Log Reference

Windows Event Log Sample

col_type: LPAgent
module_type: event_log
log_name: Security
event_id: 4624
level: Information
source_name: Microsoft-Windows-Security-Auditing
user: DOMAIN\username
computer: WORKSTATION01
message: An account was successfully logged on.

File Collection Sample

col_type: LPAgent
module_type: file_collection
file_path: C:\inetpub\logs\LogFiles\W3SVC1\u_ex231201.log
source_address: 192.0.2.0
message: 2023-12-01 10:15:23 W3SVC1 WEBSERVER01 192.0.2.0 GET /api/users 200

File Integrity Scanner Samples

New Directory Created:

col_type: LPAgent
module_type: file_scanner
action: DIR_CREATE
file_path: C:\Users\Admin\Documents\NewFolder
checksum_before: N/A
checksum_after: <directory_checksum>

Directory Deleted:

col_type: LPAgent
module_type: file_scanner
action: DIR_DELETE
file_path: C:\Users\Admin\Documents\OldFolder
checksum_before: <directory_checksum>
checksum_after: N/A

File Created:

col_type: LPAgent
module_type: file_scanner
action: FILE_CREATE
file_path: C:\Important\document.docx
checksum_before: N/A
checksum_after: a3f4b2c1d5e6f7a8b9c0d1e2f3a4b5c6

File Content Modified:

col_type: LPAgent
module_type: file_scanner
action: FILE_MODIFY
file_path: C:\Config\settings.ini
checksum_before: a3f4b2c1d5e6f7a8b9c0d1e2f3a4b5c6
checksum_after: b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9

File Renamed:

col_type: LPAgent
module_type: file_scanner
action: FILE_RENAME
file_path_old: C:\Docs\report_draft.pdf
file_path_new: C:\Docs\report_final.pdf
checksum: a3f4b2c1d5e6f7a8b9c0d1e2f3a4b5c6

File Deleted:

col_type: LPAgent
module_type: file_scanner
action: FILE_DELETE
file_path: C:\Temp\temporary_file.txt
checksum_before: a3f4b2c1d5e6f7a8b9c0d1e2f3a4b5c6
checksum_after: N/A

Windows Registry Scanner Samples

Registry Value Modified:

col_type: LPAgent
module_type: registry_scanner
action: REGISTRY_MODIFY
registry_path: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
registry_key: MyApplication
value_before: C:\Program Files\MyApp\old.exe
value_after: C:\Program Files\MyApp\new.exe

Registry Value Deleted:

col_type: LPAgent
module_type: registry_scanner
action: REGISTRY_DELETE
registry_path: HKLM\Software\MyCompany\Settings
registry_key: ConfigValue
value_before: enabled
value_after: N/A

Field Mapping

Logpoint Agent (Centralized) fields are mapped to Logpoint standardized fields:

Common Field Mappings:

• source_address → Device IP address

• computer → Windows computer name

• user → User account associated with event

• module_type → Collection type (event_log, file_collection, file_scanner, registry_scanner)

• log_name → Windows event log channel name

• event_id → Windows event ID

• level → Event severity level

• file_path → Full path to monitored file

• action → Action taken (CREATE, MODIFY, DELETE, RENAME)

• checksum_before → File checksum before change

• checksum_after → File checksum after change

• registry_path → Registry key path

• registry_key → Registry value name