LogPoint SIEM Integration

Use this Content Pack to search logs, fetch incident logs from LogPoint, analyze them for underlying threats, and respond to these threats in real-time.

Category

Utilities

Pack

LogPoint_SIEM_Integration

Configuration parameters

• url — LogPoint URL (required)
• username — LogPoint Username (required)
• apikey — API Key (required)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• first_fetch — First fetch timestamp (<number> <time unit>, e.g., 6 hours, 1 day)
• incidentType — Incident type
• isFetch — Fetch incidents
• max_fetch — Fetch limit (Max value is 200, Recommended value is 50 or less)
• incidentFetchInterval — Incidents Fetch Interval

Commands (16)

• lp-add-incident-comment — Add comments to the incidents.
• lp-assign-incidents — Assigning/Re-assigning Incidents.
• lp-close-incidents — Closes the Incidents.
• lp-get-devices — Gets devices associated with LogPoint.
• lp-get-incident-data — Retrieves a Particular Incident's Data.
• lp-get-incident-states — Displays incident states data between the provided two Timestamps ts_from and ts_to. By default, this command will display first 50 data of the past 24 hours but limit can be set to get desired number of incident states data.
• lp-get-incidents — Displays incidents between the provided two Timestamps ts_from and ts_to. By default, this command will display first 50 incidents of the past 24 hours but limit can be set to get desired number of incidents.
• lp-get-livesearches — Gets live search results of the alerts and dashboards.
• lp-get-logpoints — Gets user's LogPoints.
• lp-get-repos — Gets the list of LogPoint repos that can be accessed by the user.
• lp-get-searchid — Gets the search ID based on the provided search parameters.
• lp-get-users — Gets Incident users and user groups.
• lp-get-users-preference — Gets LogPoint user's preference such as timezone, date format, etc.
• lp-reopen-incidents — Re-opens the closed incidents.
• lp-resolve-incidents — Resolves the Incidents.
• lp-search-logs — Gets LogPoint search results. Uses the value of search_id as an argument.