Help Center Logpoint Docs Idea Portal Logpoint.com

- - Knowledge base
Groups
Events

Community
SIEM

SIEM

Welcome to the SIEM community space! Post a question about anything related to SIEM and engage with fellow customers about all things SIEM.

248 Topics

Recently active

Most replies Most views Newest first

Gaurav KhatriLogPoint Team

asked in Design & Architecture

Zpool configurations in logpoint

One of our customers is going to add additional storage and extend an existing zfs pool. I couldn’t find any official documentation on this, so can anyone help me with the recommended steps to follow ?

2111

3 years ago

Jerome PerrinLogPoint Team

posted in Design & Architecture

ZFS compared to EXT4 filesystem

Hi Team, do we have some pointers about the advantages of ZFS compared to EXT4 filesystem and why customers should use it to store Repo data ?

4771

3 years ago

Nils KrumeyLogPoint Team

asked in Design & Architecture

LogPoint Collector - Buffering

When using the LogPoint Collector with buffering, where does the collector buffer the log? Is it possible to change the directory to another mountpoint? And how big is the buffer ?

831

3 years ago

Henrik BerggrenLogPoint Team

asked in Normalization & Parsing

Normalizing Windows logs using nxlog agent

When using the nxlog agent for Windows (instead of the LogPoint Agent for Windows) how can I get the logs properly normalised?

6312

3 years ago

Jerome PerrinLogPoint Team

asked in Normalization & Parsing

Process to request a new log normalization support

Hi Team, My customer has a new network appliance that is not yet supported by LogPoint. What is the process to request its support ?

361

3 years ago

Jerome PerrinLogPoint Team

asked in Design & Architecture

Change IP address

I get this question often. What is our official reply?How can one change the IP address of a LogPoint appliance?

3861

3 years ago

Prabesh BhattaLogPoint Team

asked in Design & Architecture

Can we create a new UI admin user or change the password from any user using CLI ?

One of our customers forget the admin user credential and we need to reset the password for the user. Please let me know if there is any way around to do this?

6201

3 years ago

Nils KrumeyLogPoint Team

asked in Design & Architecture

LogPoint receiving "old" logs

When LogPoint receives “old” logs, it buffers them in the OldLogsKeeper directory. What is the threshold of max oldest logs which still get processed in the normal way and not stored by the "old log keeper"?

510

3 years ago

Prabesh BhattaLogPoint Team

asked in Searching & Analytics

What is the best recommendation while calculating eps of external and internal firewalls ?

As we know the external firewall is exposed with multiple entities, the logs generated by the firewall are usually way higher than the internal firewall. Along with that application firewall, a firewall with IPS and IDS enabled might have more logs than normal.

560

3 years ago

Basudev RautLogPoint Team

asked in Normalization & Parsing

I want to add a field management_address to its respective device_address..

Hi,I have a case where Analyst uses the management IP, however there is a NAT address on the client side. The device address configured in the logs provide client IPs.So I am looking to add a field management_address that we will define based on the device_addressie: when an event has device_address=192.168.1.1 add field management_address=10.10.10.10I've looked into a few ways to do this. Enrichment source I didn't see a good way to go about it. Adding a custom normalizer would be possible, but would have to add a signature for every IP <:ALL>192.168.1.1<:ALL> and then add keyvalue management_address=10.10.10.10Label package would also be do-able and easier than norm signatures, but that would put the new IP in a label, rather than within the normalized event.Wondering if anyone has come up with any other solutions or ideas.

741

3 years ago

Prabesh BhattaLogPoint Team

asked in Design & Architecture

Is it ok to provide root privilege of Logpoint to our customers who are confident in linux OS ?

Is it safe to provide the root privilege of Logpoint to our customers? Do we have to look for any security concerns while doing so? Has it been done before ?

1511

3 years ago

Gaurav KhatriLogPoint Team

asked in Searching & Analytics

Information about analytic components available for SNMP in logpoint ?

I used snmp to fetch oid ".1.3.6.1.2.1.1.5.0", while searching it shows "iso_org_dod_internet_mgmt_mib-2_1_5_0", How do i use this information to a dashboard or alert? Are there any normalizers available for this?

1121

3 years ago

Sandesh BushalLogPoint Team

asked in Searching & Analytics

Use cases for working from home

Hi team, do we have some standard dashboards for Work From Home use cases?

1221

3 years ago

Rupsan ShresthaLogPoint Team

asked in Operations Monitoring

Technical Requirements required for onboarding Operations Monitoring

Hi Team,Do we have a checklist I can share with customers about things to prepare before subscribing to Operations Monitoring?I am looking for more of a technical requirement like firewall rules, support connection, passwords, and so on.

