Help Center Logpoint Docs Idea Portal Logpoint.com

SIEM

Welcome to the SIEM community space! Post a question about anything related to SIEM and engage with fellow customers about all things SIEM.

237 Topics

M
MicropoleKnown Participant
asked in Searching & Analytics

BLACKLIST_COUNTRY

Hi !I would like to create a widget with all connexions from a black list counrty. But I don’t it si possible or not !Would like to know if is that possible or not? if is this possible, please could you tell me how can I get a list like that?  Thanks in advanceLooking forward to reading you

4
M
1 year ago
E
Edgar FastNew Participant
asked in Design & Architecture

Merge Repos

Hi all,we started using LogPoint and created repos for every device type. Now that we have 20+ repos i want to optimize this process and group devices by functionality (e.g. email, remote access). So my intention is to create an new repo for every functionality and modify the routing policies. I think this should work but there is a great time span where i have to search in the “new” and the “old” repo because of retention times of 90 or more days.Is there a smart way to copy the content from one repo to another so that i can get the optimizing done in a short time and this will not take 90+ days?Bestedgar

4
E
1 year ago
A
Andre KurtzInspiring
asked in Design & Architecture

Incident Management - Is it possible to automatically close cases ?

For our customer we currently have several alerts implemented. The customer has a rather small security team only interested in receiving email notification whenever an incident is triggered. So, the build in management incident of LogPoint is not used and all and i delete all open cases on a regular basis.However, for auditing reasons, for some incidents posing a major risk they would now like the security personal to use the incident management system by LogPoint and want them to resolve the cases there. All other incidents should, if possible, not be visible to them. Right now, i would assign these high risk alerts to the security personal so that are able to read and resolve them within LogPoint. Incidents with a lower risk would be assigned to me or a dummy group, and i would continue to regularly delete them manually. But i am wondering whether there is a better way: Does triggering an alert automatically have to create an incident, or is it possible to configure that only alerts

1
Nils Krumey
LogPoint Team
1 year ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Searching & Analytics

Formular to calculate first alert rule search time range

Is there a formula by which the first search timerange (from to) of a newly created alert rule could be calculated?For example, if I create a new alert rule with 24 hours time range NOW (e.g. at 10:00 AM), the first search will run between yesterday 6:00 AM and today 5:00 AM. Naively, I would have expected the search to run from yesterday 10 AM to today 10 AM.If I create an alert rule that has e.g. 5 minutes search time range, then the first search runs about 25 minutes to 20 minutes before the alert rule is activated.So the search time range of the alert rule search varies depending on the alert rule time range.Since I am developing an alert rule test environment that activates alert rules and ingests pre-made logs, it would be significant to set the timestamps in these pre-made logs so that they occur in the timerange in the first search run of the alert rule.So the question is, if there is a formula for this, with which I can determine the time period in advance, in which the alert

2
markus.nebel@8com.de
1 year ago
Piotr Moroz
Piotr MorozNew Participant
asked in Design & Architecture

Support Connection GDPR compliance

Hi,can anyone point me to terms & conditions describing compliance with GDPR regarding LogPoint support access using Support Connection functionality in LogPoint & Director? Or description what data can be accessible by support?Best Regards,Piotr

1
A
1 year ago
A
Anonymous
posted in APIs & automation

Interesting article about the Universal REST API Fetcher Configuration with Atlassian Confluence

Hi All, We are excited to share the below article focusing on configuring the Universal REST API Fetcher with Atlassian Confluence. In the article, you can read about the start-to-end procedure of the configuration including some of the know limitations and considerations to keep in mind.Read the full article below:https://servicedesk.logpoint.com/hc/en-us/articles/8140063415325-Universal-REST-API-Fetcher-Configuration-with-Atlassian-Confluence  

0
A
1 year ago
A
Aaditya KhatiNew Participant
asked in Use–cases

How to create a case from incident with in-built soar?

I have a requirement of creating cases from incident tabs. Can i get a reference to creating cases from incidents?

4
A
1 year ago
M
MicropoleKnown Participant
asked in Use–cases

Why this error message ? '}'

Hi,I come to you because I have an error when I execute folloing query. Could any one help me please ? Here is my quary : (MsWinEventLog OR norm_id=WinServer*) label=Object label=Access  (access_list=\"*4417*\" OR access=\"*WriteData*\") {{user},}, {{fileshare},}, {{path},},  -relative_target in SYSTEM_PATHS | rename relative_target as Object, share_path as Path |  chart count() by user, device_name, object_type,Path, Object | fields user, device_name, object_type, Path, Object and when I execute this query I receive these error message : Thanks in advanceLooking forward to reading you

2
M
1 year ago
A
Aaditya KhatiNew Participant
asked in Use–cases

Has anyone been able to integrate TheHive for managing cases ?

I am trying to create a use case where i can connect TheHive with LP. Lets discuss if anyone has been able to or planning to do this

13
L
1 year ago
S
Srijan KafleInspiring
asked in Searching & Analytics

Count number of entries in Dynamic list

How can we count number in entries in dynamic list?

4
S
1 year ago
S
Srijan KafleInspiring
asked in Searching & Analytics

Delete an entry from Table

I have a table that is populated frequently using query scheduled in the report. I am trying to remove an entry from the table. How can this be achieved.

2
S
1 year ago
A
Anonymous
posted in Normalization & Parsing

Logpoint Agent Collector v5.2.3 available now

Hi All, The Logpoint Agent Collector v5.2.3 has been released publicly. For more information, please visit the links below. Release notes: https://servicedesk.logpoint.com/hc/en-us/articles/360020035977  Documentation: https://docs.logpoint.com/docs/logpoint-agent/en/latest/

0
A
1 year ago
M
MicropoleKnown Participant
asked in Use–cases

Adding a Search Template

Hi,I would like to add a new parameters templete. But when I add the new parameter it doesn't works (for exemple when I add the source_address it doesn't works) ? I would like to know why ? Thank you in advance for your help. 

4
M
1 year ago
A
Aaditya KhatiNew Participant
asked in Searching & Analytics

Split same field values into two fields.

If i have an event_category= User, Logon. I want to be able to create new fields (e.g. X, Y) and present data like X=User and Y=Logon. What would be the query to showcase this in result.

1
Mike Blomgren
LogPoint Team
1 year ago
C
CarstenNew Participant
asked in Searching & Analytics

Add more Information to a Report

Hi there,i’m new using Logpoint. So i need some help for a search i would like to do. I would like to add some more information to the search “Top 10 User in Failed Kerberis Authentication” there i would like to add on which workstation the user have tryed to logon.

4
Rasmus Heiselberg Porse
LogPoint Team
1 year ago
S
Srijan KafleInspiring
asked in Design & Architecture

Logpoint collector behind NAT

Hi Community, We have a distributed collector in a remote location. We have established a Site-to-site VPN between locations. The scenario is that the IP Address of the collector is in NAT and mapped to a different IP than that of the actual host IP. For E.g the system IP of collector is 172.29.20.80 and the IP of the collector as seen by the Remote Logpoint is 172.22.2.2.  We have made the necessary configuration and ensured the Collector is visible in the logpoint. However, the IP as recorded by Logpoint is the actual system IP (Not the IP Logpoint should recognize it as). The issue is the status is Inactive stage.  Is this due to the difference in host IP and NAT address?  

7
Brian Hansen
LogPoint Team
1 year ago
A
Anonymous
posted in Searching & Analytics

AzureLogAnalytics released

Hi All,AzureLogAnalytics is now released, enabling you to fetch and analyze Azure Log Analytics workspace logs.For downloading instructions and documentation, please visit the links below:Help Center: https://servicedesk.logpoint.com/hc/en-us/articles/360017971858Documentation: https://docs.logpoint.com/docs/azureloganalytics/en/latest/

0
A
1 year ago
H
HeretoforeNew Participant
asked in Design & Architecture

Backup best practices

Hello,I’m designing my backup. So far in the documentation, I’ve read two options: application snapshot and application backup, both are writing to the local disk.Let’s put aside the configuration backup as it’s less than 1 GB. The real challenge comes with backing up repos.In an on-prem infrastructure, backups are stored in the backup infrastructure, with VTL and so on. There’s no way I can request to double the size of the repo disk just to store a consistent backup that I will have, then, to transfer to the backup infrastructure.In a cloud infrastructure, the backup would go directly to the object storage such as S3 Glacier. Neither would we rent a disk space used only during backup, though it might be easier to do in a cloud environment.In addition to the backup and snapshot methods from the documentation, I should add the option of disk snapshot, either from the guest OS or from the disk array (only for on-prem infrastructure). These would provide a stable file system onto which t

2
Rupsan Shrestha
LogPoint Team
1 year ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Searching & Analytics

Display List Elements like Tabel?

It is possible to use the search queryTable TABLE_NAMEto list the content of the table “TABLE_NAME”.But there seems to be no possibility to do the same with a list.Or did I miss something?

3
P
LogPoint Team
1 year ago
Nicolai Thorndahl
LogPoint Team
Nicolai ThorndahlLogPoint Team
asked in Searching & Analytics

Searching for special characters in fields like the wildcard star "*"

When searching for special characters in field values in Logpoint just pasting them in a regular Key = valueexpression, can often result in searches not working as intended from the users perspective as the Logpoint search language will interpret the character differently from the intention.For instance searching for fields with a star “*” character results in getting all results that has a value in that specific key, as Logpoint uses the star “*” as a wildcard character, which basically means “anything”.  key = * will result in all logs with a field called keyInstead of using they kay value pairs to search we can use the builtin command match to find any occurrences of the value that we are looking for. In this example we will search for the star “*” frequently referred to as wildcard. We have some logs that have a field called policy in which we would like to find all occurrences of the character star “*” . To do this we first ensure that the policy field exists in the logs that we s

1
markus.nebel@8com.de
1 year ago
A
Anonymous
posted in Use–cases

Hunting LockBit Variations using Logpoint

LockBit has been implicated as the most active ransomware and has been involved in the most attacks compared to others of its kind. Read our latest blog by Anish Bogati & Nilaa Maharjan from Logpoint Global Services & Security Research on how Logpoint can help you to strengthen your security posture when it comes to LockBit ransomware.Link to the blog post:https://www.logpoint.com/en/blog/hunting-lockbit-variations-using-logpoint/

0
A
1 year ago
A
Anonymous
posted in Use–cases

Introducing the Logpoint Use Case Catalog

Focusing on one use case at a time, the Use Case Catalogue will guide you through the implementation of basic monitoring of specific log sources in a Logpoint SIEM platform. The first instalment of the Use Cases Catalog series, Active Directory Use Cases is now available  on the link below:  https://community.logpoint.com/active-directory-13      

0
A
1 year ago
M
Mike FurrerInspiring
asked in Searching & Analytics

Enrich DHCP Logs, With ISE Cisco Logs. To see Switchports

Hi there.So we Have a Alert rule, that alerts us when a Unknown and New Device, leases a DHCP Adress, to prevent unwanted Physical Access.Now We wanted to Enrich said DHCP log, by adding Information of our ISE/Switch Logs, so that when we get the Incident from the Alert rule, we also see what Switch and Switchport, this Unknown device is Hanging at.We are Pretty sure that should be Possible, but I haven’t figured out how yet.Cheers Mike Furrer

2
Prabesh.B
LogPoint Team
1 year ago
B
Brandon AkalNew Participant
asked in Design & Architecture

Qualys vulnerability management integration

Hello, We’re looking at integrating our Qualys VM scans into our Logpoint instance. I was hoping to pick someone's brain about this. Does this only work on singular Qualys accounts, or will it work on MSSP/Consultant editions? Many thanks,

2
Nils Krumey
LogPoint Team
1 year ago
G
LogPoint Team
Gustav Elkjær RødsgaardLogPoint Team
posted in Searching & Analytics

Incident Reporting Overview with Search Query

Hi,I have been looking into how to get an overview over actions taken by an Security Analyst whilst using the Incidents view on Logpoint.Therefore i have created this Search Query to get an overview over Incdents and Actions.Repository to be searched on is _LogPointincident_id = * | chart count() by incident_id, log_ts, alert_id, status, action, user, alert_name, comment order by incident_id, log_ts asc Hope this could be useful.Best Regards,Gustav

0
G
LogPoint Team
1 year ago

Badge winners

Show all badges
Terms & ConditionsCookie settings