Logpoint

Integration version: 16.0

Use Cases

Perform active actions - execute queries to get more information about the entities.

Configure Logpoint integration in Google Security Operations SOAR

For detailed instructions on how to configure an integration in Google Security Operations SOAR, see Configure integrations.

Integration parameters

Use the following parameters to configure the integration:

Parameter Display Name	Type	Default Value	Is Mandatory	Description
IP Address	String	https://x.x.x.x	Yes	IP address of the Logpoint instance.
Username	String	N/A	Yes	Username of the Logpoint account.
Secret	Password	N/A	Yes	Secret API Key of the Logpoint account
CA Certificate File	String	N/A	No	Base64 encoded CA certificate file.
Verify SSL	Checkbox	Checked	Yes	If enabled, verify the SSL certificate for the connection to the Logpoint server is valid.

Actions

Ping

Description

Test connectivity to the Logpoint with parameters provided at the integration configuration page in the Google Security Operations Marketplace tab.

Parameters

N/A

Run On

The action doesn't run on entities, nor has mandatory input parameters.

Action Results

Script Result

Script Result Name	Value Options
is_success	is_success=False
is_success	is_success=True

Case Wall

Result Type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: if successful: "Successfully connected to the Logpoint server with the provided connection parameters!" The action should fail and stop a playbook execution: if not successful: "Failed to connect to the Logpoint server! Error is {0}".format(exception.stacktrace)	General

Result Type

Value / Description

Type

Output message*

The action should not fail nor stop a playbook execution:
if successful: "Successfully connected to the Logpoint server with the provided connection parameters!"

The action should fail and stop a playbook execution:
if not successful: "Failed to connect to the Logpoint server! Error is {0}".format(exception.stacktrace)

General

Execute Query

Description

Execute search query in Logpoint.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Query	String	N/A	Yes	Specify the query that needs to be executed in Logpoint.
Time Frame	DDL	Last 24 Hours Possible Values: Last Hour Last 12 Hours Last 24 Hours Last 30 Days Last 365 Days Custom	Yes	Specify the time frame for the query. If "Custom" is selected, you need to also provide start time and end time.
Start Time	String	N/A	No	Specify the start time for the query. Format: YYYY-MM-DDThh:mm:ssZ or timestamp.
End Time	String	N/A	No	Specify the end time for the query.Format: YYYY-MM-DDThh:mm:ssZ or timestamp. If nothing is provided action will use current time as end time.
Repos	CSV	N/A	No	Specify a comma-separated list of names of the repos. If nothing is provided, action will search in all repos.
Max Results To Return	Integer	100	No	Specify how many results should be returned.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options
is_success	is_success=False
is_success	is_success=True

JSON Result

{
    "query_type": "simple",
    "rows": [
        {
            "msg": "2021-01-10 10:27:50 Benchmarker; reporting speed; service=norm_front; actual_mps=1; doable_mps=19096;",
            "log_ts": 1610274470,
            "actual_mps": "1",
            "doable_mps": "19096",
            "_type_str": "_tz device_name msg source_name col_type object norm_id service collected_at label device_ip
    _enrich_policy action _fromV550 repo_name logpoint_name",
    "device_name": "localhost",
            "_offset": 48317,
            "logpoint_name": "Logpoint",
            "action": "reporting speed",
            "repo_name": "_logpoint",
            "source_name": "/opt/immune/var/log/benchmarker/norm_front.log",
            "col_ts": 1610274470,
            "_tz": "UTC",
            "norm_id": "Logpoint",
            "_identifier": "0",
            "collected_at": "Logpoint",
            "device_ip": "127.0.0.1",
            "service": "norm_front",
            "_fromV550": "t",
            "_enrich_policy": "None",
            "_type_num": "actual_mps doable_mps col_ts sig_id log_ts _offset _identifier",
            "_type_ip": "device_ip",
            "sig_id": "10505",
            "col_type": "filesystem",
            "object": "Benchmarker",
            "_labels": [
                "Logpoint",
                "Benchmarker"
            ]
        }
    ],
    "version": 6,
    "extracted_terms": [],
    "time_range": [
        1609496280,
        1610274480
    ],
    "orig_search_id": "9acac4a0-e530-4a19-a446-e17d4d9f8aae",
    "success": true,
    "final": true,
    "totalPages": 1,
    "estim_count": 185003,
    "complete": true,
    "status": {
        "Logpoint": {
            "default": {
                "@class": "com.logpoint.libcommon.merger.api.SimpleStatus",
                "estim_count": 3,
                "final": true
            },
            "_logpoint": {
                "@class": "com.logpoint.libcommon.merger.api.SimpleStatus",
                "estim_count": 185000,
                "final": true
            },
            "LogSource1": {
                "@class": "com.logpoint.libcommon.merger.api.SimpleStatus",
                "estim_count": 0,
                "final": true
            },
            "_LogpointAlerts": {
                "@class": "com.logpoint.libcommon.merger.api.SimpleStatus",
                "estim_count": 0,
                "final": true
            }
        }
    }
}

