Help Center Logpoint Docs Idea Portal Logpoint.com

Searching & Analytics

Stay up to date with the latest & greatest

  • 87 Topics
  • 198 Replies

87 Topics

M
Mike FurrerInspiring
asked in Searching & Analytics

Login Unknown User Formant Alert Rule

HelloOur company very recently configured a Logpoint for ourself and a Customer.the Customer asked for a alert rule, to Alert us and them, whenever someone Attempts to login with a Unknown username format. To see those attempts and see if someone accidentally typed their Password in the username Field.  for this I created this rule (there is probably better ways to do this)-("source_address"="ip") -("source_address"="iü") -("user"="du*")  -("user"="MINWINPC") -("user"="ch*")  -("user"="firewall") -("user"="aa*")  -("user"="da*") -("user"="nu*") -("user"="su*") -("user"="la*")   -("user"="cba_anonymous") -("user"="ex*") "reason"="Unknown user name or bad password."  "event_category"="Logon" device_ip=ip or device_ip=ip The Rule ended up being pretty long, but it mostly works.The mostly being that it generates a lot of noise, because there is a lot of Alerts with user Null, so empty, these alerts seem to come from the DC itself.And I am trying to Exclude null from the search.I tried.-(“u

2
M
10 months ago
A
alekstaKnown Participant
asked in Searching & Analytics

PowerExchange Malware backdoor - Exchange servers

Hi!Is there anyone in this community thas has some knowledge about the recently malware backdoors on Microsoft Exchange servers?I would like to investigate this further and do some threat hunting. Does anyone here has some threat hunting querys in LogPoint?

0
A
10 months ago
B
Birendra SahNew Participant
asked in Searching & Analytics

j

.

0
B
1 year ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Searching & Analytics

Is LogPoint using LogPoint SIEM itself for their IT infrastructure?

I sometimes wonder if LogPoint (as a company) itself uses its own LogPoint SIEM to monitor its IT infrastructure (servers, clients, firewalls, etc.)? (see eating your own dog food principle) I ask this because whenever it comes to user experience and serious functional errors in the software, I often have the feeling that only the support staff use the SIEM in their small virtualised test environments.They then have only a few log sources connected (or pools and machine in the director environment), which means that some problems that only occur in very large environments do not appear at all.Two simple examples:If so many entries are to be displayed in the UI that a scrollbar becomes necessary, this is sometimes not implemented correctly or poorly in terms of UX. If the indexsearcher or other services simply crashes with "something is wrong" in the UI when running a search and do not deliver any further messages or hints and thus the entire service promise of a security provider is at

2
M
1 year ago
M
MicropoleKnown Participant
asked in Searching & Analytics

meaning of the "count() function"

Hi !I would like to know a little more about the “count() function” in logpoint and it’s meaning. In fact as you can see in screen shot I received a log at 10:42:53 and count() is equal to 53 and theye are normaly 53 logs. But when I clic on this line (log) all of these 53 logs are exactly the same ! what is meaning ? How can I interpret ? Is it just one log (one action realised) ? or theye are really 53 logs (53 actions realised) Thank you in advance for your help. Best regardsSiawash

2
M
1 year ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Searching & Analytics

Indexsearcher write.lock Issues?

Has anyone of you seen errors during running a search over a larger timerange (+24 hours) from the indexsearchers reporting a missing “write.lock” file?Here is an example log of such a case:2022-12-11_00:00:45.94320 00:00:45.943 [pool-1-thread-3] WARN c.i.shared.lib.logging.util.LogUtil - Exception occurred during index closing;2022/08/11/16601760002022-12-11_00:00:45.94330 00:00:45.943 [pool-1-thread-3] WARN c.i.shared.lib.logging.util.LogUtil - Exception occurred during index closing;2022/08/09/16600032002022-12-11_00:00:45.97880 java.nio.file.NoSuchFileException: /opt/makalu/storage/indexes/M365/2022/08/11/1660176000/write.lock2022-12-11_00:00:45.97888 at sun.nio.fs.UnixException.translateToIOException(UnixException.java:86)2022-12-11_00:00:45.97888 at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102)2022-12-11_00:00:45.97888 at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107)2022-12-11_00:00:45.97889 at sun.nio.fs.UnixFileAttributeViews$Basi

3
A
1 year ago
A
Anonymous
posted in Searching & Analytics

Enrich search results with the related data from a lookup table uploaded in Logpoint

Hi All,We are happy to share that we have released a new version of our lookup plugin.Lookup enriches logs with data from a Lookup table uploaded in Logpoint using CSVEnrichmentSource. You must install CSV Enrichment Source to upload the Lookup table.Lookup supports the following process commands: Lookup Command Multi Lookup Command SAP Lookup Command Lookup Command with Wildcard Lookup Command with CIDR To learn more, please see the links below.Release note: https://servicedesk.logpoint.com/hc/en-us/articles/9314493946525-LookupDocumentation: https://docs.logpoint.com/docs/lookup-process-plugin/en/latest/

