Skip to main content
Help Center Logpoint Docs Idea Portal Logpoint.com

Unanswered questions

200 Topics
M
MicropoleKnown Participant
asked in Use–cases
Why this error message ? '}'

Hi,I come to you because I have an error when I execute folloing query. Could any one help me please ? Here is my quary : (MsWinEventLog OR norm_id=WinServer*) label=Object label=Access  (access_list=\"*4417*\" OR access=\"*WriteData*\") {{user},}, {{fileshare},}, {{path},},  -relative_target in SYSTEM_PATHS | rename relative_target as Object, share_path as Path |  chart count() by user, device_name, object_type,Path, Object | fields user, device_name, object_type, Path, Object and when I execute this query I receive these error message : Thanks in advanceLooking forward to reading you

512
M
1 year ago
A
Aaditya KhatiNew Participant
asked in Use–cases
Has anyone been able to integrate TheHive for managing cases ?

I am trying to create a use case where i can connect TheHive with LP. Lets discuss if anyone has been able to or planning to do this

79213
L
1 year ago
S
Srijan KafleInspiring
asked in Searching & Analytics
Count number of entries in Dynamic list

How can we count number in entries in dynamic list?

784
S
1 year ago
S
Srijan KafleInspiring
asked in Searching & Analytics
Delete an entry from Table

I have a table that is populated frequently using query scheduled in the report. I am trying to remove an entry from the table. How can this be achieved.

1182
S
1 year ago
M
MicropoleKnown Participant
asked in Use–cases
Adding a Search Template

Hi,I would like to add a new parameters templete. But when I add the new parameter it doesn't works (for exemple when I add the source_address it doesn't works) ? I would like to know why ? Thank you in advance for your help. 

1844
M
1 year ago
A
Aaditya KhatiNew Participant
asked in Searching & Analytics
Split same field values into two fields.

If i have an event_category= User, Logon. I want to be able to create new fields (e.g. X, Y) and present data like X=User and Y=Logon. What would be the query to showcase this in result.

921
Mike Blomgren
LogPoint Team
1 year ago
C
CarstenNew Participant
asked in Searching & Analytics
Add more Information to a Report

Hi there,i’m new using Logpoint. So i need some help for a search i would like to do. I would like to add some more information to the search “Top 10 User in Failed Kerberis Authentication” there i would like to add on which workstation the user have tryed to logon.

814
Rasmus Heiselberg Porse
LogPoint Team
1 year ago
H
HeretoforeNew Participant
asked in Design & Architecture
Backup best practices

Hello,I’m designing my backup. So far in the documentation, I’ve read two options: application snapshot and application backup, both are writing to the local disk.Let’s put aside the configuration backup as it’s less than 1 GB. The real challenge comes with backing up repos.In an on-prem infrastructure, backups are stored in the backup infrastructure, with VTL and so on. There’s no way I can request to double the size of the repo disk just to store a consistent backup that I will have, then, to transfer to the backup infrastructure.In a cloud infrastructure, the backup would go directly to the object storage such as S3 Glacier. Neither would we rent a disk space used only during backup, though it might be easier to do in a cloud environment.In addition to the backup and snapshot methods from the documentation, I should add the option of disk snapshot, either from the guest OS or from the disk array (only for on-prem infrastructure). These would provide a stable file system onto which t

6652
Rupsan Shrestha
LogPoint Team
2 years ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Searching & Analytics
Display List Elements like Tabel?

It is possible to use the search queryTable TABLE_NAMEto list the content of the table “TABLE_NAME”.But there seems to be no possibility to do the same with a list.Or did I miss something?