Case Wall

Result Type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: if success == true for all requests (is_success = true): "Successfully executed query and retrieved results from Logpoint". If success == true for all requests but no results (is_success=false): "No data was found for the provided query." If success == false for at least one request (is_success = false): "Action wasn't able to successfully execute query and retrieve results from Logpoint. Reason: {0}".format(message) Async message "Waiting for query to finish processing in Logpoint." The action should fail and stop a playbook execution: if fatal error, like wrong credentials, no connection to server, other: "Error executing action "Execute Query". Reason: {0}''.format(error.Stacktrace) If timeout: Error executing action "Execute Query". Reason: Action reached a timeout. Please narrow down the time frame or lower the amount of results to return. If at least one repo is not found: "Error executing action "Execute Query". Reason: The following repos were not found in Logpoint: {0}. Please make sure that all of the repos are available.".format(comma-separated list of repos that were not found) If "Custom" is selected, but "Start Time" is not provided: "Error executing action "Execute Query". Reason: you need to provide "Start Time", if "Custom" is selected for time frame."	General
Case Wall Table	Table Name: "Results" All of the columns from the response will be used as table columns.	General

Result Type

Value / Description

Type

Output message*

The action should not fail nor stop a playbook execution:
if success == true for all requests (is_success = true): "Successfully executed query and retrieved results from Logpoint".

If success == true for all requests but no results (is_success=false): "No data was found for the provided query."

If success == false for at least one request (is_success = false): "Action wasn't able to successfully execute query and retrieve results from Logpoint. Reason: {0}".format(message)

Async message

"Waiting for query to finish processing in Logpoint."

The action should fail and stop a playbook execution:
if fatal error, like wrong credentials, no connection to server, other: "Error executing action "Execute Query". Reason: {0}''.format(error.Stacktrace)

If timeout:

Error executing action "Execute Query". Reason: Action reached a timeout. Please narrow down the time frame or lower the amount of results to return.

If at least one repo is not found:

"Error executing action "Execute Query". Reason: The following repos were not found in Logpoint: {0}. Please make sure that all of the repos are available.".format(comma-separated list of repos that were not found)

If "Custom" is selected, but "Start Time" is not provided:

"Error executing action "Execute Query". Reason: you need to provide "Start Time", if "Custom" is selected for time frame."

General

Case Wall Table

Table Name: "Results"

All of the columns from the response will be used as table columns.

General

Execute Entity Query

Description

Execute query in Logpoint based on the entities. Currently supported entity types: User, IP, Email Address, URL, File Hash, Hostname. Note: Email Address is a User entity that matches the format of email address.

How to work with action parameters

This action gives an ability to easily retrieve information related to entities. For example, it's possible to solve the use case, where you want to see the amount of logs of the endpoints affected by the provided hash without any complicated query building.

In order to solve this problem in the Logpoint you would need to prepare the following query: ("device_ip"="10.0.0.1" or "device_ip"="10.0.0.2") and ("hash"="7694f4a66316e53c8cdd9d9954bd611d" or "hash"="8264ee52f589f4c0191aa94f87aa1aeb") | chart count() by device_ip

In order to create the same query using "Execute Entity Query" action, you need to fill out the action parameters in the following way:

Query	\| chart count() by device_ip
IP Entity Key	device_ip
File Hash Entity Key	hash
Cross Entity Operator	AND

All of the other fields can be left empty.

If the use case is to see how many endpoints were affected by the provided hashes, then the configuration of the "Execute Entity Query" will have the following look.

