Skip to main content
Help Center Logpoint Docs Idea Portal Logpoint.com
  • Community
  • UEBA - User and Entity Behaviour Analytics

UEBA - User and Entity Behaviour Analytics

Welcome to the UEBA community space! Post a question about anything related to UEBA let it be baselines, use–cases or configuration.

13 Topics
M
MicropoleKnown Participant
asked in Configuration
Adding Device to logpoint

Hi,I had added a device into the logpoint and I have done all the steps of this documentation Devices — Data Integration latest documentation (logpoint.com).However, the logpoint didn’t collect any log from this host. In addition I checked in this host and I didn’t find lpagent. Could you please tell why it not works ? And what should I do ? Regads,Siawash

1170
M
1 year ago
A
alekstaKnown Participant
asked in Configuration
LogPoint UEBA Configuration

Hi!I’m wondering how LogPoints UEBA handle nested AD groups? Nesting of AD groups for selection of specific users that I wont to point to the UEBA cloud for AI intelligence. Is this possbile? 

451
Nils Krumey
LogPoint Team
1 year ago
H
Henrik MartinssonNew Participant
asked in Use Cases
Unable to hunt down the user/process that failes to authenticate on DC

I monitor for failed authentications on DC’s.labels: Authentication | Fail | Kerberos | UserMy top failed authentications is on one client/one account that I can’t hunt down. I have looked at all process’es and their “credential’s” + installed sysmon on the client. But I can’t find the process or user. Any ideas how I could hunt this down?

1388
H
1 year ago
A
Anonymous
posted in Data-sources
Public release of GoogleCloudPlatform v.6.0.0.

Hi All,We are excited to share the release of GoogleCloudPlatform v.6.0.0.Google Cloud Platform (GCP) is a suite of cloud computing services that provides infrastructure as a service, platform as a service and serverless computing environments. Alongside a set of management tools, it offers a series of modular cloud services including computing, data storage,  data analytics and big data processing. To read more on this release, please follow the link below: https://servicedesk.logpoint.com/hc/en-us/articles/8956510332061 

170
A
1 year ago
A
Anonymous
posted in Use Cases
Hunting and remediating BlackCat ransomware

Known by many names, including ALPHV, AlphaV, ALPHVM, and Noberus, BlackCat ransomware made headlines for its successive attacks on high-profile targets. Like Black Basta and Lockbit, it also operates under the Ransomware-as-a-Service (RaaS) model and uses double and sometimes triple extortion techniques.BlackCat uses its public leak site to intimidate victims, where anyone can search and access the leaked victim information easily. The highest ransom they have demanded so far is $14 million and it’s speculated that it has similarities with ransomware families like Darkside, Blackmatter, and REvil in regard to the tools, filenames, and techniques they use. To read more about means of protecting your organisation against Black Cat, read our blog on the link below.https://www.logpoint.com/en/blog/hunting-and-remediating-blackcat-ransomware/#detecting-blackcat

360
A
2 years ago
J
JohannNew Participant
asked in Data-sources
Cisco Ironport eMail Security Appliance integration with UEAB. Why did it not work?

Hi,I´m struggeling with the integration of the Cisco Ironport eMail Security Appliance as UEBA source.The LogPoint documenation - Data Sources For UEBA — UEBA Guide latest documentation (logpoint.com) - indicates the ESA is supported.The corresponding UEBA matching query is  - device_category=Email* sAMAccountName=* receiver=* datasize=* | fields,log_ts,sender,receiver,userPrincipalName,sAMAccountName,datasize,subject,status,file,file_countThe ESA never sends a combination of receiver and datasize. The ESA only logs a combination auf sender and datazize.   The ESA´s  sender & receiver logs are linked only via the MID “message_identifier”Has anyone seen or did  this integration with Cisco´s ESA and UEBA?  Is it running in the correct way? Thanks.BRJohann

4273
J
2 years ago
Friedrich von Jagwitz
LogPoint Team
Friedrich von JagwitzLogPoint Team
asked in Use Cases
UEBA Risk Score

LogPoint UEBA: User Risk Score How are the User Risk Scores being calculated (“weighted totals”, “fuzzy logic”, ...)?

971
Nils Krumey
LogPoint Team
3 years ago
Nils Krumey
LogPoint Team
Nils KrumeyLogPoint Team
asked in Data-sources
What models are there for the "Active Directory Authentication" in UEBA?

Does anyone have some examples of the models that are used for the “Active Directory Authentication” data source? For example, does this depend on certain Event IDs being present in the logs, and if so how do they map to the models?

831
Jerome Perrin
LogPoint Team
3 years ago
Prabesh Bhatta
LogPoint Team
Prabesh BhattaLogPoint Team
asked in Data-sources
What are currently supported data sources for UEBA ?

One of our customers was asking if it's possible to add VPN logs as a data source for UEBA. 

521
Rupsan Shrestha
LogPoint Team
3 years ago
Thomas Bonde
LogPoint Team
Thomas BondeLogPoint Team
asked in Configuration
UEBA configuration

HiMy customer just purchased a UEBA license for 500 users and they would like to know when the earliest it will be active in their LogPoint dashboard, and when they will start to see “value“. Any experiences? Kind regards,

691
Guy Grieve
LogPoint Team
3 years ago
Jerome Perrin
LogPoint Team
Jerome PerrinLogPoint Team
asked in Configuration
UEBA initial baseline

Hi, how long it takes for UEBA to perform initial baseline after enabling the data collection ?

511
Henrik Berggren
LogPoint Team
3 years ago
Basudev Raut
LogPoint Team
Basudev RautLogPoint Team
asked in Configuration
How should I decide UEBA Entity Selection, LDAP vs CSV?

Hi Team,Going through our user manual, it states that the entities could be selected either using LDAP OU group as an enrichment source or a CSV as an enrichment source. What are some tried and true considerations that I can help my customer decide which enrichment source to choose?

561
Rupsan Shrestha
LogPoint Team
3 years ago
Sandesh Bushal
LogPoint Team
Sandesh BushalLogPoint Team
asked in Troubleshooting
Lots of violated fields in UEBA Dashboard

I am currently onboarding a logpoint instance on UEBA, and I have completed the entity selection. However, I am seeing a lot of “violated logs” in the UEBA Dashboard. What should I do about this?

551
Gaurav Khatri
LogPoint Team
3 years ago

Badge winners

Show all badges
Terms & ConditionsCookie settings