0
A
1 year ago
M
MicropoleKnown Participant
asked in Searching & Analytics

BLACKLIST_COUNTRY

Hi !I would like to create a widget with all connexions from a black list counrty. But I don’t it si possible or not !Would like to know if is that possible or not? if is this possible, please could you tell me how can I get a list like that?  Thanks in advanceLooking forward to reading you

4
M
1 year ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Searching & Analytics

Formular to calculate first alert rule search time range

Is there a formula by which the first search timerange (from to) of a newly created alert rule could be calculated?For example, if I create a new alert rule with 24 hours time range NOW (e.g. at 10:00 AM), the first search will run between yesterday 6:00 AM and today 5:00 AM. Naively, I would have expected the search to run from yesterday 10 AM to today 10 AM.If I create an alert rule that has e.g. 5 minutes search time range, then the first search runs about 25 minutes to 20 minutes before the alert rule is activated.So the search time range of the alert rule search varies depending on the alert rule time range.Since I am developing an alert rule test environment that activates alert rules and ingests pre-made logs, it would be significant to set the timestamps in these pre-made logs so that they occur in the timerange in the first search run of the alert rule.So the question is, if there is a formula for this, with which I can determine the time period in advance, in which the alert

2
markus.nebel@8com.de
1 year ago
S
Srijan KafleInspiring
asked in Searching & Analytics

Count number of entries in Dynamic list

How can we count number in entries in dynamic list?

4
S
1 year ago
S
Srijan KafleInspiring
asked in Searching & Analytics

Delete an entry from Table

I have a table that is populated frequently using query scheduled in the report. I am trying to remove an entry from the table. How can this be achieved.

2
S
1 year ago
A
Aaditya KhatiNew Participant
asked in Searching & Analytics

Split same field values into two fields.

If i have an event_category= User, Logon. I want to be able to create new fields (e.g. X, Y) and present data like X=User and Y=Logon. What would be the query to showcase this in result.

1
Mike Blomgren
LogPoint Team
1 year ago
C
CarstenNew Participant
asked in Searching & Analytics

Add more Information to a Report

Hi there,i’m new using Logpoint. So i need some help for a search i would like to do. I would like to add some more information to the search “Top 10 User in Failed Kerberis Authentication” there i would like to add on which workstation the user have tryed to logon.

4
Rasmus Heiselberg Porse
LogPoint Team
1 year ago
A
Anonymous
posted in Searching & Analytics

AzureLogAnalytics released

Hi All,AzureLogAnalytics is now released, enabling you to fetch and analyze Azure Log Analytics workspace logs.For downloading instructions and documentation, please visit the links below:Help Center: https://servicedesk.logpoint.com/hc/en-us/articles/360017971858Documentation: https://docs.logpoint.com/docs/azureloganalytics/en/latest/

0
A
1 year ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Searching & Analytics

Display List Elements like Tabel?

It is possible to use the search queryTable TABLE_NAMEto list the content of the table “TABLE_NAME”.But there seems to be no possibility to do the same with a list.Or did I miss something?

3
P
LogPoint Team
1 year ago
Nicolai Thorndahl
LogPoint Team
Nicolai ThorndahlLogPoint Team
asked in Searching & Analytics

Searching for special characters in fields like the wildcard star "*"

When searching for special characters in field values in Logpoint just pasting them in a regular Key = valueexpression, can often result in searches not working as intended from the users perspective as the Logpoint search language will interpret the character differently from the intention.For instance searching for fields with a star “*” character results in getting all results that has a value in that specific key, as Logpoint uses the star “*” as a wildcard character, which basically means “anything”.  key = * will result in all logs with a field called keyInstead of using they kay value pairs to search we can use the builtin command match to find any occurrences of the value that we are looking for. In this example we will search for the star “*” frequently referred to as wildcard. We have some logs that have a field called policy in which we would like to find all occurrences of the character star “*” . To do this we first ensure that the policy field exists in the logs that we s

1
markus.nebel@8com.de
1 year ago
M
Mike FurrerInspiring
asked in Searching & Analytics

Enrich DHCP Logs, With ISE Cisco Logs. To see Switchports

Hi there.So we Have a Alert rule, that alerts us when a Unknown and New Device, leases a DHCP Adress, to prevent unwanted Physical Access.Now We wanted to Enrich said DHCP log, by adding Information of our ISE/Switch Logs, so that when we get the Incident from the Alert rule, we also see what Switch and Switchport, this Unknown device is Hanging at.We are Pretty sure that should be Possible, but I haven’t figured out how yet.Cheers Mike Furrer

2
Prabesh.B
LogPoint Team
1 year ago
G
LogPoint Team
Gustav Elkjær RødsgaardLogPoint Team
posted in Searching & Analytics

Incident Reporting Overview with Search Query

Hi,I have been looking into how to get an overview over actions taken by an Security Analyst whilst using the Incidents view on Logpoint.Therefore i have created this Search Query to get an overview over Incdents and Actions.Repository to be searched on is _LogPointincident_id = * | chart count() by incident_id, log_ts, alert_id, status, action, user, alert_name, comment order by incident_id, log_ts asc Hope this could be useful.Best Regards,Gustav

0
G
LogPoint Team
1 year ago
A
Andre KurtzInspiring
posted in Searching & Analytics

Threat Intelligence - What are your experiences \ do you have recommendations ?

