Skip to main content

SIEM

Welcome to the SIEM community space! Post a question about anything related to SIEM and engage with fellow customers about all things SIEM.

244 Topics
markus.nebel@8com.de
markus.nebel@8com.deBrainy
posted in Design & Architecture
Running LogPoint as Docker Container

I just managed to run LogPoint as a docker image/container.It is relatively simpel and could help improving testing systems, where you want to start from a fresh logpoint for each test, make the desired configurations, run the test and discard the changes at the end.Our use case was developing a unit testing framework for alert rules.Spin up the docker container Configurate repo, routing policy, normalization policy, processing policy, device and syslog collector Configurate the alert rule to test (test object) Send some pre-defined logs via syslog to the docker-logpoint Wait pre-defined time to see if the behaviour of the alert rule is as expected (triggers or doesn’t trigger) Stop the docker container, discarding all changes (configuration, log storage, etc.) Repeat with the next test scenarioHere is what I did to run logpoint in a container. I did this on a linux machine (debian 12) with docker.io installed:Download latest OVA (here logpoint_7.4.0.ova) Extract the OVA (which is a ta

1
Nils Krumey
LogPoint Team
1 month ago
Kai Gustafson
Kai GustafsonKnown Participant
asked in Design & Architecture
Has anyone tried getting log data from Topdesk in paticulare auditdata

This is a cloud services and looking for a solution to get data to our onprem LP servers. Regards Kai

2
Kai Gustafson
1 month ago
S
Sascha ScholzNew Participant
asked in Searching & Analytics
Search for configuration within the search bar

Hey,Iam searching for a possibility to return the configuration of defined alert rules in the logpoint search tab.Background: I would like to report over icindents which are created by alert rules for a specific user group. We got several test alarms, which are “managed” by an other user and which should not appear in the report. So I have to combine the configuration of alert rules and the results with “repo_name="_logpoint" action="Alert received" | chart count () by alert_name, risk_level”.Unfortunately I could not find a way to bring up the alert rule configuration with a search and combine the result with another search to narrow down the alert rules which I need to report. (I dont want to do that manually per hand by tyoing the names in the search)I came over this idea because I have done such things with Splunk in the past. (was like an API-Call within the search bar to return internal configuration parameters) Is it even possible to get the configuration of the XXX back as a js

2
A
1 month ago
S
Syed Faisal QadriNew Participant
asked in Use–cases
search current hash into logpoint without adding or connecting with threat feeds

we need to search hash in logpoint of our current endpoint and servers. how we can do that. is there any package we need to install for particular application or anything else.

1
S
1 month ago
Nirmal Unagar
Nirmal UnagarNew Participant
asked in Searching & Analytics
How to extract user from regex in search?

Hello folks, I am attempting to extract data for users who have browsed torrents. I've applied a regex query to match users, but it's returning all users instead of only those matching the regex.Here is a query : "user"=* application=bittorrent | process regex("^[a-zA-Z]\.[a-zA-Z]+\d*\.\d{2}$",user ) If anyone know what I am missing, love to hear. Thanks 

0
Nirmal Unagar
2 months ago
Y
Yoshihiro IshikawaNew Participant
posted in Design & Architecture
【Japanese language support】We can provide/support Japanease language menu

Dear Team, Since we need to prepare Japanese Web UI we want to provide it then please incorporate into your source code.Japan’s market is really needed to support our own language.Kindly understand our situation and cooperate with it. Could you do that? regards,Yoshihiro 

0
Y
2 months ago
A
alekstaKnown Participant
asked in Normalization & Parsing
Change timestamp on incoming logs

Hi!I’ve several logs that comes in UTC timeformat. My timezone Is UTC + 2. Which mess things up when I perform querys, hunting, analyzing events and taking out reports.My log Exporters often send syslog in UTC timeformat, RFC-compliant behavior.Is It possible to apply any sort of Normalization Package for these incoming logs to fix this?Can I try with some querys that changes the log_ts & col_ts field to UTC +2 timezone? Instead of the default UTC timezone.Thanks

2
A
2 months ago
M
MicropoleKnown Participant
asked in Searching & Analytics
FileShare missing logs

Hi,I need you help form an issue that I have about the FileShare logs. In fact, when a user download the files form fileShare I didn’t have any log to shows downloaded file. In fact I receiving juste the “sycnhronisation” logs :Could you please tell me how can I do to receive the logs from fileshare to show when a user download or copy file ?Thank you in advance for your help :) Regards,Siawash

2
M
2 months ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Searching & Analytics
Performance Question: Has the order of search parameters influence on search performance?