Query	\| chart count() by device_ip
File Hash Entity Key	hash

"Cross Entity Operator" in this situation won't have an impact, because it only affects the query, when multiple "Entity Keys" are provided.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Query	String		Yes	Specify the query that needs to be executed. Please refer to the action documentation for details.
Time Frame	DDL	Last 24 Hours Possible Values: Last Hour Last 12 Hours Last 24 Hours Last 30 Days Last 365 Days Custom	Yes	Specify the time frame for the query. If "Custom" is selected, you need to also provide start time, end time by default will use current time.
Start Time	String		No	Specify the start time for the query. Format: YYYY-MM-DDThh:mm:ssZ or timestamp.
End Time	String		No	Specify the end time for the query.Format: YYYY-MM-DDThh:mm:ssZ or timestamp. If nothing is provided action will use current time as end time.
Repos	CSV		No	Specify a comma-separated list of names of the repos. If nothing is provided, action will search in all repos.
IP Entity Key	String		No	Specify what key should be used with IP entities. Please refer to the action documentation for details.
Hostname Entity Key	String		No	Specify what key should be used with Hostname entities, when preparing the . Please refer to the action documentation for details.
File Hash Entity Key			No	Specify what key should be used with File Hash entities. Please refer to the action documentation for details.
User Entity Key			No	Specify what key should be used with User entities. Please refer to the action documentation for details.
URL Entity Key			No	Specify what key should be used with URL entities. Please refer to the action documentation for details.
Email Address Entity Key			No	Specify what key should be used with Email Address entities. Please refer to the action documentation for details.
Stop If Not Enough Entities	Checkbox	Checked	Yes	If enabled, action will not start execution, unless all of the entity types are available for the specified ".. Entity Keys". Example: if "IP Entity Key" and "File Hash Entity Key" are specified, but in the scope there are no file hashes then if this parameter is enabled, action will not execute the query.
Cross Entity Operator	DDL	OR Possible Values: OR AND	Yes	Specify what should be the logical operator used between different entity types.
Max Results To Return	Integer	100	No	Specify how many results should be returned.

Run On

This action runs on the following entities:

IP Address
Host
User
Hash
URL

Action Results

Script Result

Script Result Name	Value Options
is_success	is_success=False
is_success	is_success=True

JSON Result

{
    "query_type": "simple",
    "rows": [
        {
            "msg": "2021-01-10 10:27:50 Benchmarker; reporting speed; service=norm_front; actual_mps=1; doable_mps=19096;",
            "log_ts": 1610274470,
            "actual_mps": "1",
            "doable_mps": "19096",
            "_type_str": "_tz device_name msg source_name col_type object norm_id service collected_at label device_ip
    _enrich_policy action _fromV550 repo_name logpoint_name",
    "device_name": "localhost",
            "_offset": 48317,
            "logpoint_name": "Logpoint",
            "action": "reporting speed",
            "repo_name": "_logpoint",
            "source_name": "/opt/immune/var/log/benchmarker/norm_front.log",
            "col_ts": 1610274470,
            "_tz": "UTC",
            "norm_id": "Logpoint",
            "_identifier": "0",
            "collected_at": "Logpoint",
            "device_ip": "127.0.0.1",
            "service": "norm_front",
            "_fromV550": "t",
            "_enrich_policy": "None",
            "_type_num": "actual_mps doable_mps col_ts sig_id log_ts _offset _identifier",
            "_type_ip": "device_ip",
            "sig_id": "10505",
            "col_type": "filesystem",
            "object": "Benchmarker",
            "_labels": [
                "Logpoint",
                "Benchmarker"
            ]
        }
    ],
    "version": 6,
    "extracted_terms": [],
    "time_range": [
        1609496280,
        1610274480
    ],
    "orig_search_id": "9acac4a0-e530-4a19-a446-e17d4d9f8aae",
    "success": true,
    "final": true,
    "totalPages": 1,
    "estim_count": 185003,
    "complete": true,
    "status": {
        "Logpoint": {
            "default": {
                "@class": "com.logpoint.libcommon.merger.api.SimpleStatus",
                "estim_count": 3,
                "final": true
            },
            "_logpoint": {
                "@class": "com.logpoint.libcommon.merger.api.SimpleStatus",
                "estim_count": 185000,
                "final": true
            },
            "LogSource1": {
                "@class": "com.logpoint.libcommon.merger.api.SimpleStatus",
                "estim_count": 0,
                "final": true
            },
            "_LogpointAlerts": {
                "@class": "com.logpoint.libcommon.merger.api.SimpleStatus",
                "estim_count": 0,
                "final": true
            }
        }
    }
}