2363
P
LogPoint Team
2 years ago
Nicolai Thorndahl
LogPoint Team
Nicolai ThorndahlLogPoint Team
asked in Searching & Analytics
Searching for special characters in fields like the wildcard star "*"

When searching for special characters in field values in Logpoint just pasting them in a regular Key = valueexpression, can often result in searches not working as intended from the users perspective as the Logpoint search language will interpret the character differently from the intention.For instance searching for fields with a star “*” character results in getting all results that has a value in that specific key, as Logpoint uses the star “*” as a wildcard character, which basically means “anything”.  key = * will result in all logs with a field called keyInstead of using they kay value pairs to search we can use the builtin command match to find any occurrences of the value that we are looking for. In this example we will search for the star “*” frequently referred to as wildcard. We have some logs that have a field called policy in which we would like to find all occurrences of the character star “*” . To do this we first ensure that the policy field exists in the logs that we s

5571
markus.nebel@8com.de
2 years ago
A
Anonymous
asked in Masterclass - English
Masterclass d. 11 October - Logpoint for SAP

Sign up for our masterclass on Logpoint for SAP here: https://logpoint.zoom.us/webinar/register/WN_JGxEHTamQvq-O5OLoSJYtw  Learn:What can happen to your business if your SAP system is compromised, including failure of SAP audits and loss of IP? Why is SAP seen as a blindspot in any security strategy? Incorporating SAP into a cybersecurity platform that includes SIEM, SOAR and UEBA can provide consistent insight into what is happening across the organization.

381
HansHenrikMoerkholt
2 years ago
B
Brandon AkalNew Participant
asked in Design & Architecture
Qualys vulnerability management integration

Hello, We’re looking at integrating our Qualys VM scans into our Logpoint instance. I was hoping to pick someone's brain about this. Does this only work on singular Qualys accounts, or will it work on MSSP/Consultant editions? Many thanks,

742
Nils Krumey
LogPoint Team
2 years ago
A
Anonymous
asked in Masterclass - German
Masterclass Recording - Converged SIEM

Hallo zusammen,das Recording der Masterclass vom 07.9.22 zu “Converged SIEM” finden Sie hier: 

580
A
2 years ago
Ash Scott
Ash ScottInspiring
asked in Use–cases
Passing parameters within a Playbook Trigger?

Hi folks, I’m trying to set up a Playbook Trigger, but wanted to potentially pass through parameters for it.The setup is as follows:Alert is triggered Playbook Trigger runs based on matching alert_id Playbook generates case data and runs additional actions/playbooks.I would (ideally) like the Playbook Trigger to pass details from the incident to the Playbook it is linked to.Is this something that’s possible from the Trigger directly, or do I need to use a Query/another action within the Playbook to try and extract the info I need?On that note, is there an easy way to get data from the incident that triggered the alert within the playbook itself?

1121
Ash Scott
2 years ago
J
JohannNew Participant
asked in Design & Architecture
LogPoint SIEM HDFS support and configuration

Hi, does Logpoint support HDFS do store data e.g. on an DELL ECS object storage?If yes, how must this be configured in best practice?Thanks.Best Regards,Johann

1461
Nils Krumey
LogPoint Team
2 years ago
S
Syed Faisal QadriNew Participant
asked in Deployment
Integrating the logs from kaspersky

we need to send the kapsersky logs into logpoint. we have configured the kapsersky to send events to logpoint machine through syslog port 514 and protocol is UDP, but it does not send the logs. need help.

1282
Nils Krumey
LogPoint Team
2 years ago
zana
zanaNew Participant
asked in Technical FAQs
Where the to find detail about type of log can be collect from different device

Hi,I want to know the information about all the data/logs that will be captured by LOGPOINT SIEM from different devices such as Firewall the logpoint SIEM can captures is syslog. So how about the others supported device/sources such as workstation /switches ?  and where in Logpoint site/portal that we can to find this info?Actually we want to list out detail for every device that can give us easy to forward log to logpoint siem.

782
Prabesh.B
LogPoint Team
2 years ago
L
Lucky SinghNew Participant
asked in Other Discussions
User account privileges escalation

is their a method or can their be method, where you can set your user accounts in log point as standard account, when someone need to complete any administrative task a ticket/token can be raised, with time frame limit.  where manager/third person can either approve or reject it request to escalate current of the user account from standard to admin. For account tracking and better account visibility.  Just as in Microsoft 365 security or MDE security portal.

532
Rupsan Shrestha
LogPoint Team
2 years ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Design & Architecture
Does the Open Door use the Syslog Collector TLS Certificate?

