Log Source Templates¶

You can create log sources using a list of templates that comes with predefined settings and configurations to fetch logs from different sources using Universal REST API Fetcher or Syslog Collector.

Syslog Collector-based Templates¶

1. A10 Networks

2. ActivTrak

3. Apache

4. Aruba

5. Barracuda

6. BitDefender

7. BlueCoat

8. Broadcom CA

9. CarbonBlack

10. CAS Server

11. Centrify

12. Check Point

13. Cisco

14. CiscoEmail

15. CrowdStrike

16. CyberArk

17. Cyberlytic

18. Cylance

19. Darktrace

20. Dell

21. DenyAll

22. ESET

23. Exim

24. EximEmail

25. F5

26. Forcepoint

27. Forescout

28. Fortigate

29. FSecure

30. IBM AIX

31. IIS

32. InfoBlox

33. Juniper

34. Kaspersky

35. Linux

36. Microsoft Exchange Server

37. Microsoft SQL Server

38. Mod Security

39. Netscaler

40. Nginx

41. Oracle

42. PaloAlto

43. PfSense Firewall

44. Proofpoint

45. Sophos General

46. StoneSoft

47. StormShield

48. Suricata

49. Trellix McAfee

50. Trend Micro

51. TrustWave

52. Varonis

53. Vectra

54. Veritas

55. VMWare

56. Wallix

57. WatchGuard

58. Web Analytics

59. Windows

60. Zeek

61. Zscaler

Syslog Collector based Templates¶

Creating Log Source via a Template¶

For Syslog Collector based templates, you can create a log source by entering device addresses and adding a repo, while other information is optional to add. If you want to configure additional information, go to Syslog Collector.

To create:

1. Go to Settings >> Log Sources from the navigation bar and click Browse Log Source Templates.

2. Click the log source template for an integration.

3. Enter the Device Addresses.

Entering Device Addresses¶

4. Click Routing.

5. Select Repo from drop-down. You can also create a repo. To learn how to create, go to create repo.

6. Click Create Log Source to save the configuration.

Adding a Repo¶

Creating a Template¶

You can create new templates from previously created log sources and export them. These templates can later be imported into Log Source and used to configure the same or different source.

To create a new template:

1. Go to Settings >> Log Sources from the navigation bar.

2. Click the previously created log source.

3. Click the more () icon and click Configure Template.

4. Configure the template and click Save as Template.

To find the created template, go to Settings >> Log Sources and click Browse Log Source Templates.

Accessing Templates¶

To use the created template as a log source, click the template and click Save Configuration. The template is now saved as a log source. However, Logpoint must have the normalizers and repos used in the template. If the repos are not there, you must either create repos with the same names or select different ones. For normalizers, you can either install the normalizer or deselect them.

Updating Template Configuration¶

To update Log Source template configuration:

1. Go to Settings >> Log Sources from the navigation bar.

2. Click Browse Log Source Templates.

3. Click the more () icon for the Log Source Template

4. Click Edit Template.

5. Make the necessary changes and click Save Template.

   5.1. To save the changes in a new template, enter a new name for the template and click Clone and Save as New Template.

   

   Cloning Templates¶

   5.2. To save the changes in the same template, click Update Template.

   You can also update the log sources configurations that are created using this template. Select the log sources to update and click Update Log Sources.

   For Universal REST API, the following entities are updated:

   • Fetch Interval (min)

   • Request Timeout (secs)

   • Retry After (secs)

   • Charset

   • Custom Headers

   • Enforce HTTPS Certificate Verification

   • Normalizer

   • Logo

   • Description

   • Vendor Name

   For Syslog Collector, the following entities are updated:

   • Parser

   • Confidentiality

   • Integrity

   • Availability

   • Normalizer

   • Logo

   • Description

   • Vendor Name

   • Normalization

     

     Updating Log Sources¶

Updating Template¶

To update Log Source template:

1. Open the Log source and click on Update Available. You will only see Update Available if the template from which the log source was created has been updated.

   

   Update Available¶

2. Select the Log Source and click Update Log Sources.

   

   Updating Log Sources¶

Exporting Template¶

During export, all custom normalization packages in the template are exported. For vendor normalization packages, only their metadata (name, version and vid) is exported.

You must first configure Log Source and save it as a template to export it.

To export a Log Source template:

1. Go to Settings >> Log Sources from the navigation bar and click Browse Log Source Templates.

2. Click the more () icon and click Edit Template.

3. Click the more () icon and click Configure Template.

4. Click Export Template.

Exporting Templates¶

Importing Template¶

To import a Log Source template:

1. Go to Settings >> Log Sources from the navigation bar and click Browse Log Source Templates.

2. Click Import Templates.

3. Browse to the exported .pak file.

Importing a template.¶

5. Click OK.

Go to Settings >> Log Sources to find the imported template. If a template with the same name as the imported template exists, you must change it. In Choose new names, enter a new name for the template and click OK.

Invalid Imports¶

If you create a Log Source with an imported template consisting of a custom normalization package, the package is automatically created in your Logpoint. In the case of name conflict, the suffix “_1” is added to the custom package.

In the case of vendor normalization packages, if your Logpoint has the same or a newer version of the vendor normalization package, the new version is automatically selected. If your Logpoint has the older version or does not have the required package, you must download and install the latest package from the Service Desk.

Deleting Template¶

To delete Log Source template:

1. Go to Settings >> Log Sources from the navigation bar and click Browse Log Source Templates.

2. Click the () icon for the Log Source and click Delete Template.

Deleting Template¶

3. Click Delete.