Skip to main content
Help Center Logpoint Docs Idea Portal Logpoint.com

SIEM

Welcome to the SIEM community space! Post a question about anything related to SIEM and engage with fellow customers about all things SIEM.

250 Topics
T
Tobias HartmannNew Participant
asked in Searching & Analytics
Is it possible to share alert rules from "Used Rules"?

I’ve implemented some alerts by using Vendor Rules (via the “Use” action) and customizing them. But there is no action to share or change ownership of rules in the “Used Rules” view. Is it generally impossible to share those rules?  Maybe I don’t quite understand the purpose of “Used Rules”, shouldn’t the vendor rule by under “My Rules” once it has been customized?

801
Mike Blomgren
LogPoint Team
3 years ago
HansHenrikMoerkholt
HansHenrikMoerkholtInspiring
posted in Design & Architecture
TCP Keepalive & Dead Connection Detection

HiOne of the changes from LogPoint 5 to 6 I was exited to see implemented, was the support for session keepalive in the syslog collector.Most people do not think that much about it, but I would say that it is part of ensuring a stable operating environment.Doing a 'netstat -ano | grep 514' in the CLI you will probably get something like the below listed:(I have pasted in the headlines as well as they will not show using '| grep')Active Internet connections (servers and established)Proto Recv-Q Send-Q Local Address           Foreign Address         State       Timer--------------tcp6       0      0 :::514                  :::*                    LISTEN      off (0.00/0/0)tcp6       0      0 172.20.20.20:514        172.20.10.107:50554    ESTABLISHED keepalive (7126.58/0/0)tcp6       0      0 172.20.20.20:514        172.20.10.100:51662    ESTABLISHED keepalive (7126.58/0/0)tcp6       0      0 172.20.20.20:514        172.25.20.42:50053      ESTABLISHED keepalive (7135.92/0/0)--------------

11610
HansHenrikMoerkholt
3 years ago
HansHenrikMoerkholt
HansHenrikMoerkholtInspiring
posted in Operations Monitoring
LPA Agents status

HiI got this Python script from Mingma in LogPoint support, and think it is such a great utility, that it would be a pity if it is not available for others in the LogPoint community.It makes a csv-file of the info from the 'Agents' section of the 'LogPoint Agent Plugin' listing:"Device Name, Template, Source, Encryption, Last Config Update, Status"This can be used for different purposes like for example documenting to the the Agents status to the customer. RegardsHans

921
HansHenrikMoerkholt
3 years ago
B
Brandon AkalNew Participant
asked in Design & Architecture
VM IOPS requirement

Hey, I’m trying to find information on the required/recommended IOPS for both hypervisor-hosted LPs and cloud-hosted VMs.  Many thanks,

1141
Irakli Edjibia
LogPoint Team
3 years ago
H
Hans VedderNew Participant
asked in Operations Monitoring
"/opt/makalu/storage" grows and grows and grows

Hi,since I installed Logpoint 6.12 three weeks ago, "/opt/makalu/storage" grew from 47 % to 89 %.Does anyone have the same issue?Best regards,Hans Vedder

3861
markus.nebel@8com.de
3 years ago
O
obachaneNew Participant
asked in Design & Architecture
KPI

I want to define the KPI ( Key Performance indicators )for each equipment in the dashboard, how can I proceed?

461
markus.nebel@8com.de
3 years ago
H
Hans VedderNew Participant
asked in Searching & Analytics
Using geoip at drilldown

Hi,at https://servicedesk.logpoint.com/hc/en-us/community/posts/360008777778-How-To-video-Using-GeoIP-with-LogPoint Kalyan Bhetwal provided the following query:norm_id=*  destination_address=* -destination_address in HOMENET  | chart count() by destination_address, country order by count() desc limit 10 | process geoip(destination_address) as country To my comment “With the ‘new’ query it's not possible to make a drill down.” he wrote:We will have a new feature in upcoming version of logpoint where the geoip used after chart count() will also be present in drilldown. This will solve the drilldown problem. What about the new feature? At the moment, it’s still not possible to make a drill down.I use Logpiont 6.12.1.Best regards,Hans Vedder

1311
Rupsan Shrestha
LogPoint Team
3 years ago
H
Hans VedderNew Participant
asked in Searching & Analytics
How to see a result whith "filter < ..."

