Help Center Logpoint Docs Idea Portal Logpoint.com

Searching & Analytics

Stay up to date with the latest & greatest

  • 89 Topics
  • 203 Replies

89 Topics

S
Sascha ScholzNew Participant
asked in Searching & Analytics

Search for configuration within the search bar

Hey,Iam searching for a possibility to return the configuration of defined alert rules in the logpoint search tab.Background: I would like to report over icindents which are created by alert rules for a specific user group. We got several test alarms, which are “managed” by an other user and which should not appear in the report. So I have to combine the configuration of alert rules and the results with “repo_name="_logpoint" action="Alert received" | chart count () by alert_name, risk_level”.Unfortunately I could not find a way to bring up the alert rule configuration with a search and combine the result with another search to narrow down the alert rules which I need to report. (I dont want to do that manually per hand by tyoing the names in the search)I came over this idea because I have done such things with Splunk in the past. (was like an API-Call within the search bar to return internal configuration parameters) Is it even possible to get the configuration of the XXX back as a js

2
A
3 days ago
Nirmal Unagar
Nirmal UnagarNew Participant
asked in Searching & Analytics

How to extract user from regex in search?

Hello folks, I am attempting to extract data for users who have browsed torrents. I've applied a regex query to match users, but it's returning all users instead of only those matching the regex.Here is a query : "user"=* application=bittorrent | process regex("^[a-zA-Z]\.[a-zA-Z]+\d*\.\d{2}$",user ) If anyone know what I am missing, love to hear. Thanks 

0
Nirmal Unagar
28 days ago
M
MicropoleKnown Participant
asked in Searching & Analytics

FileShare missing logs

Hi,I need you help form an issue that I have about the FileShare logs. In fact, when a user download the files form fileShare I didn’t have any log to shows downloaded file. In fact I receiving juste the “sycnhronisation” logs :Could you please tell me how can I do to receive the logs from fileshare to show when a user download or copy file ?Thank you in advance for your help :) Regards,Siawash

2
M
1 month ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Searching & Analytics

Performance Question: Has the order of search parameters influence on search performance?

Hi everyone!does anyone know if it makes any difference how you order the search parameters in a search query? example:event_id=1234 event_channel="Security"vs.event_channel="Security" event_id=1234  

2
G
1 month ago
A
Alexandru ILIOIUParticipating Frequently
asked in Searching & Analytics

Data privacy on dashboards

I have activated the “Data Privacy” module and configured the fields, concerned groups, etc.I have a dashboard whose query contains one of the “encrypted” fields defined into “data privacy” module. Since activation, the dashboard is not displaying information anymore.There is a way to allow (via request/grant or something else) the dashboard to display the information ? Thanks,Alexandru  

0
A
3 months ago
A
Alexandru ILIOIUParticipating Frequently
asked in Searching & Analytics

Usage of computed fields into process functions

The following query put the result of processing function as “null” :| chart max(log_ts) as maxlogts  | process format_date(maxlogts,'YYYY/MM/dd') as endDate | fields maxlogts, endDate  I think the field “maxlogts” is not retrieved/recognized by function format_date().There is a way to obtain the field “endDate” not null ?

3
A
3 months ago
G
Gökhan GökNew Participant
asked in Searching & Analytics

several if-else

Hi everyone, i have a issue:I am writing a query. My query contains more than one if-else. However, because there are too many if-else, it does not return any result and gets stuck in “searching”. I wonder if there is a limit for else-if? If there is a small amount of else-if, it works, the query works, but if there is too much, unfortunately it doesn't work. I need help with this!!! since the values corresponding to each condition are different, I should use the else-if structure. I am open to different solution methods by the way.The query I wrote is as follows (here I just wanted to draw attention to the amount of else-if)I also get the following error: “No Response from server”alert=*| process eval("foo=if(alert=='xyz1') {return 1.2}else-if(alert=='xyz2') {return 1.0}else-if(alert=='xyz3') {return 1.21}else-if(alert=='xyz4') {return 1.2}else-if(alert=='xyz5') {return 1.29}else-if(alert=='xyz6') {return 1.25}else-if(alert=='xyz7') {return 1.29}else-if(alert=='xyz8') {return 1.200}el

3
G
3 months ago
M
Michael Schmidt JensenParticipating Frequently
asked in Searching & Analytics

Report

When I try to create a report it says “”Invalid number of fields used in process command, expected 7 field(s) but found 8” Why?