Hello, just wanted to “pick the brains” of my fellow LP community member regarding TI. Is anyone here actively using the Threat Intelligence feature of the LogPoint and \ or has any recommendations and experiences on the matter. Personally i think it could be a very valuable part in a LogPoint environment to increase the detection capabilities, but have not be able to set it up in a way that would really beneficial. This is mainly due to the fact that i haven’t been able to find a decent (free) TI feed, and to my mind, the value of TI stands and falls with the quality of the feed data.Most of my customers have their firewalls, spam and web filter devices and mostly even their centralized AV solution sending their logs to LP. Setting up monitoring DNS request wouldn’t be a problem either. So i think we have enough visibility into the network traffic. Having a decent TI feed could allow us to compare these logs for known IoC (IP, hostnames, email addresses) and take a look at endpoints w

5
M
1 year ago
Nicolai Thorndahl
LogPoint Team
Nicolai ThorndahlLogPoint Team
asked in Searching & Analytics

Detecting devices not sending logs

Hi I know the following query can be used to create an alarm with devices that haven’t been sending logs | chart count() by device_ip | search ‘count()’ = 0However, in cases where I have multiple IP’s for a single device this won’t work as the ones not sending data will come up in the search result even though the device is sending data from another IP. Another case where I have issues, is when pulling data with for instance the O365 fetcher which will have device_ip of the localhost which will also be the case for the internal LogPoint logs. One way could be to create alerts on the individual repo’s with some specific characteristics, but I would like to avoid creating multiple alerts for the same to reduce search load. Any ideas how to build a single alert for detecting devices not sending logs with multiple IP’s and fetchers not fetching any data? 

13
M
1 year ago
Gaurav Khatri
LogPoint Team
Gaurav KhatriLogPoint Team
asked in Searching & Analytics

Joining more than two streams of data in logpoint query language

Hi Team, currently, my customer could only join two streams of data at maximum using join queries from pattern-finding expressions. Are there any recommended queries we can use two join more than two streams of data?I understand that creating tables and using process lookup commands is one way of doing this , but creating multiple tables and populating them one by one and then using it in the query is a hassle I would not want my customer to go through. So is there some native support in the query itself for performing these multiple joins at once?

2
markus.nebel@8com.de
1 year ago
A
Anonymous
posted in Searching & Analytics

Monitoring Alerting Services

Hi All,Alerting is one of the core feature of Logpoint, in the article below we collected a compact list of the precautions that can be done to ensure that alerting runs smoothly and what to do if you realize the alerts weren't triggered.  To read the full article, please follow the link below: https://servicedesk.logpoint.com/hc/en-us/articles/6013024248093-Monitoring-Alerting-Service

0
A
1 year ago
S
Sascha ScholzNew Participant
asked in Searching & Analytics

Search for configuration within the search bar

Hey,Iam searching for a possibility to return the configuration of defined alert rules in the logpoint search tab.Background: I would like to report over icindents which are created by alert rules for a specific user group. We got several test alarms, which are “managed” by an other user and which should not appear in the report. So I have to combine the configuration of alert rules and the results with “repo_name="_logpoint" action="Alert received" | chart count () by alert_name, risk_level”.Unfortunately I could not find a way to bring up the alert rule configuration with a search and combine the result with another search to narrow down the alert rules which I need to report. (I dont want to do that manually per hand by tyoing the names in the search)I came over this idea because I have done such things with Splunk in the past. (was like an API-Call within the search bar to return internal configuration parameters) Is it even possible to get the configuration of the XXX back as a js

1
Nils Krumey
LogPoint Team
1 year ago
S
Sascha ScholzNew Participant
asked in Searching & Analytics

Show Alert Detail within the search

Hello Guys,Is there a possibility to show the “Alert Details” within a search, so we can execute filtering and combining with other searches to get a special reporting on this infomation?Alert Details 

4
S
1 year ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Searching & Analytics

Search Query Placeholder/Wildcard for Exact Amount of Characters?

Is there a way to replace a certain number of characters with a wildcard in a search query? The asterisk (*) is unfortunately too unspecific for my purposes. In other query languages there is for example the "?" for a character, or in regex the ".{n}" quantifier, where "n" is the number of characters. A typical application would be the detection of a base64 encoded single char variable assignment like this: thus having a search query like this would be very helpful:script_text=”*JAB?AD0A*”

1
Nils Krumey
LogPoint Team
1 year ago

Badge winners

Show all badges
Terms & ConditionsCookie settings