Skip to main content
Help Center Logpoint Docs Idea Portal Logpoint.com

SOAR

LogPoint SOAR is a new solution that helps security operators reduce costs and increase efficiency by automating repetitive manual tasks, such as incident investigation and response.

32 Topics
K
KazYNew Participant
asked in Technical FAQs
Unable to see some Pre-configured Playbook Guides

Hi,I cannot see following Pre-configured Playbook Guides https://docs.logpoint.com/soar?p=Logpoint&page=Pre-configured%20Playbook%20Guides.Brute Force Detected - Multiple Unique Sources Playbookhttps://docs.logpoint.com/docs/brute-force-detected-multiple-unique-sources-playbook/en/latest/ Credential Dumping - Registry Save Playbookhttps://docs.logpoint.com/docs/credential-dumping-registry-save-playbook/en/latest/ Default Brute Force Attempt Multiple Sources Playbookhttps://docs.logpoint.com/docs/default-brute-force-attempt-multiple-sources-playbook/en/latest/ Password Spray Playbookhttps://docs.logpoint.com/docs/password-spray-playbook/en/latest/ PsExec Tool Execution Detected Playbookhttps://docs.logpoint.com/docs/psexec-tool-execution-detected-playbook/en/latest/All links direct to the page showingPermission DeniedYou don't have the proper permissions to view this page. Please contact the owner of this project to request permission. How can I see these pages?Best,Kaz

20
K
14 hours ago
J
Julien GarnierNew Participant
asked in Technical FAQs
Playbook not executed when alert is triggered

Hello,I am trying to set up the launch of a plugin when an alert is triggered.My alert appears to be working correctly; I receive an email every time it is executed. According to the documentation, I've set up the trigger on my Logpoint search node like this:SELECT * FROM LogPoint WHERE alertrule_id = 'xxxxxxxxxxxxxxxxxxx' OR name = 'Detection of a Threat 2'I have also tried SELECT * FROM LogPoint WHERE alertrule_id LIKE '%xxxxxxxxxxxxxx%' Unfortunately, when an alert is triggered, the playbook is not executed. Do you have any idea what might be causing this issue? Am I missing something? Regards,Julien

541
S
LogPoint Team
3 months ago
Nirmal Unagar
Nirmal UnagarNew Participant
asked in Technical FAQs
Adding IP into LIST

Hi folks, How can I add IP into LIST in playbook? I have created playbook where I am extracting malicious IP and want to add into LIST(SOAR). It would be great if someone have idea which node I should use or any other way?

381
HansHenrikMoerkholt
3 months ago
M
MicropoleKnown Participant
asked in Use cases
Why this error message ?

Hi,I am trying to create a playbook in order to block an account. However I have an error message thas I can’t undrestand the reason. Could you please tell me why I have this error message ?“Bad/missing Action inputs! Details: Bad rest-action url: /users/...” Thank you in advance.Regads,Siawash

511
N
LogPoint Team
5 months ago
M
MicropoleKnown Participant
asked in Use cases
SOAR Playbook Creation From LogPoint Alerts

Hi,I need your help regarding the SOAR. In fact, I have just started the SOAR and I want to create a playbook From LogPoint alerts in order to block an IP@ or an action. Could please help me ? How can I do that ? Thank you in advance. Regards,Siawash 

2091
N
LogPoint Team
6 months ago
G
Gabriel LayanaNew Participant
asked in Use cases
How to configure AbuseIPDB instance in LogPoint SOAR

Hi everyone,I need to check some source addresses in my playbooks and I want to use AbuseIPDB for this action, but I can’t finish configuring AbuseIPDB instance and obtain some errors.  Could you help me with the correct configuration for this instance in SOAR LogPoint Playbook integrations?.  I have my api_key but I don’t know what is the correct base_url and threshold parameters if I need to review IP address. I hope your help Regards Gabriel

650
G
7 months ago
G
Gabriel LayanaNew Participant
asked in Technical FAQs
how to configure AbuseIPDB instance

Hi everyone, I need your help.  I need to check Public IP Address in my playbook to obtain some information about it.  I want to use AbuseIPDB but I’m obtaining error. Bad/missing Action inputs! Details: Bad rest-action url: base url/check I think the error is in my AbuseIPDB’s instance configuration.  What is the base_url and threshold that I have to configure?  I have my API Key ready. Thanks for your help. Regards, Gabriel

260
G
7 months ago
O
Olin NGAGOMNew Participant
asked in Use cases
Launch a playbook when an alert is triggered

 l have an alert rule that triigers when it detects a web attack like XSS, SQLI.i want my playbook to starts when the alert is triggered. Any idea??