15
Nils Krumey
LogPoint Team
4 months ago
M
MicropoleKnown Participant
asked in Searching & Analytics

Alerts repetation

Hi,I would like to know if is it possible to receive one alert for the same action? For, example : for the following example if the same action is repeated several times I want to recive just one alert not more. action=Login source_address=1.1.1.1 user=titi | chart count() by user Is it possible ? If yes could you please tell me how do I do ? Best regards,SA

1
markus.nebel@8com.de
5 months ago
M
MicropoleKnown Participant
asked in Searching & Analytics

use Joinner method in Templates

Hi,I Would like to use the joinner method in my template LogPoint. Whowever, I can’t use the “{{}}” for search parameter. Could you please tell me how should I do ? Here is an exemple of this tamplate :[ source_address=* display_name=* user=*] as s1 join [ user=* source_host=* source_address=*  ] as s2 on s1.user  = s2.user   {{source_host}} | rename  s2.source_host  as source_host  |  process geoip(s1.source_address) as country|  rename user as User |  chart count() by User, country, source_host   Note => I would like to search by this parameter {{source_host}} Thank you in advance.Siawash,

1
G
LogPoint Team
5 months ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Searching & Analytics

Prefered Way to Fetch Logs from Azure?

Hi, what is LogPoint's recommended way to get logs from Azure AD / EntraID and any other Azure applications into LogPoint?We have noticed that the Azure EventHubs sometimes provide their logs several days late via the message queue. We were able to verify this independently of LogPoint using a fetcher developed in Python.How does this work with the "Azure Log Analytics Workspace" module? Can the logs be expected in the SIEM in a timely manner?A delay of several hours and days is not possible with the current alert rule concept of searching on already indexed timeranges without running the alert rules on utopian high timeranges.

6
Nils Krumey
LogPoint Team
6 months ago
M
Mike FurrerInspiring
asked in Searching & Analytics

Filter only part of a field

HelloWe want to see a statistic of outgoing mails/which domain sends how many.Filtering by source user is easy, however what I would need is the domain, not the precise E-Mail address.Is there a way to filter by only what comes after the @, so I can make a chart with only that information.Or is there a way to get the more precise Domain.cheers, and happy holidaysMike

6
M
6 months ago
M
MosheJ88New Participant
asked in Searching & Analytics

Usage of process eval like

Hi guys,I wrote a query that monitors for abnormal computer names joining my organization network. I had some success with those queries, but they still returns some false positives for me. How can I improve it?| process eval("is_abnormal_computer_name = (machine != like('Computer_Name') AND machine != like('Computer_Name') AND machine != like('Computer_Name') AND machine != like('Computer_Name'))") | process eval("is_abnormal_computer_name != like(machine, '^(name|name|name|name).*')") I want the query to returns the computer names that are abnormal.

0
M
7 months ago
L
Lee BradleyNew Participant
asked in Searching & Analytics

Publish Dashboard to Public API

Hello all, I am looking for a way to publish a dashboard to the public API. Does anyone know if this is possible? As it stands I have managed to publish individual dashboard widgets to the public API but I would prefer to share the whole dashboard with 1 URL. Thanks

0
L
8 months ago
M
Mark NorthcottNew Participant
asked in Searching & Analytics

list all event ids found by each device

I need to create a query to export the results with the following criteria, but unsure how to write the query.I want to list every end device by hostname (including all end devices fed by Windows event collectors, not reported as the WEC) and then all the event codes (unique) collected from that device in ascending order. Can someone please point me in the right direction

1
G
LogPoint Team
8 months ago
M
MicropoleKnown Participant
asked in Searching & Analytics

Exiration log for Microsoft office 365

Hi,I would like to know if it is possible to find the log that show the expiration date of Microsoft office 365 account ? If yes, could you please tell me how can I find it ? Regards,Siawash

2
M
8 months ago
M
Mike FurrerInspiring
asked in Searching & Analytics

Logpoint Agent X Applocker Dashboard

Hi.We have implemented Agent X into our systems, and we are observing Applocker Events with Agent X.Now our customer would like a dashboard for these Event.And I was not sure how to go about creating these Dashboards.How can I make a dashboard specifically for the Eventviewer logs.Cheers Mike