921

3 years ago

Sandesh BushalLogPoint Team

asked in Design & Architecture

Difference in SNMP Fetcher and SNMP trap collector

What is the difference between SNMP fetcher and SNMP trap collector and what should i use to get health information using SNMP?

871

3 years ago

Rupsan ShresthaLogPoint Team

asked in Searching & Analytics

Threat Intelligence

Which threat intelligence source should i use and what happens if i use multiple threat intelligence sources.

1591

3 years ago

Prabesh BhattaLogPoint Team

asked in Design & Architecture

Is it possible to transfer files between collector and data node by using the existing VPN tunnel ?

In the case where we need to transfer files between collectors to a data node where there is no other network connectivity than a VPN tunnel between two. Is it possible to transfer files between them? If how and using which tools and protocols?

842

3 years ago

Rupsan ShresthaLogPoint Team

asked in Design & Architecture

Domain Change

What do we advise customers when there is a change in theorganizational domain but the log consists of old domain. For example: the system are extracting logs linked to the old email address like @immunesecurity.com, but in AD it is @logpoint.com.

461

3 years ago

Prabesh BhattaLogPoint Team

asked in Searching & Analytics

Is there any better way to get high resource utilization alert of remote machine in LP dashboard ?

One of our customer wants realtime health report of there critical servers in Logpoint dashboard and alert. I couldn't find any health-related logs coming from Syslog. Is there any way we can get resource utilization or uptime information on the dashboard and alerts?

320

3 years ago

Sandesh BushalLogPoint Team

asked in Searching & Analytics

Incremental values in SNMP Logs

Hello!I am receiving logs from SNMP, but the field names are incremental in nature, which have the same values as the incremental value. For an example:oid_hierarchy_value_1 = 1oid_hierarchy_value_2 = 2oid_hierarchy_value_3 = 3 How can I go about extracting these fields from the logs so that I can do chart sum, average, and so on?

471

3 years ago

Gaurav KhatriLogPoint Team

asked in Searching & Analytics

Is there any workaround to make sure your dynamic lists are updated automatically at regular intervals ?

For now, I don’t see any native option which enables me to update a list at regular interval. Because of this, I need to always run the same query regularly to update the dynamic list with new data. Is there a better approach ?

590

3 years ago

Basudev RautLogPoint Team

asked in Searching & Analytics

How to fetch enrichment sources from the collector node itself?

A MSSP partner is planning is to run a lightweight LogPoint collector VM at each of their customers, and then setting up the main LogPoint servers with compute and storage at their end. They will have the Open Door tunnel open to the LogPoint Collectors, but won't be able to expose the customer's Domain Controller/LDAP publicly. Therefore, the LogPoint Collector needs to collect the LDAP enrichment data from the local DC, instead of the main LogPoint server.Is there a way of making this happen without engineering changes, such as by redirecting the main server's LDAP query through the tunnel somehow, or by the collector fetching something to a file to then send across?

991

3 years ago

Rupsan ShresthaLogPoint Team

published in Design & Architecture

Network and System Health MonitoringBlog

IT Operations and Monitoring has always been a crucial aspect of security for any organization. SIEM, a security incident and event management solution today needs to do much more than what it used to do, manage incidents and events.Modern SIEMs are versatile solution covering not only your SOC demands but also provides rich visibility and accounting of NOC demands.A typical enterprise network contains routers, switches, wireless APs, firewalls and so on. For a NOC team the availability of the devices and the performance metrics are very important information. NOC team generally use network monitoring tools in order to constantly monitor the said important informations. Modern SIEMs enables to put the NOC team under the same umbrella as the SOC. Modern SIEMs provides visualizations, alerting and reporting capabilities for security/network events and incidents as well as real time network health related information like: Uptime, Memory/CPU Utilization, interface Tx/Rx, wireless client c

2592

3 years ago

Page 10 / 10

Badge winners

Gustav Elkjær Rødsgaardhas earned the badge Valued Contributor
Gustav Elkjær Rødsgaardhas earned the badge Easy talker
Gustav Elkjær Rødsgaardhas earned the badge Conversation starter
Gustav Elkjær Rødsgaardhas earned the badge Innovator
markus.nebel@8com.dehas earned the badge Silver Contributor

Show all badges

Terms & Conditions Cookie settings

Sign up

Already have an account? Login

Already a Partner or Customer? Login with your LogPoint Support credentials. Don‘t have a LogPoint Support account? Ask your local LogPoint Representative. Only visiting? Login with LinkedIn to gain read–access.

Login to the community

Already a Partner or Customer? Login with your LogPoint Support credentials. Don‘t have a LogPoint Support account? Ask your local LogPoint Representative. Only visiting? Login with LinkedIn to gain read–access.

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.