LogPoint SIEM Integration (v1.2.17)
Use this Content Pack to fetch incident logs from LogPoint, analyze them for underlying threats, and respond to these threats in real-time.
- Author
- LogPoint
- Support
- partner
- URL
- https://servicedesk.logpoint.com
- Categories
- Analytics & SIEM
Incident fields (20)
- LogPoint AlertObjId
- LogPoint Assigned To
- LogPoint Comments
- LogPoint Comments Count
- LogPoint Detection Timestamp
- LogPoint IncidentId
- LogPoint Last Action
- LogPoint LogPoint Name
- LogPoint Loginspect IP DNS
- LogPoint Object ID
- LogPoint Query
- LogPoint Repos
- LogPoint Rows Count
- LogPoint Status
- LogPoint Throttle Enabled
- LogPoint Tid
- LogPoint Time Range
- LogPoint User Id
- LogPoint Username
- LogPoint Visible To
Integrations (1)
- LogPoint SIEM Integration
README
LogPoint is a security information and event management (SIEM) solution that detects, analyzes, and responds to threats within your data for faster security investigations. LogPoint provides a complete view of the threat landscape by automatically identifying and sending alerts about any critical incidents or abnormalities in your system.
The LogPoint SIEM integration combines security monitoring and incident response to help security staff respond to and resolve incidents fast.
Capabilities of the LogPoint SIEM content pack
The playbooks in the pack are based on LogPoint SIEM data and help automate repetitive tasks associated with LogPoint SIEM incidents:
- Syncs and updates LogPoint SIEM incidents.
- Helps analysts focus on important alerts with built-in incident prioritization.
- Reduce mean time to respond with incident mapping.
- Contains a sample playbook to guide users on creating unique playbooks.
- Full incident control with the ability to update, resolve, and close incidents.
- Automates coordinated actions and responses to save time on incident resolution.
- Provides search commands to get logs from LogPoint devices and repos.