Hi,every hour my firewall loads a new antivir database. In normal case, I receive 24 logs a day. When the download fails, I don’t receive any log.Now I want to be informed when the count of logs are less than 20 a day.I tried the following:norm_id=FortiOS event_category=kevent sub_category=update message="Update result: virus db:yes*"  | chart count() as "Count" by message | filter "Count" &lt; 20but this query doesn’t show my any results. I would like to see message and Count.What should I modify?Best regards,Hans Vedder

703
H
3 years ago
M
Mark NorthcottNew Participant
asked in Design & Architecture
Import Microsoft SCCM logs?

Im looking to import the various SCCM log files, but there doesnt appear to be a normaliser or an obvious way to do this. Has anyone else done this? I’m mainly interested in the last client communication an the last patching updates and attempts as part of a bigger piece of work to compare last communications from various different sources.

860
M
3 years ago
H
Hans VedderNew Participant
asked in Searching & Analytics
Why this query is wrong?

Hi,when I start a query | chart min(log_ts) as min_ts  by min_ts, source_address, destination_address I receive the error message:could not convert string to float: '/'.But why?An example for log_ts: 2021/10/11 11:04:54I use | chart count() as "Count", min(log_ts) as min_ts, max(log_ts) as max_tsin a macro and I am sure that in fewer versions of Logpoint I didn’t receive this error message.Actually I use Logpoint version 6.12.0Best regards,Hans Vedder

2356
H
3 years ago
A
Andre KurtzInspiring
posted in Searching & Analytics
Join: Restricting "followed by" using time conditions

Hello, i am facing following scenario:I want to monitor web gui access to a device, especially the host a access was attempted from. However, most of the access attempts are done from different LANs, using web proxies. Hence, i only see the ip of the web proxies as the source ip of the login attempts. I therefore like to use some kind of join to retrieve access attempts to the device, and then check the web proxies which ip was accessing the device IP at around  that time (e.g. within two seconds). (I tried a join based on the exact same time, but this approach leaves out many events). So basically, i need something like [search1] as s1 followed by [search2] as s2 on s1.log_ts &lt;= s2.log_ts + 2 seconds Does any body know how i can accomplish this, or knows of  a different approach ? Andre

1133
A
3 years ago
HansHenrikMoerkholt
HansHenrikMoerkholtInspiring
asked in Operations Monitoring
Extract of LPA information for customer use

When using the LogPoint agent all administration is done in the LPA plugin, which can only be accessed by the LogPoint administrator.Some customers wants reporting on the operational side of things and part of that is a report displaying:Device Name ,Template,Source,Encryption,Last Config Update,Status How can this output be created without supplying the customer with a number of screen shots

1433
D
3 years ago
T
Timo FahlenbockNew Participant
asked in Searching & Analytics
Creating Alert Rules PAK File

HI,i want to integrate many of the SIGMA Rules found here:https://github.com/SigmaHQ/sigmaI was able to translate them into the Logpoint Query Language and Now i want to Import them as Alert Rules.Doing each one by one manually in the GUI is a very time consuming/impossible Task.Is there a Way to Import Alert Rules beside the .PAK Files? Or is there a Defintion how such a .PAK File looks? Best RegardsTimo  