Hi everyone!does anyone know if it makes any difference how you order the search parameters in a search query? example:event_id=1234 event_channel="Security"vs.event_channel="Security" event_id=1234  

2
G
2 months ago
U
Uwe PoliakNew Participant
asked in Normalization & Parsing
Windows Server DNS Query Log

Hi all,I have configured my windows 2022 dns server to log dns queries. We need those logs for security and possible forensic reasons. The configuration is done in Windows Event Manager as described in DNS Logging and Diagnostics | Microsoft Learn. We are using LPAgent to collect other logs from this server. The result is an etl file, which cannot be read from the eventlog with im_msvistalog configuration from LPAgent. etl cannot be read with the im_msvistalog plugin of LPAgent. I have read that there is an NXLOG EE plugin im_etw out there which should be able to handle this file type, but we do not have the NXLog Enterprise Subscription. Is there any other option to collect the dns query logs from the server and import them into LogPoint?Is ther e any the best practice to handle windows dns server query logs (without using NXLOG EE)?Kind regardsUwe

3
Nils Krumey
LogPoint Team
3 months ago
A
Andre KurtzInspiring
asked in Normalization & Parsing
Problem adding McAfee ePo server via Syslog

We configured our McAfee ePO (5.10) server to send its logs to a syslog server and configured it in the LP accordingly. Yet, when using the “Test Syslog” Feature in McAfee ePO, the test failed. Nonetheless, we are receiving logs from the server, but they only contain gibberish. LP raw logs This is as far as i think not a problem with normalization, as a tcpdump also shows the log payload not being human readable.tcpdumpI already tried to change the charset min the log m,collection policy from utf_8 to iso8559_15 and ascii, to no avail.  I found following McAfee (KB87927)  document, which says:ePO syslog forwarding only supports the TCP protocol, and requires Transport Layer Security (TLS). Specifically, it supports receivers following RFC 5424 and RFC 5425, which is known as syslog-ng. You do not need to import the certificate used by the syslog receiver into ePO. As long as the certificate is valid, ePO accepts it. Self-signed certificates are supported and are commonly used for this

12
A
4 months ago
A
Alexandru ILIOIUParticipating Frequently
asked in Searching & Analytics
Data privacy on dashboards

I have activated the “Data Privacy” module and configured the fields, concerned groups, etc.I have a dashboard whose query contains one of the “encrypted” fields defined into “data privacy” module. Since activation, the dashboard is not displaying information anymore.There is a way to allow (via request/grant or something else) the dashboard to display the information ? Thanks,Alexandru  

0
A
4 months ago
A
Alexandru ILIOIUParticipating Frequently
asked in Searching & Analytics
Usage of computed fields into process functions

The following query put the result of processing function as “null” :| chart max(log_ts) as maxlogts  | process format_date(maxlogts,'YYYY/MM/dd') as endDate | fields maxlogts, endDate  I think the field “maxlogts” is not retrieved/recognized by function format_date().There is a way to obtain the field “endDate” not null ?

3
A
4 months ago
G
Gökhan GökNew Participant
asked in Searching & Analytics
several if-else

Hi everyone, i have a issue:I am writing a query. My query contains more than one if-else. However, because there are too many if-else, it does not return any result and gets stuck in “searching”. I wonder if there is a limit for else-if? If there is a small amount of else-if, it works, the query works, but if there is too much, unfortunately it doesn't work. I need help with this!!! since the values corresponding to each condition are different, I should use the else-if structure. I am open to different solution methods by the way.The query I wrote is as follows (here I just wanted to draw attention to the amount of else-if)I also get the following error: “No Response from server”alert=*| process eval("foo=if(alert=='xyz1') {return 1.2}else-if(alert=='xyz2') {return 1.0}else-if(alert=='xyz3') {return 1.21}else-if(alert=='xyz4') {return 1.2}else-if(alert=='xyz5') {return 1.29}else-if(alert=='xyz6') {return 1.25}else-if(alert=='xyz7') {return 1.29}else-if(alert=='xyz8') {return 1.200}el

3
G
5 months ago
G
Gökhan GökNew Participant
asked in Normalization & Parsing
Normalisation for Miliseconds

<123>2024-01-11T11:11:11.123Z hostnameI want to remove two fields from the above rohdaten using normalization, so to say. After normalization I should have the following fields:milliseconds=123log_ts=2024-01-11T11:11:11ZCan I do this in normalization (or signature)? If yes, can you write me the normalization/signature rule? This problem can be solved like this:| <<:int>><log_ts:datetime_m> <host:all>but I don't want that. I want to separate my fields at the beginning using normalization. 

0
G
5 months ago
M
Michael Schmidt JensenParticipating Frequently
asked in Searching & Analytics
Report

When I try to create a report it says “”Invalid number of fields used in process command, expected 7 field(s) but found 8” Why?

