Help Center Logpoint Docs Idea Portal Logpoint.com

- - Knowledge base
Groups
Events

Community
SIEM
Searching & Analytics

Searching & Analytics

Stay up to date with the latest & greatest

94 Topics
204 Replies

When you subscribe we will email you when there is a new topic in this category

94 Topics

Recently active

Most replies Most views Newest first

D. van PuttenNew Participant

asked in Searching & Analytics

Add subnets to list

Hi, how can I paste a list of subnets to a static list?I'm trying to add a list of subnets to a static list in Logpoint (7.3.2). e.g.:1.2.3.0/242.3.4.0/245.6.7.0/234.3.2.0/22I cannot just copy/paste the list as it is pasted as one entry.

1373

1 year ago

Georg WittigNew Participant

asked in Searching & Analytics

Access individual logs within single stream

Hi,I want to display all relevant information that is available for remote sessions per remote session. However this is contained in different logs that all have the same session_id. Suppose I gather those logs in a search via a single stream. For example like this:[3 user=”x*” type=login OR type=logoff OR type=authentication_try having same session_id] as Stream How can I access the individual logs included? For example| fields Stream.type, Stream.col_ts, Stream.user or| chart count() by Stream.user etc. doesn’t work. Just showing the fields without grouping of same session_id is not the solution, since I cannot order fields and all session_ids are mixed. Hope there’s a way. BestGeorg

1263

1 year ago

Georg WittigNew Participant

asked in Searching & Analytics

group logs with same value

Hi everyone, Here is a task that puzzles me: I am looking at events of remote connections and I want to display the connections that are currently active. One Connection has evetns like “login”, “authentication_try”, “session_closed”, etc. and the same session_id. The number of logs with the same session _id may vary, since, for example, there might be more than one authentication_try.So I would like to first group all events with the same session_id and then filter out those, that do not have a “session_closed” event.I tried to implement this with one or two streams (join) but did not come to a solution. With one stream I cannot give an exact number of logs “having same session_id”, with two streams I would need something like “[session_id=*] as first-streamjoin[session_id=*] as second-stream on first-stream.session_id=second-stream.session_id AND first-stream.log_ts!=second-stream.log_ts”. Also a “not followed by” could have been a solution for this, which does not exist. Does any

670

1 year ago

Edgar FastNew Participant

asked in Searching & Analytics

Dynamic Alert Recipient

Hi all,i would like to send an email alert and choose the recipient depending on the triggered alert. For example, when a user changed his active directory password, i want to send him an email, telling that the password for his account was changed and if it was not himself he should contact directly the helpdesk.Bestedgar

981

1 year ago

MicropoleKnown Participant

asked in Searching & Analytics

Scanned ports

Hi !I would like to know if it is possible to know hwo has scanned the sources ports and destinations ports ?Thank you in advance :) Best regards,Siawash

1473

1 year ago

Prabesh BhattaLogPoint Team

asked in Searching & Analytics

Is there any way to export CSV enrichment sources ?

Is there any way to export CSV enrichment sources? From time to time these files are lost and it is a hassle to recreate.

2604

1 year ago

Georg WittigNew Participant

asked in Searching & Analytics

how to compare different times in search

Dear fellow LogPoint users,I am wondering if there is the possibility to compare the results of a querry for different times in one plot? This would be very helpful to identify regularities/irregularities. For example, the number of logs received today over the number of logs received yesterday and the day before. Yes, I can create a dashbord and stack the corresponding widgets on top one another. However, it would be helpful to be able to directly compare the curves in one plot. Thanks in advanceGeorg

2642

1 year ago

Georg WittigNew Participant

asked in Searching & Analytics

[HOW TO] plot something other than the frequency in search

Dear fellow LogPoint users,I would like to plot a given quantity over time in search and in my dashboards. For example, the GBs of data transferred over time, or the values of a time table. To my understanding chart, as well as timechart does not allow this. These functions only aggregate the number of occurences within the given time-interval (like in a histogram). Is there a way to do this? Best regards,Georg

650

1 year ago

Mike FurrerInspiring

asked in Searching & Analytics

HelloOur company very recently configured a Logpoint for ourself and a Customer.the Customer asked for a alert rule, to Alert us and them, whenever someone Attempts to login with a Unknown username format. To see those attempts and see if someone accidentally typed their Password in the username Field. for this I created this rule (there is probably better ways to do this)-("source_address"="ip") -("source_address"="iü") -("user"="du*") -("user"="MINWINPC") -("user"="ch*") -("user"="firewall") -("user"="aa*") -("user"="da*") -("user"="nu*") -("user"="su*") -("user"="la*") -("user"="cba_anonymous") -("user"="ex*") "reason"="Unknown user name or bad password." "event_category"="Logon" device_ip=ip or device_ip=ip The Rule ended up being pretty long, but it mostly works.The mostly being that it generates a lot of noise, because there is a lot of Alerts with user Null, so empty, these alerts seem to come from the DC itself.And I am trying to Exclude null from the search.I tried.-(“u

1662

1 year ago

alekstaKnown Participant

asked in Searching & Analytics

PowerExchange Malware backdoor - Exchange servers

Hi!Is there anyone in this community thas has some knowledge about the recently malware backdoors on Microsoft Exchange servers?I would like to investigate this further and do some threat hunting. Does anyone here has some threat hunting querys in LogPoint?

