LogPoint SIEM Integration

Use this Content Pack to search logs, fetch incident logs from LogPoint, analyze them for underlying threats, and respond to these threats in real-time.

Utilities · LogPoint SIEM Integration

Configuration parameters

  • url — LogPoint URL (required)
  • username — LogPoint Username (required)
  • apikey — API Key (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 6 hours, 1 day)
  • incidentType — Incident type
  • isFetch — Fetch incidents
  • max_fetch — Fetch limit (Max value is 200, Recommended value is 50 or less)
  • incidentFetchInterval — Incidents Fetch Interval

Commands (16)

  • lp-add-incident-comment

    Add comments to the incidents.

  • lp-assign-incidents

    Assigning/Re-assigning Incidents.

  • lp-close-incidents

    Closes the Incidents.

  • lp-get-devices

    Gets devices associated with LogPoint.

  • lp-get-incident-data

    Retrieves a Particular Incident's Data.

  • lp-get-incident-states

    Displays incident states data between the provided two Timestamps ts_from and ts_to. By default, this command will display first 50 data of the past 24 hours but limit can be set to get desired number of incident states data.

  • lp-get-incidents

    Displays incidents between the provided two Timestamps ts_from and ts_to. By default, this command will display first 50 incidents of the past 24 hours but limit can be set to get desired number of incidents.

  • lp-get-livesearches

    Gets live search results of the alerts and dashboards.

  • lp-get-logpoints

    Gets user's LogPoints.

  • lp-get-repos

    Gets the list of LogPoint repos that can be accessed by the user.

  • lp-get-searchid

    Gets the search ID based on the provided search parameters.

  • lp-get-users

    Gets Incident users and user groups.

  • lp-get-users-preference

    Gets LogPoint user's preference such as timezone, date format, etc.

  • lp-reopen-incidents

    Re-opens the closed incidents.

  • lp-resolve-incidents

    Resolves the Incidents.

  • lp-search-logs

    Gets LogPoint search results. Uses the value of search_id as an argument.