Wir haben einen Kunden, der das neue Feature zum Hochladen der SSL/TLS Zertifikate für den Syslog Collector über die Web Oberfläche genutzt hat. Does this have any effect on the certificates used by OpenVPN?Because currently, after configuring the Distributed LogPoint, we see in the OpenVPN client log (/opt/immune/var/log/service/remote_con_client_xx.xx.xx.xx/current) that the certificate cannot be verified:2022-01-04_11:12:48.10967 Tue Jan  4 11:12:48 2022 VERIFY ERROR: depth=0, error=unable to get local issuer certificate: XXX  

1351
Reinhard Vielhaber
2 years ago
Gaurav Khatri
LogPoint Team
Gaurav KhatriLogPoint Team
asked in Searching & Analytics
Joining more than two streams of data in logpoint query language

Hi Team, currently, my customer could only join two streams of data at maximum using join queries from pattern-finding expressions. Are there any recommended queries we can use two join more than two streams of data?I understand that creating tables and using process lookup commands is one way of doing this , but creating multiple tables and populating them one by one and then using it in the query is a hassle I would not want my customer to go through. So is there some native support in the query itself for performing these multiple joins at once?

3792
markus.nebel@8com.de
2 years ago
J
James BettsNew Participant
asked in Use cases
SOAR VirusTotal API integration

Hi, Is anyone using the VirusTotal integration into their SOAR?I was all for getting it setup until I saw that you cannot use the free Public API in a commercial product.“The Public API must not be used in commercial products or services.” (https://developers.virustotal.com/reference/public-vs-premium-api) So, is anyone using the Premium API? and is it really $10,000 per year?Or are you sticking to the public API and hoping to not get blacklisted?Cheers

10901
T
2 years ago
A
Anonymous
asked in Use–cases
Emerging Threats: ChromeLoader

Our research team have been taking an in depth look at ChromeLoader. An innocent looking malvertiser that masquerades as a cracked game or a pirated movie sometimes placed on social media.Read here ⇉ https://bit.ly/3N2vHEo and download the report here ⇉ https://bit.ly/3tRZZDc to ensure you’re taking the best steps to remain protected.#SIEM #SIEMSOAR #Cyberthreats #CyberSecurity #Malware

210
A
2 years ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Normalization & Parsing
FortiMail Logs not Correctly Separated into Multiple Lines

We recently added a FortiMail appliance as a log source to one of our logpoints and now see an issue during collection and normalization.It seems that FortiMail is sending the log messages without separating the single messages with a newline or NULL-termination or something else. Thus the syslog_collector is reading from the socket until the maximum buffer length is exceeded.So we get a maximum length raw log message (10k characters, which then breaks in between a log message), which contains up to 30 or 40 single log messages, which are written one after the other. The normalizer then normalizes only the first message and discards the rest.Here a shortened example of how this looks like:550 <6>date=2022-06-20 time=07:24:11.992 device_id=[...]553 <6>date=2022-06-20 time=07:24:11.992 device_id=[...]479 <6>date=2022-06-20 time=07:24:11.992 device_id=[...]324 <6>date=2022-06-20 time=07:24:12.279 device_id=[...] Is there a way to resolve this issue? 

890
markus.nebel@8com.de
2 years ago
zana
zanaNew Participant
asked in Technical FAQs
Set logpoint as collector and SOAR

Hi ,I have a question regarding configuration of Logpoint. Can we set logpoint as a collector andat  the same time with enable the SOAR? Can we only use one server and set as one console for both?

1201
markus.nebel@8com.de
2 years ago
Piotr Moroz
Piotr MorozNew Participant
asked in Configuration
How to configure Recorded Future application on Director

Hi, I’m trying to configure Recorded Future application throug director on fabric enabled LogPoint. I was able to install application through Director on required host but I can’t configure.On director Recorded Future is not visible under plugins nor as a sub-type of Threat intelligence plugin. On AiO SIEM on which plugin was installed I can see it under configuration but when I try to configure I’m getting error “Invalid action while Fabric Connect is enabled”.Any ideas?

422
Piotr Moroz
2 years ago

Badge winners

Show all badges
Terms & ConditionsCookie settings