15
Nils Krumey
LogPoint Team
5 months ago
Rene Szeli
Rene SzeliNew Participant
asked in Operations Monitoring
Delete files in storage folder with bash command

Hi friends,I have the problem that the storage folder is now over 90% full.Now I wanted to empty the folder using bash commands directly in the disk notification and have applied the following to "Command:": find /opt/makalu/storage/ -type f -mtime +30 -deleteUnfortunately without success, the folder grows and grows. Do you have a tip or a solution for this?Thank you in advance and kind regards

12
Kai Gustafson
6 months ago
M
MicropoleKnown Participant
asked in Searching & Analytics
Alerts repetation

Hi,I would like to know if is it possible to receive one alert for the same action? For, example : for the following example if the same action is repeated several times I want to recive just one alert not more. action=Login source_address=1.1.1.1 user=titi | chart count() by user Is it possible ? If yes could you please tell me how do I do ? Best regards,SA

1
markus.nebel@8com.de
6 months ago
S
Stefano PrunottoNew Participant
asked in Design & Architecture
Logpoint 7.3.0 upgrade stalled

I have uploaded the logpoint 7.3.0 and 7.3.1 pak on logpoint server 7.2.4.I have started the 7.3.0 pak installation but after some hours is still in “installing” stateChecking the status I see that is blocked on SOAR Plugin upgrade …………………...Checking package status ...install; giving etc/, storage/ and var/ to loginspect only in changed filesinstall; removing old filesinstall; copying filesUpdate; updating plugins....Upgrading SOAR plugin I tried to install the 7.3.1 pak that fails because the 7.3.0 is not installed.I have restarted the server but nothing change.Could you please help me to understand the cause? 

4
markus.nebel@8com.de
6 months ago
M
MicropoleKnown Participant
asked in Searching & Analytics
use Joinner method in Templates

Hi,I Would like to use the joinner method in my template LogPoint. Whowever, I can’t use the “{{}}” for search parameter. Could you please tell me how should I do ? Here is an exemple of this tamplate :[ source_address=* display_name=* user=*] as s1 join [ user=* source_host=* source_address=*  ] as s2 on s1.user  = s2.user   {{source_host}} | rename  s2.source_host  as source_host  |  process geoip(s1.source_address) as country|  rename user as User |  chart count() by User, country, source_host   Note => I would like to search by this parameter {{source_host}} Thank you in advance.Siawash,

1
G
LogPoint Team
7 months ago
R
Ronny KempeNew Participant
asked in Normalization & Parsing
WIndows Logs

We would like to send log files from a directory such as C:\Logs to our logpoint server.What needs to be entered in nxlog.conf?

2
Kai Gustafson
7 months ago
S
Syed Faisal QadriNew Participant
asked in Use–cases
Enable FIM in Logpoint

I want to implement FIM use cases in logpoint. please share any document or implementation guide to achieve the below.

2
HansHenrikMoerkholt
7 months ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Searching & Analytics
Prefered Way to Fetch Logs from Azure?

Hi, what is LogPoint's recommended way to get logs from Azure AD / EntraID and any other Azure applications into LogPoint?We have noticed that the Azure EventHubs sometimes provide their logs several days late via the message queue. We were able to verify this independently of LogPoint using a fetcher developed in Python.How does this work with the "Azure Log Analytics Workspace" module? Can the logs be expected in the SIEM in a timely manner?A delay of several hours and days is not possible with the current alert rule concept of searching on already indexed timeranges without running the alert rules on utopian high timeranges.

6
Nils Krumey
LogPoint Team
8 months ago
M
Mike FurrerInspiring
asked in Searching & Analytics
Filter only part of a field

HelloWe want to see a statistic of outgoing mails/which domain sends how many.Filtering by source user is easy, however what I would need is the domain, not the precise E-Mail address.Is there a way to filter by only what comes after the @, so I can make a chart with only that information.Or is there a way to get the more precise Domain.cheers, and happy holidaysMike

6
M
8 months ago
M
MosheJ88New Participant
asked in Searching & Analytics
Usage of process eval like

Hi guys,I wrote a query that monitors for abnormal computer names joining my organization network. I had some success with those queries, but they still returns some false positives for me. How can I improve it?| process eval("is_abnormal_computer_name = (machine != like('Computer_Name') AND machine != like('Computer_Name') AND machine != like('Computer_Name') AND machine != like('Computer_Name'))") | process eval("is_abnormal_computer_name != like(machine, '^(name|name|name|name).*')") I want the query to returns the computer names that are abnormal.

0
M
8 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings