Help Center Logpoint Docs Idea Portal Logpoint.com

Searching & Analytics

Stay up to date with the latest & greatest

  • 71 Topics
  • 147 Replies

71 Topics

G
Georg WittigNew Participant
asked in Searching & Analytics

Access individual logs within single stream

Hi,I want to display all relevant information that is available for remote sessions per remote session. However this is contained in different logs that all have the same session_id. Suppose I gather those logs in a search via a single stream. For example like this:[3 user=”x*” type=login OR type=logoff OR type=authentication_try having same session_id] as Stream How can I access the individual logs included?  For example| fields Stream.type, Stream.col_ts, Stream.user or| chart count() by Stream.user etc. doesn’t work. Just showing the fields without grouping of same session_id is not the solution, since I cannot order fields and all session_ids are mixed. Hope there’s a way. BestGeorg

3
G
LogPoint Team
7 days ago
G
Georg WittigNew Participant
asked in Searching & Analytics

group logs with same value

Hi everyone,  Here is a task that puzzles me: I am looking at events of remote connections and I want to display the connections that are currently active. One Connection has evetns like “login”, “authentication_try”,  “session_closed”, etc. and the same session_id. The number of logs with the same session _id may vary, since, for example, there might be more than one authentication_try.So I would like to first group all events with the same session_id and then filter out those, that do not have a “session_closed” event.I tried to implement this with one or two streams (join) but did not come to a solution. With one stream I cannot give an exact number of logs “having same session_id”, with two streams I would need something like “[session_id=*] as first-streamjoin[session_id=*] as second-stream on first-stream.session_id=second-stream.session_id AND first-stream.log_ts!=second-stream.log_ts”. Also a “not followed by” could have been a solution for this, which does not exist.  Does any

0
G
13 days ago
E
Edgar FastNew Participant
asked in Searching & Analytics

Dynamic Alert Recipient

Hi all,i would like to send an email alert and choose the recipient depending on the triggered alert. For example, when a user changed his active directory password, i want to send him an email, telling that the password for his account was changed and if it was not himself he should contact directly the helpdesk.Bestedgar

1
S
LogPoint Team
15 days ago
M
Mike FurrerNew Participant
asked in Searching & Analytics

Logpoint Agent X and devices Hostnames

Hellowith the new Agent X, we were testing adding Devices with Agent X to logpoint, due to DHCP they will not always have the same IP address. We attempted to add this device via Hostname to logpoint, but even though the Agent X panel claims that it is active and collecting logs, When searching for said logs, I get no result for the Hostname.Is it Possible to use Hostnames to add Devices to logpoint in use with agent X?Or is it not possible.

1
M
LogPoint Team
2 months ago
M
MicropoleParticipating Frequently
asked in Searching & Analytics

Scanned ports

Hi !I would like to know if it is possible to know hwo has scanned the sources ports and destinations ports ?Thank you in advance :) Best regards,Siawash 

3
S
3 months ago
Prabesh Bhatta
LogPoint Team
Prabesh BhattaLogPoint Team
asked in Searching & Analytics

Is there any way to export CSV enrichment sources ?

Is there any way to export CSV enrichment sources? From time to time these files are lost and it is a hassle to recreate.

4
Prabesh.B
LogPoint Team
3 months ago
G
Georg WittigNew Participant
asked in Searching & Analytics

how to compare different times in search

Dear fellow LogPoint users,I am wondering if there is the possibility to compare the results of a querry for different times in one plot? This would be very helpful to identify regularities/irregularities. For example, the number of logs received today over the number of logs received yesterday and the day before. Yes, I can create a dashbord and stack the corresponding widgets on top one another. However, it would be helpful to be able to directly compare the curves in one plot. Thanks in advanceGeorg

2
G
3 months ago
G
Georg WittigNew Participant
asked in Searching & Analytics

[HOW TO] plot something other than the frequency in search

Dear fellow LogPoint users,I would like to plot a given quantity over time in search and in my dashboards. For example, the GBs of data transferred over time, or the values of a time table. To my understanding chart, as well as timechart does not allow this. These functions only aggregate the number of occurences within the given time-interval (like in a histogram). Is there a way to do this?  Best regards,Georg