970

1 year ago

Birendra SahNew Participant

asked in Searching & Analytics

330

1 year ago

markus.nebel@8com.deBrainy

asked in Searching & Analytics

Is LogPoint using LogPoint SIEM itself for their IT infrastructure?

I sometimes wonder if LogPoint (as a company) itself uses its own LogPoint SIEM to monitor its IT infrastructure (servers, clients, firewalls, etc.)? (see eating your own dog food principle) I ask this because whenever it comes to user experience and serious functional errors in the software, I often have the feeling that only the support staff use the SIEM in their small virtualised test environments.They then have only a few log sources connected (or pools and machine in the director environment), which means that some problems that only occur in very large environments do not appear at all.Two simple examples:If so many entries are to be displayed in the UI that a scrollbar becomes necessary, this is sometimes not implemented correctly or poorly in terms of UX. If the indexsearcher or other services simply crashes with "something is wrong" in the UI when running a search and do not deliver any further messages or hints and thus the entire service promise of a security provider is at

3352

1 year ago

MicropoleKnown Participant

asked in Searching & Analytics

meaning of the "count() function"

Hi !I would like to know a little more about the “count() function” in logpoint and it’s meaning. In fact as you can see in screen shot I received a log at 10:42:53 and count() is equal to 53 and theye are normaly 53 logs. But when I clic on this line (log) all of these 53 logs are exactly the same ! what is meaning ? How can I interpret ? Is it just one log (one action realised) ? or theye are really 53 logs (53 actions realised) Thank you in advance for your help. Best regardsSiawash

2042

1 year ago

markus.nebel@8com.deBrainy

asked in Searching & Analytics

Indexsearcher write.lock Issues?

Has anyone of you seen errors during running a search over a larger timerange (+24 hours) from the indexsearchers reporting a missing “write.lock” file?Here is an example log of such a case:2022-12-11_00:00:45.94320 00:00:45.943 [pool-1-thread-3] WARN c.i.shared.lib.logging.util.LogUtil - Exception occurred during index closing;2022/08/11/16601760002022-12-11_00:00:45.94330 00:00:45.943 [pool-1-thread-3] WARN c.i.shared.lib.logging.util.LogUtil - Exception occurred during index closing;2022/08/09/16600032002022-12-11_00:00:45.97880 java.nio.file.NoSuchFileException: /opt/makalu/storage/indexes/M365/2022/08/11/1660176000/write.lock2022-12-11_00:00:45.97888 at sun.nio.fs.UnixException.translateToIOException(UnixException.java:86)2022-12-11_00:00:45.97888 at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102)2022-12-11_00:00:45.97888 at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107)2022-12-11_00:00:45.97889 at sun.nio.fs.UnixFileAttributeViews$Basi

2123

1 year ago

Anonymous

posted in Searching & Analytics

Enrich search results with the related data from a lookup table uploaded in Logpoint

Hi All,We are happy to share that we have released a new version of our lookup plugin.Lookup enriches logs with data from a Lookup table uploaded in Logpoint using CSVEnrichmentSource. You must install CSV Enrichment Source to upload the Lookup table.Lookup supports the following process commands: Lookup Command Multi Lookup Command SAP Lookup Command Lookup Command with Wildcard Lookup Command with CIDR To learn more, please see the links below.Release note: https://servicedesk.logpoint.com/hc/en-us/articles/9314493946525-LookupDocumentation: https://docs.logpoint.com/docs/lookup-process-plugin/en/latest/

1460

1 year ago

MicropoleKnown Participant

asked in Searching & Analytics

BLACKLIST_COUNTRY

Hi !I would like to create a widget with all connexions from a black list counrty. But I don’t it si possible or not !Would like to know if is that possible or not? if is this possible, please could you tell me how can I get a list like that? Thanks in advanceLooking forward to reading you

874

1 year ago

markus.nebel@8com.deBrainy

asked in Searching & Analytics

Formular to calculate first alert rule search time range

Is there a formula by which the first search timerange (from to) of a newly created alert rule could be calculated?For example, if I create a new alert rule with 24 hours time range NOW (e.g. at 10:00 AM), the first search will run between yesterday 6:00 AM and today 5:00 AM. Naively, I would have expected the search to run from yesterday 10 AM to today 10 AM.If I create an alert rule that has e.g. 5 minutes search time range, then the first search runs about 25 minutes to 20 minutes before the alert rule is activated.So the search time range of the alert rule search varies depending on the alert rule time range.Since I am developing an alert rule test environment that activates alert rules and ingests pre-made logs, it would be significant to set the timestamps in these pre-made logs so that they occur in the timerange in the first search run of the alert rule.So the question is, if there is a formula for this, with which I can determine the time period in advance, in which the alert

1802

1 year ago

Srijan KafleInspiring

asked in Searching & Analytics

Count number of entries in Dynamic list

How can we count number in entries in dynamic list?

784

1 year ago

Srijan KafleInspiring

asked in Searching & Analytics

Delete an entry from Table

I have a table that is populated frequently using query scheduled in the report. I am trying to remove an entry from the table. How can this be achieved.

1192

1 year ago

Aaditya KhatiNew Participant

asked in Searching & Analytics

Split same field values into two fields.

If i have an event_category= User, Logon. I want to be able to create new fields (e.g. X, Y) and present data like X=User and Y=Logon. What would be the query to showcase this in result.

941

1 year ago

CarstenNew Participant

asked in Searching & Analytics

Add more Information to a Report

Hi there,i’m new using Logpoint. So i need some help for a search i would like to do. I would like to add some more information to the search “Top 10 User in Failed Kerberis Authentication” there i would like to add on which workstation the user have tryed to logon.

814

1 year ago

Anonymous

posted in Searching & Analytics

AzureLogAnalytics released

Hi All,AzureLogAnalytics is now released, enabling you to fetch and analyze Azure Log Analytics workspace logs.For downloading instructions and documentation, please visit the links below:Help Center: https://servicedesk.logpoint.com/hc/en-us/articles/360017971858Documentation: https://docs.logpoint.com/docs/azureloganalytics/en/latest/

990

2 years ago

markus.nebel@8com.deBrainy

asked in Searching & Analytics

Display List Elements like Tabel?

It is possible to use the search queryTable TABLE_NAMEto list the content of the table “TABLE_NAME”.But there seems to be no possibility to do the same with a list.Or did I miss something?

2363

2 years ago

Nicolai ThorndahlLogPoint Team

asked in Searching & Analytics

Searching for special characters in fields like the wildcard star "*"

When searching for special characters in field values in Logpoint just pasting them in a regular Key = valueexpression, can often result in searches not working as intended from the users perspective as the Logpoint search language will interpret the character differently from the intention.For instance searching for fields with a star “*” character results in getting all results that has a value in that specific key, as Logpoint uses the star “*” as a wildcard character, which basically means “anything”. key = * will result in all logs with a field called keyInstead of using they kay value pairs to search we can use the builtin command match to find any occurrences of the value that we are looking for. In this example we will search for the star “*” frequently referred to as wildcard. We have some logs that have a field called policy in which we would like to find all occurrences of the character star “*” . To do this we first ensure that the policy field exists in the logs that we s

5611

2 years ago

Mike FurrerInspiring

asked in Searching & Analytics

Enrich DHCP Logs, With ISE Cisco Logs. To see Switchports

Hi there.So we Have a Alert rule, that alerts us when a Unknown and New Device, leases a DHCP Adress, to prevent unwanted Physical Access.Now We wanted to Enrich said DHCP log, by adding Information of our ISE/Switch Logs, so that when we get the Incident from the Alert rule, we also see what Switch and Switchport, this Unknown device is Hanging at.We are Pretty sure that should be Possible, but I haven’t figured out how yet.Cheers Mike Furrer

1732

2 years ago

Page 2 / 4

Badge winners

Gustav Elkjær Rødsgaardhas earned the badge Valued Contributor
Gustav Elkjær Rødsgaardhas earned the badge Easy talker
Gustav Elkjær Rødsgaardhas earned the badge Conversation starter
Gustav Elkjær Rødsgaardhas earned the badge Innovator
markus.nebel@8com.dehas earned the badge Silver Contributor

Show all badges

Terms & Conditions Cookie settings

Sign up

Already have an account? Login

Already a Partner or Customer? Login with your LogPoint Support credentials. Don‘t have a LogPoint Support account? Ask your local LogPoint Representative. Only visiting? Login with LinkedIn to gain read–access.

Login to the community

Already a Partner or Customer? Login with your LogPoint Support credentials. Don‘t have a LogPoint Support account? Ask your local LogPoint Representative. Only visiting? Login with LinkedIn to gain read–access.

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.