1391
HansHenrikMoerkholt
1 year ago
NiklasSchmidt
NiklasSchmidtNew Participant
posted in Use cases
A playbook that streamlines the process of investigating incidents associated with a specific IP address

Hey everyone,During my day to day, I identified a workload that I was able to fully automate with SOAR playbook. I have created a SOAR playbook that does the following.Takes the outbound IP address from incident data as a trigger. In my example, 213.183.58.12.The playbook automates the following workload.Checks WhosthisIP to gather information about this external IP (domain, etc) Uses SearchAPI to extract all users that have interacted with this IP (from SIEM). Also extract all the incidents related to the above IP Uses SearchAPI to get the number of incidents this user is associated in the last 12 hours Sends an email to the required address (completely customisable) with the list of those incidents info (this could be your SOC's email, or analyst's email) and waits for response Use IncidentAPI to mark this incident as resolved and Close the Case, when the email gets an response.This playbook can be nested with other playbooks or you can run it independently. Please be aware that when

1120
NiklasSchmidt
1 year ago
A
Ahmad KhilfiNew Participant
asked in Technical FAQs
Capture Raw Logs into SOAR Parameter

Is there a way to capture raw logs and use them as field parameter?

530
A
1 year ago
GJC
GJCNew Participant
posted in Technical FAQs
About director console

can you share some useful commands used in backend for our knowledge like how to find installed version of director console etc.. 

320
GJC
1 year ago
A
Anonymous
posted in Technical FAQs
Introducing: Certified Logpoint SOAR Training

We are delighted to announce the launch of our new Certified SOAR User Training. Throughout the full day training session, a LogPoint Certified SOAR Expert will display and explain the features of the SOAR solution, look into real-world use cases, highlight best practices and how all the various blocks of Logpoint SOAR can be combined for maximum efficiency. The first course debutes on October 24th, and will recur monthly. (For the other upcoming dates, please see below.) For further inquiries about registration and pricing, please contact your local Logpoint representative or email to csz@logpoint.com  Course Schedule Q4 2022 / Q1 2023:Monday October 24th  9 AM-5 PM CET Monday November 28th 9 AM-5 PM CET Monday December 12th 9 AM-5 PM CET Monday January 23rd 9 AM-5 PM CET Monday February 20th 9 AM-5 PM CET Monday March 20th 9 AM-5 PM CETFor more information, please visit logpoint.com/LogpointAcademy*All courses are held online

2572
A
1 year ago
yashusharma
yashusharmaNew Participant
asked in Use cases
How to Extract Custom SAP Table Modification Logs in SIEM Using LogPoint for SAP?

Hello everyone,I hope this post finds you well. Today, I'd like to discuss how to extract custom SAP table modification logs in SIEM using LogPoint.For those unfamiliar with the concept, SIEM (Security Information and Event Management) is a technology that combines security information management (SIM) and security event management (SEM) to provide real-time analysis of security alerts generated by network hardware and applications.LogPoint is an industry-leading SIEM solution that enables users to collect and analyze log data from various sources, including SAP systems.When it comes to SAP systems, LogPoint can be used to extract modification logs for standard tables. However, for custom tables, some additional configuration is required to ensure that the logs are collected and analyzed properly.Here are the steps you can follow to extract custom SAP table modification logs in LogPoint:Step 1: Enable Change Document ObjectFirst, you need to enable the change document object for your c

1591
A
1 year ago
Rasmus Heiselberg Porse
LogPoint Team
Rasmus Heiselberg PorseLogPoint Team
posted in Use cases
ChatGPT-SOAR integration now available for Logpoint

Hi All,Have you tried our new ChatGPT-SOAR integration yet? The OpenAI Actions will allow you to ask ChatGPT anything and incorporate the responses into your playbooks and use cases. The actions require valid credentials you can apply for at platform.openai.com/signup. The actions allow you to send requests, receive answers and  modify the model used for receiving results. To read more about the use cases: https://www.logpoint.com/en/media-room/#/pressreleases/logpoint-makes-chatgpt-soar-integration-available-3232134To download: https://servicedesk.logpoint.com/hc/en-us/articles/9183395790237-ChatGPT-Integration

3640
Rasmus Heiselberg Porse
LogPoint Team
1 year ago
Anastasya
AnastasyaNew Participant
asked in Use cases
Vendor rules sharing

Hey there, I’m not available to comment on the post from a year ago and I have follow-up questions:Mike Blomgren in his reply stated that in order to “share Alert Rules with User Groups, you need to Clone the Vendor Rule”. My questions are as follows:Does it work the same way with the “Vendor rules”? Is there an option to share the “Vendor rules”? If so, is there an available solution to share multiple (like 50 or more) vendor rules? Do you have to clone them all?Thank you in advance.

673
Anastasya
1 year ago
Ash Scott
Ash ScottInspiring
asked in Use cases
Combining formatted messages from ForEach?

Hi folks, I was just wondering if there was a way to combine formatted messages into one result from a ForEachResult loop?Diagram showing how I would like the results to combine.I currently have a little status message that is created by having the ForEachResult connected to a Format node. Unfortunately, I can’t think of a way to combine these created Format nodes into a single Format message that can then be used elsewhere.I could feed the results into a Python script but that seems excessive for such a small thing (and would like to avoid if possible as it adds delay).I also looked to see if I could have a ‘LIST’ global parameter, but that does not appear to be the case. Any ideas?