Case Wall

Result Type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: if success == true for all requests (is_success = true): "Successfully executed query and retrieved results from Logpoint". If success == true for all requests but no results (is_success=false): "No data was found for the provided query." If success == false for at least one request (is_success = false): "Action wasn't able to successfully execute query and retrieve results from Logpoint. Reason: {0}".format(message) Async message "Waiting for query to finish processing in Logpoint." If "Stop If Not Enough Entities" is enabled and not enough entity types are available for the provided "Entity Keys" (is_success=false): Action wasn't able to build the query, because not enough entity types were supplied for the specified ".. Entity Keys". Please disable "Stop If Not Enough Entities" parameter or provide at least one entity for each specified ".. Entity Key". The action should fail and stop a playbook execution: if fatal error, like wrong credentials, no connection to server, other: "Error executing action "Execute Entity Query". Reason: {0}''.format(error.Stacktrace) If timeout: Error executing action "Execute Entity Query". Reason: Action reached a timeout. Please narrow down the time frame or lower the amount of results to return. If at least one repo is not found: "Error executing action "Execute Entity Query". Reason: The following repos were not found in Logpoint: {0}. Please make sure that all of the repos are available.".format(comma-separated list of repos that were not found) If no "Entity" keys are specified: Error executing action "Execute Entity Query". Reason: Please specify at least one ".. Entity Key" parameter. If "Custom" is selected, but "Start Time" is not provided: "Error executing action "Execute Entity Query". Reason: you need to provide "Start Time", if "Custom" is selected for time frame."	General
Case Wall Table	Table Name: "Results" All of the columns from the response will be used as table columns.	General

Result Type

Value / Description

Type

Output message*

The action should not fail nor stop a playbook execution:
if success == true for all requests (is_success = true): "Successfully executed query and retrieved results from Logpoint".

If success == true for all requests but no results (is_success=false): "No data was found for the provided query."

If success == false for at least one request (is_success = false): "Action wasn't able to successfully execute query and retrieve results from Logpoint. Reason: {0}".format(message)

Async message

"Waiting for query to finish processing in Logpoint."

If "Stop If Not Enough Entities" is enabled and not enough entity types are available for the provided "Entity Keys" (is_success=false): Action wasn't able to build the query, because not enough entity types were supplied for the specified ".. Entity Keys". Please disable "Stop If Not Enough Entities" parameter or provide at least one entity for each specified ".. Entity Key".

The action should fail and stop a playbook execution:
if fatal error, like wrong credentials, no connection to server, other: "Error executing action "Execute Entity Query". Reason: {0}''.format(error.Stacktrace)

If timeout:

Error executing action "Execute Entity Query". Reason: Action reached a timeout. Please narrow down the time frame or lower the amount of results to return.

If at least one repo is not found:
"Error executing action "Execute Entity Query". Reason: The following repos were not found in Logpoint: {0}. Please make sure that all of the repos are available.".format(comma-separated list of repos that were not found)

If no "Entity" keys are specified:

Error executing action "Execute Entity Query". Reason: Please specify at least one ".. Entity Key" parameter.

If "Custom" is selected, but "Start Time" is not provided:

"Error executing action "Execute Entity Query". Reason: you need to provide "Start Time", if "Custom" is selected for time frame."

General

Case Wall Table

Table Name: "Results"

All of the columns from the response will be used as table columns.

General

List Repos

Description

List available repos in Logpoint.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Max Repos To Return	Integer	100	No	Specify how many reports should be returned.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options
is_success	is_success=False
is_success	is_success=True

JSON Result

{
    "success": true,
    "allowed_repos": [
        {
            "repo": "default",
            "address": "127.0.0.1:5504/default"
        },
        {
            "repo": "_logpoint",
            "address": "127.0.0.1:5504/_logpoint"
        },
        {
            "repo": "_LogpointAlerts",
            "address": "127.0.0.1:5504/_LogpointAlerts"
        },
        {
            "repo": "LogSource1",
            "address": "127.0.0.1:5504/LogSource1"
        }
    ],
    "logpoint": [
        {
            "name": "Logpoint",
            "ip": "127.0.0.1"
        }
    ]
}

Case Wall

Result Type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: if success == true (is_success = true): "Successfully retrieve available repos query from Logpoint". The action should fail and stop a playbook execution: if fatal error, like wrong credentials, no connection to server, other: "Error executing action "List Repos". Reason: {0}''.format(error.Stacktrace)	General
Case Wall Table	Table Name: "Available Repos" Name - allowed_repos/repo Address - allowed_repos/address	General

Result Type

Value / Description

Type

Output message*

The action should not fail nor stop a playbook execution:
if success == true (is_success = true): "Successfully retrieve available repos query from Logpoint".

