Audit logs are records of events and activities that occur within Logpoint. Logpoint generates various audit logs related to different events for security purposes. Only authorized users can access audit logs.
Audit logs are generated when you add, edit, or delete users, user groups, and permissions.
Sample query to view the logs:
-label=LPSearch label=Logpoint label=User or (label=User label=Management) object=*
| latest by object, action | fields log_ts, user, object, type, action, source_address
User Management Audit Logs¶
Audit logs are generated for login attempts, login success, login failures, and user lock/unlock.
Sample query to view the logs:
-label=LPSearch label=Logpoint label=Authentication user=*
| fields log_ts, user, object, type, action, source_address
Identification and Authentication Audit Logs¶
User actions
Audit logs are generated when you add, edit, or delete Knowledge Base items, Configuration items (Device, Device Group, Log Collection Policies, Repos, Distributed Logpoint), Search, Report, Dashboard, and Incident Management, and configure the UEBA Board.
Sample query to view the logs:
-label=LPSearch label=Logpoint label=Configuration (label=Change or label=Add or label=Delete or label=Install or label=Mount) | chart count() by log_ts, user, type, object, action
User Configuration Actions Audit logs¶
Inter-TSF trusted channel
Audit logs are generated when attempts are made to connect or disconnect from another Logpoint.
Sample query to view the logs:
-label=LPSearch label=Logpoint (label=Remote label=Connection) OR (label=DLP (label=Connect OR label=Disconnect OR label=Initialize)) | chart count() by log_ts, type, object, user, action
Inter-TSF Trusted Channel Audit Logs¶
System
Audit logs are generated when disk usage exceeds the predefined limit. The predefined limit for notification is 90% by default, and it is user-configurable. Audit logs are generated every hour.
Sample query to view the logs:
label=Logpoint label=Harddisk use=* | rename use as PercentageUsed | fields log_ts, object, total, PercentageUsed
Disk Usage Audit Logs¶
To sort event data, follow these steps:
After successful login, click Search from the top horizontal menu.
Enter a valid query in the search query bar.
Click the column header of the results table to sort the logs.