0
G
3 months ago
M
Mike FurrerNew Participant
asked in Searching & Analytics

Login Unknown User Formant Alert Rule

HelloOur company very recently configured a Logpoint for ourself and a Customer.the Customer asked for a alert rule, to Alert us and them, whenever someone Attempts to login with a Unknown username format. To see those attempts and see if someone accidentally typed their Password in the username Field.  for this I created this rule (there is probably better ways to do this)-("source_address"="ip") -("source_address"="iü") -("user"="du*")  -("user"="MINWINPC") -("user"="ch*")  -("user"="firewall") -("user"="aa*")  -("user"="da*") -("user"="nu*") -("user"="su*") -("user"="la*")   -("user"="cba_anonymous") -("user"="ex*") "reason"="Unknown user name or bad password."  "event_category"="Logon" device_ip=ip or device_ip=ip The Rule ended up being pretty long, but it mostly works.The mostly being that it generates a lot of noise, because there is a lot of Alerts with user Null, so empty, these alerts seem to come from the DC itself.And I am trying to Exclude null from the search.I tried.-(“u

2
M
3 months ago
A
alekstaKnown Participant
asked in Searching & Analytics

PowerExchange Malware backdoor - Exchange servers

Hi!Is there anyone in this community thas has some knowledge about the recently malware backdoors on Microsoft Exchange servers?I would like to investigate this further and do some threat hunting. Does anyone here has some threat hunting querys in LogPoint?

0
A
4 months ago
B
Birendra SahNew Participant
asked in Searching & Analytics

j

.

0
B
5 months ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Searching & Analytics

Is LogPoint using LogPoint SIEM itself for their IT infrastructure?

I sometimes wonder if LogPoint (as a company) itself uses its own LogPoint SIEM to monitor its IT infrastructure (servers, clients, firewalls, etc.)? (see eating your own dog food principle) I ask this because whenever it comes to user experience and serious functional errors in the software, I often have the feeling that only the support staff use the SIEM in their small virtualised test environments.They then have only a few log sources connected (or pools and machine in the director environment), which means that some problems that only occur in very large environments do not appear at all.Two simple examples:If so many entries are to be displayed in the UI that a scrollbar becomes necessary, this is sometimes not implemented correctly or poorly in terms of UX. If the indexsearcher or other services simply crashes with "something is wrong" in the UI when running a search and do not deliver any further messages or hints and thus the entire service promise of a security provider is at

2
M
6 months ago
M
MicropoleParticipating Frequently
asked in Searching & Analytics

meaning of the "count() function"

Hi !I would like to know a little more about the “count() function” in logpoint and it’s meaning. In fact as you can see in screen shot I received a log at 10:42:53 and count() is equal to 53 and theye are normaly 53 logs. But when I clic on this line (log) all of these 53 logs are exactly the same ! what is meaning ? How can I interpret ? Is it just one log (one action realised) ? or theye are really 53 logs (53 actions realised) Thank you in advance for your help. Best regardsSiawash

2
M
6 months ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Searching & Analytics

Indexsearcher write.lock Issues?

Has anyone of you seen errors during running a search over a larger timerange (+24 hours) from the indexsearchers reporting a missing “write.lock” file?Here is an example log of such a case:2022-12-11_00:00:45.94320 00:00:45.943 [pool-1-thread-3] WARN c.i.shared.lib.logging.util.LogUtil - Exception occurred during index closing;2022/08/11/16601760002022-12-11_00:00:45.94330 00:00:45.943 [pool-1-thread-3] WARN c.i.shared.lib.logging.util.LogUtil - Exception occurred during index closing;2022/08/09/16600032002022-12-11_00:00:45.97880 java.nio.file.NoSuchFileException: /opt/makalu/storage/indexes/M365/2022/08/11/1660176000/write.lock2022-12-11_00:00:45.97888 at sun.nio.fs.UnixException.translateToIOException(UnixException.java:86)2022-12-11_00:00:45.97888 at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102)2022-12-11_00:00:45.97888 at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107)2022-12-11_00:00:45.97889 at sun.nio.fs.UnixFileAttributeViews$Basi

3
A
7 months ago
A
Anonymous
posted in Searching & Analytics

Enrich search results with the related data from a lookup table uploaded in Logpoint

Hi All,We are happy to share that we have released a new version of our lookup plugin.Lookup enriches logs with data from a Lookup table uploaded in Logpoint using CSVEnrichmentSource. You must install CSV Enrichment Source to upload the Lookup table.Lookup supports the following process commands: Lookup Command Multi Lookup Command SAP Lookup Command Lookup Command with Wildcard Lookup Command with CIDR To learn more, please see the links below.Release note: https://servicedesk.logpoint.com/hc/en-us/articles/9314493946525-LookupDocumentation: https://docs.logpoint.com/docs/lookup-process-plugin/en/latest/