1022
Ash Scott
1 year ago
Ash Scott
Ash ScottInspiring
asked in Use cases
What's the use case for 'Add Global Parameters' action in SOAR 1.0.4?

Hi folks,I was wondering if anybody could tell me what the use case is for the new ‘Add Global Parameters’ action added in SOAR 1.0.4? As far as I can see, any output parameter from an action is already accessible from any other? From my quick tests it doesn’t look like they pass down to Sub-playbooks either, so are they just meant as a quicker way to access the values within a playbook?I couldn’t find any documentation on this, so I was hoping someone else might know the answer.

1716
Ash Scott
1 year ago
Ash Scott
Ash ScottInspiring
asked in Use cases
Rename a case within a Playbook?

Hi folks, Another cases and playbooks question - is there a way to update the name of an existing case item from within a Playbook? By default, we are generating cases with just the incident ID for identification, but we’d ideally like to be able to update the name of the case once some additional playbooks have run.We already have a way to get the case ID etc, it’s just the renaming part we’re stuck on. Is this possible?

1346
Ash Scott
1 year ago
Ash Scott
Ash ScottInspiring
asked in Use cases
Update case with output from Playbook

Hi folks,Is there a way to update a case with the output of a Playbook?For example, if I have a Playbook that checks an IP Reputation, is there any way I can get the Playbook to update the case to display the reputation response as an actual Case Annotation or something of the sort? 

943
Ash Scott
2 years ago
zana
zanaNew Participant
asked in Technical FAQs
Where the to find detail about type of log can be collect from different device

Hi,I want to know the information about all the data/logs that will be captured by LOGPOINT SIEM from different devices such as Firewall the logpoint SIEM can captures is syslog. So how about the others supported device/sources such as workstation /switches ?  and where in Logpoint site/portal that we can to find this info?Actually we want to list out detail for every device that can give us easy to forward log to logpoint siem.

782
Prabesh.B
LogPoint Team
2 years ago
A
Anonymous
posted in Use cases
Top 5 SOAR use cases

Analysts are constantly swamped with alerts, and to deal with this, they have to rely on repetitive manual tasks. This is like putting water on an oil fire, making the situation much worse and more time-consuming.SOCs need a solution that enables them to manage and prioritize their workflow efficiently by giving them the ability to collect security threat data and alerts from multiple sources. This is where Logpoint steps in.Previously we identified top use cases for SIEM. This time here are five common SOAR use cases that every organization should implement to reduce alert fatigue, overload and subsequently increase productivity in your SOC team.01 Automated alert triage and enrichment02 Endpoint malware mitigation03 Automated Phishing Investigation and Response04 Automated Threat Intelligence management05 Ransomware mitigationTo read the full story, read the link below: https://www.logpoint.com/en/blog/top-5-soar-use-cases/

1510
A
2 years ago
A
Anonymous
posted in Use cases
Introducing /logpoint Playbook Explorer

Hi All,Have you ever found yourself asking the following questions while using /logpoint SOAR? What do i need to do to run a specific playbook? What playbooks can i run with my current set of integrations? What integrations should I get to run a specific playbook? In case the answer is yes, we have exciting news. We are pleased to announce the  launch of /logpoint playbook explorer, a compact tool helping you to maximize the security value of your integrations and SOAR playbooks.For your convenience, we have also created a short walk-through video attached below.You can access /logpoint playbook explorer via the link below:https://docs.logpoint.com/playbook-explorer Should you have more questions, do not hesitate to reach out to us here or via customersuccess@logpoint.com

2260
A
2 years ago
J
James BettsNew Participant
asked in Use cases
SOAR VirusTotal API integration

Hi, Is anyone using the VirusTotal integration into their SOAR?I was all for getting it setup until I saw that you cannot use the free Public API in a commercial product.“The Public API must not be used in commercial products or services.” (https://developers.virustotal.com/reference/public-vs-premium-api) So, is anyone using the Premium API? and is it really $10,000 per year?Or are you sticking to the public API and hoping to not get blacklisted?Cheers

10901
T
2 years ago
zana
zanaNew Participant
asked in Technical FAQs
Set logpoint as collector and SOAR

Hi ,I have a question regarding configuration of Logpoint. Can we set logpoint as a collector andat  the same time with enable the SOAR? Can we only use one server and set as one console for both?

1201
markus.nebel@8com.de
2 years ago
zana
zanaNew Participant
asked in Technical FAQs
Connecting FortiSIEM with LogPoint SOAR

Hi,Can FortiSIEM from Fortinet product connecting to LogPoint SOAR?IF yes, can share with me the step or the action needed.

2111
Nils Krumey
LogPoint Team
2 years ago

Badge winners

Show all badges
Terms & ConditionsCookie settings