3322
T
3 years ago
P
Padraig KellyNew Participant
asked in Operations Monitoring
Adding devices to logpoint with CSV

HiI have 70+ devices  to add to logpoint for monitoring.     The version of Logpoint is 6.7.4.I dont want to key them in with the GUI (takes too long, risks of mistakes).   I have the device details in a spreadsheet - extracting to a csv and loading the csv into logpoint with the UI is the best way. The device uses a proxy I have followed the documentation  - but perhaps I’ve misread something. The CSV line below gives the error “Exception, Nonetype object has no attribute split” device_name,device_ips,device_groups,log_collection_policies, distributed_collector,confidentiality,integrity,availability,timezone,uses_proxy, proxy_ip, hostname, processpolicydevice1,10.0.0.1,linux,,,,,,Europe/London,TRUE,192.168.1.1,10.0.0.1,Linux    I can add devices without issue if I remove the last 4 fields from the csv  (i.e. uses_proxy, proxy_ip, hostname, processpolicy),  but i do want to add the syslog collector details.Does anyone know if the add devices with a csv actually works when you want to a

3344
P
3 years ago
A
Anonymous
posted in Use–cases
LogPoint 6.12 - Speed up incident response with more contextual awareness

Join Sales Engineer  @Nils Krumey on October 5 on a live session where he will demo how the new update to LogPoint can help security analysts react to and resolve threats quickly by knowing instantly which type of threat it is.  Join the knowledge session to:- Learn how the new categorisation of alerts and incidents to the MITRE framework can speed up incident response- See how you now can share search and report templates- Understand how LogPoint is making it easy to route incidents to different SOAR playbooks based on the incident type Register on the link below:https://lnkd.in/ggg9pvMH 

710
A
3 years ago
Kai Albarus
Kai AlbarusInspiring
asked in Use–cases
Alarm a missing Event...

Hi @all, do anyone have an Idea how to alarm a missing Event like:Every Morning around 4 there should be a “successful copy” Event. I want to Alarm if exactly this Event is missing.The Alarm should fire around 6 and not much later. My only Idea is to run a scheduled Report because i can’t configure the ALarm to rum exactly in the Timeframe of 2 hours. Am i wrong?

732
Kai Albarus
3 years ago
Kai Albarus
Kai AlbarusInspiring
asked in Normalization & Parsing
Normalizer Timestamp

I have a nice Logfile (FlatFile with once a day import via Ubuntu LogPoint Agent) containing a timestamp like: |20210905|231304| Any suggestions how i need to modify my Normalizer to understand this Time ? Edit:I do some sed Magic and change the Format directly in the Logfile

3952
Mike Blomgren
LogPoint Team
3 years ago
A
Aaditya KhatiNew Participant
asked in Use–cases
Fetching logs using Nessus Fetcher

Installed Nessus. Configured Nessus fetcher in LogPoint and communicated with Nessus successfully.  What is the following procedure that the Nessus logs are imported to LogPoint?Thanks in advance. 

2133
Nils Krumey
LogPoint Team
3 years ago
J
John CouzinsNew Participant
asked in Design & Architecture
Case Management

Hi, i am just wondering if there was any plans to include any form of case management with the product.We are currently commenting on incidents an a structure way to allow us to search back through them, but having the ability to save multiple logs which relate to an investigation for the purposes of escalation or handover or to even store outside of the various repos to have a log retention period would be so useful. I know that this is possible currently through exporting the logs out, but these take the raw logs out of logpoint which is not as useful. Without wanting to point to another vendor, LogRhythm have similar case management functionality which allows you to add certain logs into a case/investigation for ease. 

1062
J
3 years ago
Brian Hansen
LogPoint Team
Brian HansenLogPoint Team
posted in Use–cases
New Blogpost - Detecting PetitPotam

Remember to read the latest BlogpostWatch out for PetitPotam, a relay attack that can compromise your domain without any authentication. In this blog post, our Security Analytics Engineer Babesh Rai takes you through all you need to know to mitigate the threat and detect the attack chain in LogPointRead the post here: https://www.logpoint.com/en/blog/detecting-petitpotam-a-relay-attack-that-can-compromise-your-domain-without-any-authentication/ / Brian   

290
Brian Hansen
LogPoint Team
3 years ago
J
Johannes BendigNew Participant
asked in Normalization & Parsing
Debian Normalizers

I want to add some Linux Logs to Logpoint and I have seen that there are so many different normalizers that the testing would be take forever . . . Has somebody a best practice normalizers for a default Debian rsyslog configuration?

2013
Nils Krumey
LogPoint Team
3 years ago
A
Andre KurtzInspiring
asked in Searching & Analytics
Is it possible to create a device group with devices on a remote LP ?

Hello, as the title says i was wondering whether devices that are configured as a log source on a remote LP can be added to a devices group configured on the local LP? Our network is divided into two locations connected via a MPLS connection, and to prevent devices sending their logs over the MPLS line we configured a LP at each location and added one LP as a remote LP into the other LP (our “main LP”). I would like to create an alert on our “main LP” to notify us when a deviceis  no longer sending logs. Hence i would like to create a device group on the “main LP” containing all the devices the alert should “monitor”, but i am unable to add devices that are configured as log sources on the remote LP. As far as i understand the documentation, it is possible when using LP Director (which we do not have), but not possible in our scenario. Just  would like to confirm this and that i have to create an altert on both LP monitoring the “local” log sources.    

1034
A
3 years ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
posted in Design & Architecture
Discussion: How do you implement Clients in DHCP networks?

In our internal research team we obsevered that it is of extremly high importance to have the logs of the client systems collected in your SIEM. Especially of the windows systems, in the best case with sysmon together with a sophisticated sysmon configuration.The majority of large scale “attacks” doesn’t utilize any strange “cyber hacking voodoo”, but uses simple “human naivity” as initial code execution trigger. Like a “mouse click” to “enable content” of a microsoft office document with VBA macros, which was delivered via email from the attackers. The following malware download, its execution, reconnaissance and lateral movement steps can be easily detected with a good sysmon configuration. And this in “real time”, before any harm was done or your IDS may throw alerts.The main issue is, that clients are typically flexible/mobile systems, which are connecting your enterprise network via different network IP ranges (several LANs, Wifi, VPN, WAN etc.).As the current logpoint design requ

49811
L
3 years ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
asked in Searching & Analytics
More Fields in Stream Search with "having same"?

When I'm using a search query like this:[5 event_id=1234 having same user] I'm getting a grouped result with only log_ts and user as normalized fields for this group.Is it possible to get more fields similar to SQL with theselect FIELDS where CONDITIONAt the moment I'm "workarounding" this with joining the first search with another search. But this seems to be extremly inefficient because it uses the analyzer process which itself relies on slow leveldb operations:[5 event_id=1234 having same user] as s1 join [event_id=1234] as s2 on s1.user = s2.userIs there a better solution?The problem with 'having same' is, that the search result only contains the fields specified in the 'having same' clause. But in this special case the 'service' field should be different, not the same. So specifying it in a comma separate list (like '...having same user,service...') doesn't help here.It would be great to access all the other fields in a following 'chart count()' etc.

1501
Basudev Raut
LogPoint Team
3 years ago
markus.nebel@8com.de
markus.nebel@8com.deBrainy
posted in Normalization & Parsing
Howto: Increase maximum size of syslog message

In the default configuration the syslog_collector process only accepts messages (log lines) with a maximum of 10000 bytes (characters). This results in truncated messages and thus they will not be normalized correctly. Especially powershell script blocks may contain important information, but generate very long log messages.Unfortunately this is a fixed value in the syslog_collector binary.At least the c code is avialable in the system and you can adjust the values and compile the binary again.For this you need sudo/root access.sudo -i # become rootcd /opt/immune/installed/col/apps/collector_c/syslog_collector/cp syslog_collector.h syslog_collector.h.bak # create a backup of the filenano syslog_collector.hchange the value here in this line: compile the syslog collector using:/opt/immune/bin/envdo make clean/opt/immune/bin/envdo makesv restart /opt/immune/etc/service/syslog_collector/ # restart the serviceIt would be a great feature to be able to set this value within the web UI.

7511
Rupsan Shrestha
LogPoint Team
3 years ago

Badge winners

Show all badges
Terms & ConditionsCookie settings