0
A
7 months ago
M
MicropoleParticipating Frequently
asked in Searching & Analytics

BLACKLIST_COUNTRY

Hi !I would like to create a widget with all connexions from a black list counrty. But I don’t it si possible or not !Would like to know if is that possible or not? if is this possible, please could you tell me how can I get a list like that?  Thanks in advanceLooking forward to reading you

4
M
8 months ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Searching & Analytics

Formular to calculate first alert rule search time range

Is there a formula by which the first search timerange (from to) of a newly created alert rule could be calculated?For example, if I create a new alert rule with 24 hours time range NOW (e.g. at 10:00 AM), the first search will run between yesterday 6:00 AM and today 5:00 AM. Naively, I would have expected the search to run from yesterday 10 AM to today 10 AM.If I create an alert rule that has e.g. 5 minutes search time range, then the first search runs about 25 minutes to 20 minutes before the alert rule is activated.So the search time range of the alert rule search varies depending on the alert rule time range.Since I am developing an alert rule test environment that activates alert rules and ingests pre-made logs, it would be significant to set the timestamps in these pre-made logs so that they occur in the timerange in the first search run of the alert rule.So the question is, if there is a formula for this, with which I can determine the time period in advance, in which the alert

2
markus.nebel@8com.de
8 months ago
S
Srijan KafleInspiring
asked in Searching & Analytics

Count number of entries in Dynamic list

How can we count number in entries in dynamic list?

4
S
9 months ago
S
Srijan KafleInspiring
asked in Searching & Analytics

Delete an entry from Table

I have a table that is populated frequently using query scheduled in the report. I am trying to remove an entry from the table. How can this be achieved.

2
S
9 months ago
A
Aaditya KhatiNew Participant
asked in Searching & Analytics

Split same field values into two fields.

If i have an event_category= User, Logon. I want to be able to create new fields (e.g. X, Y) and present data like X=User and Y=Logon. What would be the query to showcase this in result.

1
Mike Blomgren
LogPoint Team
9 months ago
C
CarstenNew Participant
asked in Searching & Analytics

Add more Information to a Report

Hi there,i’m new using Logpoint. So i need some help for a search i would like to do. I would like to add some more information to the search “Top 10 User in Failed Kerberis Authentication” there i would like to add on which workstation the user have tryed to logon.

4
Rasmus Heiselberg Porse
LogPoint Team
9 months ago
A
Anonymous
posted in Searching & Analytics

AzureLogAnalytics released

Hi All,AzureLogAnalytics is now released, enabling you to fetch and analyze Azure Log Analytics workspace logs.For downloading instructions and documentation, please visit the links below:Help Center: https://servicedesk.logpoint.com/hc/en-us/articles/360017971858Documentation: https://docs.logpoint.com/docs/azureloganalytics/en/latest/

0
A
10 months ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Searching & Analytics

Display List Elements like Tabel?

It is possible to use the search queryTable TABLE_NAMEto list the content of the table “TABLE_NAME”.But there seems to be no possibility to do the same with a list.Or did I miss something?

3
P
LogPoint Team
10 months ago
Nicolai Thorndahl
LogPoint Team
Nicolai ThorndahlLogPoint Team
asked in Searching & Analytics

Searching for special characters in fields like the wildcard star "*"

When searching for special characters in field values in Logpoint just pasting them in a regular Key = valueexpression, can often result in searches not working as intended from the users perspective as the Logpoint search language will interpret the character differently from the intention.For instance searching for fields with a star “*” character results in getting all results that has a value in that specific key, as Logpoint uses the star “*” as a wildcard character, which basically means “anything”.  key = * will result in all logs with a field called keyInstead of using they kay value pairs to search we can use the builtin command match to find any occurrences of the value that we are looking for. In this example we will search for the star “*” frequently referred to as wildcard. We have some logs that have a field called policy in which we would like to find all occurrences of the character star “*” . To do this we first ensure that the policy field exists in the logs that we s

1
markus.nebel@8com.de
11 months ago
M
Mike FurrerNew Participant
asked in Searching & Analytics

Enrich DHCP Logs, With ISE Cisco Logs. To see Switchports

Hi there.So we Have a Alert rule, that alerts us when a Unknown and New Device, leases a DHCP Adress, to prevent unwanted Physical Access.Now We wanted to Enrich said DHCP log, by adding Information of our ISE/Switch Logs, so that when we get the Incident from the Alert rule, we also see what Switch and Switchport, this Unknown device is Hanging at.We are Pretty sure that should be Possible, but I haven’t figured out how yet.Cheers Mike Furrer

2
Prabesh.B
LogPoint Team
11 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings