted (line breaks and indentation) logs for users who will look for the logs ? Thanks

3553

1 year ago

yashusharmaNew Participant

asked in Use cases

How to Extract Custom SAP Table Modification Logs in SIEM Using LogPoint for SAP?

Hello everyone,I hope this post finds you well. Today, I'd like to discuss how to extract custom SAP table modification logs in SIEM using LogPoint.For those unfamiliar with the concept, SIEM (Security Information and Event Management) is a technology that combines security information management (SIM) and security event management (SEM) to provide real-time analysis of security alerts generated by network hardware and applications.LogPoint is an industry-leading SIEM solution that enables users to collect and analyze log data from various sources, including SAP systems.When it comes to SAP systems, LogPoint can be used to extract modification logs for standard tables. However, for custom tables, some additional configuration is required to ensure that the logs are collected and analyzed properly.Here are the steps you can follow to extract custom SAP table modification logs in LogPoint:Step 1: Enable Change Document ObjectFirst, you need to enable the change document object for your c

1591

1 year ago

MicropoleKnown Participant

asked in Searching & Analytics

meaning of the "count() function"

Hi !I would like to know a little more about the “count() function” in logpoint and it’s meaning. In fact as you can see in screen shot I received a log at 10:42:53 and count() is equal to 53 and theye are normaly 53 logs. But when I clic on this line (log) all of these 53 logs are exactly the same ! what is meaning ? How can I interpret ? Is it just one log (one action realised) ? or theye are really 53 logs (53 actions realised) Thank you in advance for your help. Best regardsSiawash

1992

1 year ago

Aaditya KhatiNew Participant

asked in Use–cases

How to create a case from incident with in-built soar?

I have a requirement of creating cases from incident tabs. Can i get a reference to creating cases from incidents?

1524

1 year ago

Page 3 / 8

Badge winners

Gustav Elkjær Rødsgaardhas earned the badge Valued Contributor
Gustav Elkjær Rødsgaardhas earned the badge Easy talker
Gustav Elkjær Rødsgaardhas earned the badge Conversation starter
Gustav Elkjær Rødsgaardhas earned the badge Innovator
markus.nebel@8com.dehas earned the badge Silver Contributor

Show all badges

Terms & Conditions Cookie settings

Sign up

Already have an account? Login

Already a Partner or Customer? Login with your LogPoint Support credentials. Don‘t have a LogPoint Support account? Ask your local LogPoint Representative. Only visiting? Login with LinkedIn to gain read–access.

Login to the community

Already a Partner or Customer? Login with your LogPoint Support credentials. Don‘t have a LogPoint Support account? Ask your local LogPoint Representative. Only visiting? Login with LinkedIn to gain read–access.

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.