3
Nils Krumey
LogPoint Team
8 months ago
M
Mike FurrerInspiring
asked in Searching & Analytics

Logpoint Agent X and devices Hostnames

Hellowith the new Agent X, we were testing adding Devices with Agent X to logpoint, due to DHCP they will not always have the same IP address. We attempted to add this device via Hostname to logpoint, but even though the Agent X panel claims that it is active and collecting logs, When searching for said logs, I get no result for the Hostname.Is it Possible to use Hostnames to add Devices to logpoint in use with agent X?Or is it not possible.

2
M
9 months ago
K
Kamal PaulNew Participant
asked in Searching & Analytics

P2P network connection detect rule

Hello everyone,Being searching LP blogs and community to see if we have any detection rules for P2P network connections. Came out there is a rule to finding P2P applications but nothing of useful to find the network connection. Any tips or suggestions in building a P2P detection will be much appreciated. Thanks

1
Nils Krumey
LogPoint Team
9 months ago
L
LouisNew Participant
asked in Searching & Analytics

[HOW TO] MPS per repo and per log source

Hello all,I would like to visualize: MPS sent by each log sources MPS per repo_name I have managed to create a timechart of MPS per repo_name:repo_name=* | timechart count() by repo_nameNote : This is not really MPS per repos, but log volume per repo. But I cannot find how to generate the equivalent for each log sources. Thanks for your help!

8
A
9 months ago
D
D. van PuttenNew Participant
asked in Searching & Analytics

Add subnets to list

Hi, how can I paste a list of subnets to a static list?I'm trying to add a list of subnets to a static list in Logpoint (7.3.2). e.g.:1.2.3.0/242.3.4.0/245.6.7.0/234.3.2.0/22I cannot just copy/paste the list as it is pasted as one entry. 

3
P
LogPoint Team
9 months ago
G
Georg WittigNew Participant
asked in Searching & Analytics

Access individual logs within single stream

Hi,I want to display all relevant information that is available for remote sessions per remote session. However this is contained in different logs that all have the same session_id. Suppose I gather those logs in a search via a single stream. For example like this:[3 user=”x*” type=login OR type=logoff OR type=authentication_try having same session_id] as Stream How can I access the individual logs included?  For example| fields Stream.type, Stream.col_ts, Stream.user or| chart count() by Stream.user etc. doesn’t work. Just showing the fields without grouping of same session_id is not the solution, since I cannot order fields and all session_ids are mixed. Hope there’s a way. BestGeorg

3
G
LogPoint Team
10 months ago
G
Georg WittigNew Participant
asked in Searching & Analytics

group logs with same value

Hi everyone,  Here is a task that puzzles me: I am looking at events of remote connections and I want to display the connections that are currently active. One Connection has evetns like “login”, “authentication_try”,  “session_closed”, etc. and the same session_id. The number of logs with the same session _id may vary, since, for example, there might be more than one authentication_try.So I would like to first group all events with the same session_id and then filter out those, that do not have a “session_closed” event.I tried to implement this with one or two streams (join) but did not come to a solution. With one stream I cannot give an exact number of logs “having same session_id”, with two streams I would need something like “[session_id=*] as first-streamjoin[session_id=*] as second-stream on first-stream.session_id=second-stream.session_id AND first-stream.log_ts!=second-stream.log_ts”. Also a “not followed by” could have been a solution for this, which does not exist.  Does any

0
G
10 months ago
E
Edgar FastNew Participant
asked in Searching & Analytics

Dynamic Alert Recipient

Hi all,i would like to send an email alert and choose the recipient depending on the triggered alert. For example, when a user changed his active directory password, i want to send him an email, telling that the password for his account was changed and if it was not himself he should contact directly the helpdesk.Bestedgar

1
S
LogPoint Team
10 months ago
M
MicropoleKnown Participant
asked in Searching & Analytics

Scanned ports

Hi !I would like to know if it is possible to know hwo has scanned the sources ports and destinations ports ?Thank you in advance :) Best regards,Siawash 

3
S
1 year ago

Badge winners

Show all badges
Terms & ConditionsCookie settings