Skip to main content
Help Center Logpoint Docs Idea Portal Logpoint.com

Searching & Analytics (SIEM)

Stay up to date with the latest & greatest

  • 94 Topics
  • 205 Replies
94 Topics
H
Hans VedderNew Participant
asked in Searching & Analytics (SIEM)
How to see a result whith "filter < ..."

Hi,every hour my firewall loads a new antivir database. In normal case, I receive 24 logs a day. When the download fails, I don’t receive any log.Now I want to be informed when the count of logs are less than 20 a day.I tried the following:norm_id=FortiOS event_category=kevent sub_category=update message="Update result: virus db:yes*"  | chart count() as "Count" by message | filter "Count" &lt; 20but this query doesn’t show my any results. I would like to see message and Count.What should I modify?Best regards,Hans Vedder

723
H
3 years ago
H
Hans VedderNew Participant
asked in Searching & Analytics (SIEM)
Why this query is wrong?

Hi,when I start a query | chart min(log_ts) as min_ts  by min_ts, source_address, destination_address I receive the error message:could not convert string to float: '/'.But why?An example for log_ts: 2021/10/11 11:04:54I use | chart count() as "Count", min(log_ts) as min_ts, max(log_ts) as max_tsin a macro and I am sure that in fewer versions of Logpoint I didn’t receive this error message.Actually I use Logpoint version 6.12.0Best regards,Hans Vedder

2376
H
3 years ago
A
Andre KurtzInspiring
posted in Searching & Analytics (SIEM)
Join: Restricting "followed by" using time conditions

Hello, i am facing following scenario:I want to monitor web gui access to a device, especially the host a access was attempted from. However, most of the access attempts are done from different LANs, using web proxies. Hence, i only see the ip of the web proxies as the source ip of the login attempts. I therefore like to use some kind of join to retrieve access attempts to the device, and then check the web proxies which ip was accessing the device IP at around  that time (e.g. within two seconds). (I tried a join based on the exact same time, but this approach leaves out many events). So basically, i need something like [search1] as s1 followed by [search2] as s2 on s1.log_ts &lt;= s2.log_ts + 2 seconds Does any body know how i can accomplish this, or knows of  a different approach ? Andre

1153
A
3 years ago
T
Timo FahlenbockNew Participant
asked in Searching & Analytics (SIEM)
Creating Alert Rules PAK File

HI,i want to integrate many of the SIGMA Rules found here:https://github.com/SigmaHQ/sigmaI was able to translate them into the Logpoint Query Language and Now i want to Import them as Alert Rules.Doing each one by one manually in the GUI is a very time consuming/impossible Task.Is there a Way to Import Alert Rules beside the .PAK Files? Or is there a Defintion how such a .PAK File looks? Best RegardsTimo  

3362
T
3 years ago
A
Andre KurtzInspiring
asked in Searching & Analytics (SIEM)
Is it possible to create a device group with devices on a remote LP ?

Hello, as the title says i was wondering whether devices that are configured as a log source on a remote LP can be added to a devices group configured on the local LP? Our network is divided into two locations connected via a MPLS connection, and to prevent devices sending their logs over the MPLS line we configured a LP at each location and added one LP as a remote LP into the other LP (our “main LP”). I would like to create an alert on our “main LP” to notify us when a deviceis  no longer sending logs. Hence i would like to create a device group on the “main LP” containing all the devices the alert should “monitor”, but i am unable to add devices that are configured as log sources on the remote LP. As far as i understand the documentation, it is possible when using LP Director (which we do not have), but not possible in our scenario. Just  would like to confirm this and that i have to create an altert on both LP monitoring the “local” log sources.    

1064
A
3 years ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Searching & Analytics (SIEM)
More Fields in Stream Search with "having same"?

When I'm using a search query like this:[5 event_id=1234 having same user] I'm getting a grouped result with only log_ts and user as normalized fields for this group.Is it possible to get more fields similar to SQL with theselect FIELDS where CONDITIONAt the moment I'm "workarounding" this with joining the first search with another search. But this seems to be extremly inefficient because it uses the analyzer process which itself relies on slow leveldb operations:[5 event_id=1234 having same user] as s1 join [event_id=1234] as s2 on s1.user = s2.userIs there a better solution?The problem with 'having same' is, that the search result only contains the fields specified in the 'having same' clause. But in this special case the 'service' field should be different, not the same. So specifying it in a comma separate list (like '...having same user,service...') doesn't help here.It would be great to access all the other fields in a following 'chart count()' etc.

1531
Basudev Raut
LogPoint Team
3 years ago
Nicolai Thorndahl
LogPoint Team
Nicolai ThorndahlLogPoint Team
asked in Searching & Analytics (SIEM)
Usage of if-else statements in eval

Hi I can see that the process eval command supports the use of if-else statements, but I can’t find any examples of the syntax. My issue is that I have logs which contain a source_address field, and host_address, and then I have some other logs which only contains host_address logs, and I would like to translate the IP to country from source_address if the field exists and else take it from host_address. So I tried to say if, source_address is null, then set source_address to host_address, else nothing. |process eval(if(source_address=null, source_address=host_address,)

3403
Nicolai Thorndahl
LogPoint Team
3 years ago
K
Kimil TimilsinaNew Participant
posted in Searching & Analytics (SIEM)
Threat_Intelligence

My Endpoint devices shows source_address as client_ip? How can  I use threat_intelligence for matching source_address as client_ip? I have used rename for enrichingthose threat_intelligence logs, but failed to do so? How can I use endpoint hashes as well for enriching threat_intelligence logs?

1001
Rupsan Shrestha
LogPoint Team
3 years ago
Nicolai Thorndahl
LogPoint Team
Nicolai ThorndahlLogPoint Team
asked in Searching & Analytics (SIEM)
Using quotes " in process regex command?

I need to extract a field which is not getting normalized as it is part of a combined field. the value of the field is sounded by quote signs, but the process regex command doesn’t seem to get it when I put a backslash before the quote sign. Can I somehow escape the quotes in my regex? Example, I want to extract the “from” field value  {    "Directionality": "Incoming",    "From": "do-not-reply@test-industry.dk",Wrote the following regex: .*?From\"\:\s*?\"(?P&lt;from&gt;.*?)\" but pasting it to | process regex(“.*?From\"\:\s*?\"(?P&lt;from&gt;.*?)\"”, msg) gives error and says “unbalanced quotes” 

2361
Nils Krumey
LogPoint Team
3 years ago
Sandesh Bushal
LogPoint Team
Sandesh BushalLogPoint Team
asked in Searching & Analytics (SIEM)
Has anyone worked with the "step" function in Logpoint?

Hello. Just as the question mentioned. I am fulfilling a use case that requires grouping integer values in steps of maybe 4, 10, or even more. I would like to use the step function, but it is not working as per the documentation mentioned at docs.logpoint.comCan anyone point me towards the solution to grouping values / using the step function? 

390
Sandesh Bushal
LogPoint Team
3 years ago
Jerome Perrin
LogPoint Team
Jerome PerrinLogPoint Team
asked in Searching & Analytics (SIEM)
Export raw logs

Hi, I need to export a large amount of raw logs for a device. I tried to use the export log feature but I can’t select a destination. Can someone help ?

4541
Guy Grieve
LogPoint Team
3 years ago
Prabesh Bhatta
LogPoint Team
Prabesh BhattaLogPoint Team
asked in Searching & Analytics (SIEM)
What is the best recommendation while calculating eps of external and internal firewalls ?

As we know the external firewall is exposed with multiple entities, the logs generated by the firewall are usually way higher than the internal firewall. Along with that application firewall, a firewall with IPS and IDS enabled might have more logs than normal. 

580
Prabesh Bhatta
LogPoint Team
3 years ago
Gaurav Khatri
LogPoint Team
Gaurav KhatriLogPoint Team
asked in Searching & Analytics (SIEM)
Information about analytic components available for SNMP in logpoint ?

I used snmp to fetch oid ".1.3.6.1.2.1.1.5.0", while searching it shows "iso_org_dod_internet_mgmt_mib-2_1_5_0", How do i use this information to a dashboard or alert? Are there any normalizers available for this?

1251
Rupsan Shrestha
LogPoint Team
3 years ago
Sandesh Bushal
LogPoint Team
Sandesh BushalLogPoint Team
asked in Searching & Analytics (SIEM)
Use cases for working from home

Hi team, do we have some standard dashboards for Work From Home use cases?

1271
Basudev Raut
LogPoint Team
3 years ago
Rupsan Shrestha
LogPoint Team
Rupsan ShresthaLogPoint Team
asked in Searching & Analytics (SIEM)
Threat Intelligence

Which threat intelligence source should i use and what happens if i use multiple threat intelligence sources.

1681
Basudev Raut
LogPoint Team
3 years ago
Prabesh Bhatta
LogPoint Team
Prabesh BhattaLogPoint Team
asked in Searching & Analytics (SIEM)
Is there any better way to get high resource utilization alert of remote machine in LP dashboard ?

One of our customer wants realtime health report of there critical servers in Logpoint dashboard and alert. I couldn't find any health-related logs coming from Syslog. Is there any way we can get resource utilization or uptime information on the dashboard and alerts? 

340
Prabesh Bhatta
LogPoint Team
3 years ago
Sandesh Bushal
LogPoint Team
Sandesh BushalLogPoint Team
asked in Searching & Analytics (SIEM)
Incremental values in SNMP Logs

Hello!I am receiving logs from SNMP, but the field names are incremental in nature, which have the same values as the incremental value. For an example:oid_hierarchy_value_1 = 1oid_hierarchy_value_2 = 2oid_hierarchy_value_3 = 3 How can I go about extracting these fields from the logs so that I can do chart sum, average, and so on?

531
Rupsan Shrestha
LogPoint Team
3 years ago
Gaurav Khatri
LogPoint Team
Gaurav KhatriLogPoint Team
asked in Searching & Analytics (SIEM)
Is there any workaround to make sure your dynamic lists are updated automatically at regular intervals ?

For now, I don’t see any native option which enables me to update a list at regular interval. Because of this, I need to always run the same query regularly to update the dynamic list with new data. Is there a better approach ?

620
Gaurav Khatri
LogPoint Team
3 years ago
Basudev Raut
LogPoint Team
Basudev RautLogPoint Team
asked in Searching & Analytics (SIEM)
How to fetch enrichment sources from the collector node itself?

A MSSP partner is planning is to run a lightweight LogPoint collector VM at each of their customers, and then setting up the main LogPoint servers with compute and storage at their end. They will have the Open Door tunnel open to the LogPoint Collectors, but won't be able to expose the customer's Domain Controller/LDAP publicly. Therefore, the LogPoint Collector needs to collect the LDAP enrichment data from the local DC, instead of the main LogPoint server.Is there a way of making this happen without engineering changes, such as by redirecting the main server's LDAP query through the tunnel somehow, or by the collector fetching something to a file to then send across?  

1031
Gaurav Khatri
LogPoint Team
3 years ago
Terms & ConditionsCookie settings