The action should fail and stop a playbook execution:
if fatal error, like wrong credentials, no connection to server, other: "Error executing action "List Repos". Reason: {0}''.format(error.Stacktrace)

General

Case Wall Table

Table Name: "Available Repos"

Name - allowed_repos/repo

Address - allowed_repos/address

General

Update Incident Status

Description

Update incident status in Logpoint.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Incident ID	String	N/A	Yes	Specify the id of the incident, which you want to update.
Action	DLL	Close Possible Values: Resolve Close	Yes	Specify the action for the incident.

Parameter Display Name

Type

Default Value

Is Mandatory

Description

Incident ID

String

N/A

Yes

Specify the id of the incident, which you want to update.

Action

DLL

Possible Values:

Resolve

Yes

Specify the action for the incident.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options
is_success	is_success=False
is_success	is_success=True

Case Wall

Result Type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: if success== true (is_success = true): "Successfully {0} incident with ID {1} in Logpoint.".format(resolved/closed, incident_id) if success== false(is_success = true): "Action wasn't able to {0} incident with ID {1} in Logpoint.".format(resolve/close, incident_id) The action should fail and stop a playbook execution: if fatal error, like wrong credentials, no connection to server, other: "Error executing action "Update Incident Status". Reason: {0}''.format(error.Stacktrace)	General

Result Type

Value / Description

Type

Output message*

The action should not fail nor stop a playbook execution:
if success== true (is_success = true): "Successfully {0} incident with ID {1} in Logpoint.".format(resolved/closed, incident_id)

if success== false(is_success = true): "Action wasn't able to {0} incident with ID {1} in Logpoint.".format(resolve/close, incident_id)

The action should fail and stop a playbook execution:

if fatal error, like wrong credentials, no connection to server, other: "Error executing action "Update Incident Status". Reason: {0}''.format(error.Stacktrace)

General

Connector

Logpoint - Incidents Connector

Description

Pull incidents from Logpoint.

Configure Logpoint - Incidents Connector in Google Security Operations SOAR

For detailed instructions on how to configure a connector in Google Security Operations SOAR, see Configuring the connector.

Connector parameters

Use the following parameters to configure the connector:

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Product Field Name	String	Product Name	Yes	Enter the source field name in order to retrieve the Product Field name.
Event Field Name	String	type	Yes	Enter the source field name in order to retrieve the Event Field name.
Environment Field Name	String	""	No	Describes the name of the field where the environment name is stored. If the environment field isn't found, the environment is the default environment.
Environment Regex Pattern	String	.*	No	A regex pattern to run on the value found in the "Environment Field Name" field. Default is .* to catch all and return the value unchanged. Used to allow the user to manipulate the environment field via regex logic. If the regex pattern is null or empty, or the environment value is null, the final environment result is the default environment.
Script Timeout (Seconds)	Integer	180	Yes	Timeout limit for the python process running the current script.
IP Address	String	https://x.x.x.x	Yes	IP address of the Logpoint instance.
Username	String	N/A	Yes	Username of the Logpoint account.
Secret	Password	N/A	Yes	Secret of the Logpoint account.
Max Hours Backwards	Integer	1	No	Amount of hours from where to fetch incidents.
Lowest Risk To Fetch	String	N/A	No	Lowest risk of the incidents to fetch. Possible values: Critical, High, Medium, Low.
Max Incidents To Fetch	Integer	10	No	How many incidents to process per one connector iteration..
Use whitelist as a blacklist	Checkbox	Unchecked	Yes	If enabled, whitelist will be used as a blacklist.
Verify SSL	Checkbox	Unchecked	Yes	If enabled, verifies that the SSL certificate for the connection to the Logpoint server is valid.
CA Certificate File	String	N/A	No	Base64 encoded CA certificate file.
Proxy Server Address	String	N/A	No	The address of the proxy server to use.
Proxy Username	String	N/A	No	The proxy username to authenticate with.
Proxy Password	Password	N/A	No	The proxy password to authenticate with.
User Filter	CSV	N/A	No	A comma-separated list of usernames that are used to filter out incidents. Only incidents created by the valid users are ingested. If nothing is provided, this filter is not applied and the connector ingests incidents from all users.

Connector Rules

Proxy Support

The connector supports proxy.