Audit Logs

Audit logs are records of events and activities that occur within Logpoint. Logpoint generates various audit logs related to different events for security purposes. Only authorized users can access audit logs.

User management

• Audit logs are generated when you add, edit, or delete users, user groups, and permissions.

• Sample query to view the logs:

User management query

-label=LPSearch label=Logpoint label=User or (label=User label=Management) object=* | latest by object, action | fields log_ts, user, object, type, action, source_address

Identification and authentication

• Audit logs are generated for login attempts, login success, login failures, and user lock/unlock.

• Sample query to view the logs:

Identification and authentication query

-label=LPSearch label=Logpoint label=Authentication user=* | fields log_ts, user, object, type, action, source_address

User actions

• Audit logs are generated when you add, edit, or delete Knowledge Base items, Configuration items (Device, Device Group, Log Collection Policies, Repos, Distributed Logpoint), Search, Report, Dashboard, and Incident Management, and configure the UEBA Board.

• Sample query to view the logs:

User actions query

-label=LPSearch label=Logpoint label=Configuration (label=Change or label=Add or label=Delete or label=Install or label=Mount) | chart count() by log_ts, user, type, object, action

Inter-TSF trusted channel

• Audit logs are generated when attempts are made to connect or disconnect from another Logpoint.

• Sample query to view the logs:

Inter-TSF trusted channel query

-label=LPSearch label=Logpoint (label=Remote label=Connection) OR (label=DLP (label=Connect OR label=Disconnect OR label=Initialize)) | chart count() by log_ts, type, object, user, action

System

• Audit logs are generated when disk usage exceeds the predefined limit. The predefined limit for notification is 90% by default, and it is user-configurable. Audit logs are generated every hour.

• Sample query to view the logs:

System (disk usage) query

label=Logpoint label=Harddisk use=* | rename use as PercentageUsed | fields log_ts, object, total, PercentageUsed

Selectable Audit Logs

To sort event data, follow these steps:

1

After login

Click Search from the top horizontal menu.

2

Enter query

Enter a valid query in the search query bar.

3

Sort results

Click the column header of the results table to sort the logs.