Logpoint
The LogPoint Connector allows for use of the LogPoint Security Information and Event Management (SIEM) product.
Capabilities
The LogPoint connector provides the following capabilities:
- Add Incident Comment
- Assign or Reassign Incident
- Close Incident
- Get Devices
- Get Incident by ID
- Get Incident Users
- Get Incidents
- Get Livesearches
- Get Logpoint
- Get Query by SearchID
- Get Repos
- Get User TimeZone
- Reopen Incidents
- Resolve Incidents
- Run Adhoc Query
Asset Setup
The asset requires a host, username, and secret key.
Tasks Setup
For tasks that take datetime inputs, you can use any standard datetime format, or put in a relative time.
Notes
For more information on LogPoint: LogPoint API Documentation
Configurations
Logpoint Authentication
Authenticates using username and secret key.
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
username | Username | string | Required |
password | Secret Key | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Add Incident Comment
Add a comments to incidents.
Endpoint
- URL: /add_incident_comment
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
headers | object | Optional | HTTP headers for the request |
requestData | object | Optional | Response data |
requestData.version | string | Optional | Response data |
requestData.states | array | Optional | Response data |
requestData.states._id | string | Optional | Response data |
requestData.states.comments | array | Optional | Response data |
Input Example
{"json_body":{"requestData":{"version":"0.1","states":[{"_id":"6156e859b92e73ec9b0b9bfa","comments":["Comment1","Comment2"]},{"_id":"6156e985b92e73ec9b0b9bfb","comments":["Comment1","Comment2"]}]}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Assign or Reassign Incident
Assign or Reassign incident.
Endpoint
- URL: /assign_incident
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
headers | object | Optional | HTTP headers for the request |
requestData | object | Optional | Response data |
requestData.version | string | Optional | Response data |
requestData.incident_ids | array | Optional | Response data |
requestData.new_assignee | string | Optional | Response data |
Input Example
{"json_body":{"requestData":{"version":"0.1","incident_ids":["5a62bd8cce983de89085429c","5a62bd8cce983de89085429b","5a62bd8cce983de89085429e"],"new_assignee":"59b0eecfd8aaa4334ee41707"}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Close Incident
Close an incident.
Endpoint
- URL: /close_incident
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
headers | object | Optional | HTTP headers for the request |
requestData | object | Optional | Response data |
requestData.version | string | Optional | Response data |
requestData.incident_ids | array | Optional | Response data |
Input Example
{"json_body":{"requestData":{"version":"0.1","incident_ids":["5a62bd8cce983de89085429c","5a62bd8cce983de89085429b","5a62bd8cce983de89085429e"]}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Get Devices
Retrieve Devices.
Endpoint
- URL: /getalloweddata
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
data_body | object | Optional | Response data |
data_body.type | string | Optional | Response data |
headers | object | Optional | HTTP headers for the request |
Input Example
{"data_body":{"type":"devices"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Get Incident by ID
Retrieve information associated with a particular incident.
Endpoint
- URL: /get_data_from_incident
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
headers | object | Optional | HTTP headers for the request |
requestData | object | Optional | Response data |
requestData.incident_obj_id | string | Optional | Response data |
requestData.incident_id | string | Optional | Response data |
Input Example
{"json_body":{"requestData":{"incident_obj_id":"6156e859b92e73ec9b0b9bfa","incident_id":"a84eba14a93482092a1db865c87516af"}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Get Incident Users
Get users and user groups involved in any LogPoint recorded incidents.
Endpoint
- URL: /get_users
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
headers | object | Optional | HTTP headers for the request |
Input Example
{"headers":{}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Get Incidents
Retrieve incidents from a specific time range.
Endpoint
- URL: /incidents
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
headers | object | Optional | HTTP headers for the request |
requestData | object | Optional | Response data |
requestData.version | string | Optional | Response data |
requestData.ts_from | number | Optional | Response data |
requestData.ts_to | number | Optional | Response data |
Input Example
{"json_body":{"requestData":{"version":"0.1","ts_from":1633085529,"ts_to":1640595047}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Get Livesearches
Get LiveSearches
Endpoint
- URL: /getalloweddata
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
data_body | object | Optional | Response data |
data_body.type | string | Optional | Response data |
headers | object | Optional | HTTP headers for the request |
Input Example
{"data_body":{"type":"livesearches"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Get Logpoint
Retrieve Logpoint(s).
Endpoint
- URL: /getalloweddata
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
data_body | object | Optional | Response data |
data_body.type | string | Optional | Response data |
headers | object | Optional | HTTP headers for the request |
Input Example
{"data_body":{"type":"loginspects"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Get Query by SearchID
Retrieve a query by Search ID.
Endpoint
- URL: /getsearchlogs
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
data_body | object | Required | Response data |
data_body.search_id | string | Required | Response data |
headers | object | Optional | HTTP headers for the request |
Input Example
{"data_body":{"search_id":"c970d599-c107-41c1-a54c-a2129eef4062"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Get Repos
Retrieve Repos.
Endpoint
- URL: /getalloweddata
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
data_body | object | Optional | Response data |
data_body.type | string | Optional | Response data |
headers | object | Optional | HTTP headers for the request |
Input Example
{"data_body":{"type":"Logpoint_repos"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Get User TimeZone
Retrieve a user's timezone.
Endpoint
- URL: /getalloweddata
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
data_body | object | Optional | Response data |
data_body.type | string | Optional | Response data |
headers | object | Optional | HTTP headers for the request |
Input Example
{"data_body":{"type":"user_preference"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Reopen Incidents
Reopen incident by Incident ID.
Endpoint
- URL: /reopen_incident
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
headers | object | Optional | HTTP headers for the request |
requestData | object | Optional | Response data |
requestData.version | string | Optional | Response data |
requestData.incident_ids | array | Optional | Response data |
Input Example
{"json_body":{"requestData":{"version":"0.1","incident_ids":["5a62bd8cce983de89085429c","5a62bd8cce983de89085429b","5a62bd8cce983de89085429e"]}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Resolve Incidents
Resolve an incident.
Endpoint
- URL: /resolve_incident
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
headers | object | Optional | HTTP headers for the request |
requestData | object | Optional | Response data |
requestData.version | string | Optional | Response data |
requestData.incident_ids | array | Optional | Response data |
Input Example
{"json_body":{"requestData":{"version":"0.1","incident_ids":["5a62bd8cce983de89085429c","5a62bd8cce983de89085429b","5a62bd8cce983de89085429e"]}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Run Adhoc Query
Run Ad Hoc Query/Get Search Results.
Endpoint
- URL: /getsearchlogs
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
data_body | object | Optional | Response data |
data_body.requestData | object | Optional | Response data |
data_body.requestData.query | string | Optional | Response data |
data_body.requestData.time_range | string | Optional | Response data |
data_body.requestData.limit | number | Optional | Response data |
data_body.requestData.repos | array | Optional | Response data |
headers | object | Optional | HTTP headers for the request |
Input Example
{"data_body":{"requestData":{"query":"|chart count() by device_ip","time_range":"Last 24 hours","limit":100,"repos":["127.0.0.1:5504/_Logpoint"]}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |