Skip to main content
Help Center Logpoint Docs Idea Portal Logpoint.com

SIEM

Welcome to the SIEM community space! Post a question about anything related to SIEM and engage with fellow customers about all things SIEM.

250 Topics
S
Stefano PrunottoNew Participant
asked in Design & Architecture
Logpoint 7.3.0 upgrade stalled

I have uploaded the logpoint 7.3.0 and 7.3.1 pak on logpoint server 7.2.4.I have started the 7.3.0 pak installation but after some hours is still in “installing” stateChecking the status I see that is blocked on SOAR Plugin upgrade …………………...Checking package status ...install; giving etc/, storage/ and var/ to loginspect only in changed filesinstall; removing old filesinstall; copying filesUpdate; updating plugins....Upgrading SOAR plugin I tried to install the 7.3.1 pak that fails because the 7.3.0 is not installed.I have restarted the server but nothing change.Could you please help me to understand the cause? 

4264
markus.nebel@8com.de
10 months ago
M
MicropoleKnown Participant
asked in Searching & Analytics
use Joinner method in Templates

Hi,I Would like to use the joinner method in my template LogPoint. Whowever, I can’t use the “{{}}” for search parameter. Could you please tell me how should I do ? Here is an exemple of this tamplate :[ source_address=* display_name=* user=*] as s1 join [ user=* source_host=* source_address=*  ] as s2 on s1.user  = s2.user   {{source_host}} | rename  s2.source_host  as source_host  |  process geoip(s1.source_address) as country|  rename user as User |  chart count() by User, country, source_host   Note => I would like to search by this parameter {{source_host}} Thank you in advance.Siawash,

601
G
LogPoint Team
10 months ago
R
Ronny KempeNew Participant
asked in Normalization & Parsing
WIndows Logs

We would like to send log files from a directory such as C:\Logs to our logpoint server.What needs to be entered in nxlog.conf?

2622
Kai Gustafson
11 months ago
S
Syed Faisal QadriNew Participant
asked in Use–cases
Enable FIM in Logpoint

I want to implement FIM use cases in logpoint. please share any document or implementation guide to achieve the below.

1322
HansHenrikMoerkholt
11 months ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Searching & Analytics
Prefered Way to Fetch Logs from Azure?

Hi, what is LogPoint's recommended way to get logs from Azure AD / EntraID and any other Azure applications into LogPoint?We have noticed that the Azure EventHubs sometimes provide their logs several days late via the message queue. We were able to verify this independently of LogPoint using a fetcher developed in Python.How does this work with the "Azure Log Analytics Workspace" module? Can the logs be expected in the SIEM in a timely manner?A delay of several hours and days is not possible with the current alert rule concept of searching on already indexed timeranges without running the alert rules on utopian high timeranges.

5096
Nils Krumey
LogPoint Team
11 months ago
M
Mike FurrerInspiring
asked in Searching & Analytics
Filter only part of a field

HelloWe want to see a statistic of outgoing mails/which domain sends how many.Filtering by source user is easy, however what I would need is the domain, not the precise E-Mail address.Is there a way to filter by only what comes after the @, so I can make a chart with only that information.Or is there a way to get the more precise Domain.cheers, and happy holidaysMike

1976
M
1 year ago
M
MosheJ88New Participant
asked in Searching & Analytics
Usage of process eval like

Hi guys,I wrote a query that monitors for abnormal computer names joining my organization network. I had some success with those queries, but they still returns some false positives for me. How can I improve it?| process eval("is_abnormal_computer_name = (machine != like('Computer_Name') AND machine != like('Computer_Name') AND machine != like('Computer_Name') AND machine != like('Computer_Name'))") | process eval("is_abnormal_computer_name != like(machine, '^(name|name|name|name).*')") I want the query to returns the computer names that are abnormal.

1170
M
1 year ago
M
mimn2gNew Participant
asked in Design & Architecture
Newbie: Distributed Logpoint

hello guys, good daynewbie here and I am taking overed from our previous employee. correct me if I’m wrong since it is still in final design I need to deploy distributed LP in customer environment, we provide them 2 ESXi and this is our 1st customer migrated from Microfocus. The components are: (current)search head x1 distributed logpoint x1 log collector x2 (collect log for on-prem x1, collect log for cloud but sitting on prem)for windows, planning to use LPA and the rest syslogIssue 1:I do some testing and I realized all the API or Cloud Trail configuration directly into DLP. Reason I am thinking, we do not need the LC on this case and the pros is we have the opportunity to turn on SOAR features also increase the specification/storage for DLP.Do I need to turn on this DLP as collector also?Issue 2:license: 325 nodes (300 servers/security/network and 5 API: sophos, office365 and 1: AWS cloud trail)I believed 325 nodes will be installed inside the DLP and but not sure about SH and LC,

1400
M
1 year ago
M
MicropoleKnown Participant
asked in APIs & automation
Implementation the SMS feature throught LogPoint

Hi,I’m intressted in implementing the SMS feature through LogPoint. However, to activate this functionality, I need an SMS hosting service. Could you tell me if LogPoint offers an SMS hosting service ? If so, what is the procedure to set up this feature ? If LogPoint doesn’t provide SMS hosting, could you recommend a good SMS hosting service, compatible with LogPoint ?  Thank you in advance. Siawash,

912
M
1 year ago
L
Lee BradleyNew Participant
asked in Searching & Analytics
Publish Dashboard to Public API

Hello all, I am looking for a way to publish a dashboard to the public API. Does anyone know if this is possible? As it stands I have managed to publish individual dashboard widgets to the public API but I would prefer to share the whole dashboard with 1 URL. Thanks

620
L
1 year ago
B
bnelaNew Participant
asked in Design & Architecture
Logpoint Health monitoring through Grafana

Hi All, We do have different clients and we want to create a real time monitoring system. Is it possible to integrate it on Grafana, if yes do you have any idea how?  i know that monitoring through email is possible but we want a centralized monitoring system Thanks 

1340
B
1 year ago
M
Mark NorthcottNew Participant
asked in Searching & Analytics
list all event ids found by each device

I need to create a query to export the results with the following criteria, but unsure how to write the query.I want to list every end device by hostname (including all end devices fed by Windows event collectors, not reported as the WEC) and then all the event codes (unique) collected from that device in ascending order. Can someone please point me in the right direction

1491
G
LogPoint Team
1 year ago
M
MicropoleKnown Participant
asked in Searching & Analytics
Exiration log for Microsoft office 365

Hi,I would like to know if it is possible to find the log that show the expiration date of Microsoft office 365 account ? If yes, could you please tell me how can I find it ? Regards,Siawash

912
M
1 year ago
A
alekstaKnown Participant
asked in Design & Architecture
LogPoint [AIO] - import syslog from a syslog server

Hello,I have an archive server were I store some syslog/json logs on. I wonder If It’s possible to send over som of  these to LogPoint?Is It possible manually to transfer over some of the logs from the archive → Logpoint AIO? Like use scp or something else. I dont find any related documentation related to this. 

560
A
1 year ago
M
Matmut - SécuritéNew Participant
asked in Use–cases
How to estimate the volume of data collected ?

Hello,I would like to search a query to know the volume of data per day collected in my Logpoint.Thanks a lot

3412
M
1 year ago
M
Mike FurrerInspiring
asked in Searching & Analytics
Logpoint Agent X Applocker Dashboard

Hi.We have implemented Agent X into our systems, and we are observing Applocker Events with Agent X.Now our customer would like a dashboard for these Event.And I was not sure how to go about creating these Dashboards.How can I make a dashboard specifically for the Eventviewer logs.Cheers Mike

2043
Nils Krumey
LogPoint Team
1 year ago
M
Mike FurrerInspiring
asked in Searching & Analytics
Logpoint Agent X and devices Hostnames

Hellowith the new Agent X, we were testing adding Devices with Agent X to logpoint, due to DHCP they will not always have the same IP address. We attempted to add this device via Hostname to logpoint, but even though the Agent X panel claims that it is active and collecting logs, When searching for said logs, I get no result for the Hostname.Is it Possible to use Hostnames to add Devices to logpoint in use with agent X?Or is it not possible.

5022
M
1 year ago
K
Kamal PaulNew Participant
asked in Searching & Analytics
P2P network connection detect rule

Hello everyone,Being searching LP blogs and community to see if we have any detection rules for P2P network connections. Came out there is a rule to finding P2P applications but nothing of useful to find the network connection. Any tips or suggestions in building a P2P detection will be much appreciated. Thanks

331
Nils Krumey
LogPoint Team
1 year ago
A
alekstaKnown Participant
asked in Use–cases
Collect DHCP logs & enrichment with other log sources

I’m thinking of onboarding internal DHCP logs. But I don’t quit know yet If it’s a good way to go.I’m also in the progress of onboarding ISE logs, for authentication monitorering. Is It possible to correlate DHCP logs with ISE logs?How about use-case related to DHCP logs? Looking at the built in alert rules there was only few use-cases related to DHCP. I think more about rouge DHCP server and so on. Does anyone have experience about DHCP logs and the the ability to correlate these with other logsources to get MAX out of It.Thanks!

2272
A
1 year ago
L
LouisNew Participant
asked in Searching & Analytics
[HOW TO] MPS per repo and per log source

Hello all,I would like to visualize: MPS sent by each log sources MPS per repo_name I have managed to create a timechart of MPS per repo_name:repo_name=* | timechart count() by repo_nameNote : This is not really MPS per repos, but log volume per repo. But I cannot find how to generate the equivalent for each log sources. Thanks for your help!

7978
A
1 year ago
Kai Gustafson
Kai GustafsonKnown Participant
asked in Normalization & Parsing
Nxlog configuration, dropping logs from local host on IIS

Hi,I can’t get this to work, maybe some of you have tried this before.The drop line below works fine syntax wise, but my goal are to get rid of 127.0.0.1 logs, and when i remove the “!” it fails.Help Are apprecieredeRegards Kai  <Input IIS1>    Module   im_file    File    "C:\\inetpub\\logs\\LogFiles\\W3SVC1\\u_ex*"    Exec if $MessageSourceAddress != "127.0.0.1" drop ();     ReadFromLast FALSE    Recursive TRUE    PollInterval  1    Exec     $FileName = file_name();    Exec if $raw_event =~ /^#/ drop();\       else\       {\        w3c->parse_csv();\    $EventTime = $EventTime - (2 * 3600);\        $SourceName = "IIS";\       }</Input>

490
Kai Gustafson
1 year ago
D
D. van PuttenNew Participant
asked in Searching & Analytics
Add subnets to list

Hi, how can I paste a list of subnets to a static list?I'm trying to add a list of subnets to a static list in Logpoint (7.3.2). e.g.:1.2.3.0/242.3.4.0/245.6.7.0/234.3.2.0/22I cannot just copy/paste the list as it is pasted as one entry. 

1493
P
LogPoint Team
1 year ago
G
Georg WittigNew Participant
asked in Searching & Analytics
Access individual logs within single stream

Hi,I want to display all relevant information that is available for remote sessions per remote session. However this is contained in different logs that all have the same session_id. Suppose I gather those logs in a search via a single stream. For example like this:[3 user=”x*” type=login OR type=logoff OR type=authentication_try having same session_id] as Stream How can I access the individual logs included?  For example| fields Stream.type, Stream.col_ts, Stream.user or| chart count() by Stream.user etc. doesn’t work. Just showing the fields without grouping of same session_id is not the solution, since I cannot order fields and all session_ids are mixed. Hope there’s a way. BestGeorg

1294
G
LogPoint Team
1 year ago
G
Georg WittigNew Participant
asked in Searching & Analytics
group logs with same value

Hi everyone,  Here is a task that puzzles me: I am looking at events of remote connections and I want to display the connections that are currently active. One Connection has evetns like “login”, “authentication_try”,  “session_closed”, etc. and the same session_id. The number of logs with the same session _id may vary, since, for example, there might be more than one authentication_try.So I would like to first group all events with the same session_id and then filter out those, that do not have a “session_closed” event.I tried to implement this with one or two streams (join) but did not come to a solution. With one stream I cannot give an exact number of logs “having same session_id”, with two streams I would need something like “[session_id=*] as first-streamjoin[session_id=*] as second-stream on first-stream.session_id=second-stream.session_id AND first-stream.log_ts!=second-stream.log_ts”. Also a “not followed by” could have been a solution for this, which does not exist.  Does any

760
G
1 year ago
E
Edgar FastNew Participant
asked in Searching & Analytics
Dynamic Alert Recipient

Hi all,i would like to send an email alert and choose the recipient depending on the triggered alert. For example, when a user changed his active directory password, i want to send him an email, telling that the password for his account was changed and if it was not himself he should contact directly the helpdesk.Bestedgar

1021
S
LogPoint Team
1 year ago

Badge winners

Show all badges
Terms & ConditionsCookie settings