Log Source Templates
Log Source Templates provide predefined configurations for collecting and normalizing logs from common devices, applications, and services. Each template includes the required parsing logic, field mappings, and expected log formats. By using Log Source Templates, onboard new log sources faster, reduce configuration errors, and ensure that security-relevant events are normalized into a common data model.
You must have Read, Create, and Delete permissions of Devices, DeviceGroups, Log Collection Policy, and Parsers to configure Log Sources.
Log source templates are made up of:
Source: Where the logs come from.
Connector: Defines the connection between the log source and Logpoint. A collector retrieves logs from the source and buffers them. It receives logs through specific ports and/or forwards them to a Logpoint Storage Node. The collector uses a normalizer to split each log message into key-value pairs and apply static enrichment during processing.
Routing: The repositories (repos) where logs are stored. This includes routing criteria to direct logs to the correct destinations. Routing specifies which repository on a specific device should store incoming log data based on a log message's key or key-value pair.
Normalization: Assigns normalizers to standardize log formats. Normalization translates a raw log message into the Logpoint taxonomy. Raw log messages originate from different source devices in various formats. Normalizing enables searches and the identification of patterns and correlations across log messages from different log sources. For example, different firewall vendors may label fields in logs differently, or not label them at all. Normalization takes various input fields, like source, or third field from the left, and normalizes them into the standard field name source_address.
Logpoint uses two types of normalizers:
Compiled Normalizers: Hard-coded and fast.
Normalization Packages: Contain one or more normalizers that use regex or signatures to find and extract key-value pairs from raw logs. Use signature-based normalizers on raw logs that are not well-defined.
Enrichment: Apply enrichment policies. Enrichment adds metadata from an enrichment source to log events that were not present in the log message. Enriched fields in Logpoint logs are red.
Two types of enrichment:
Static: Applied at data ingestion (collection or storage). Static enrichment is indexed, which makes queries over large datasets run faster.
Dynamic: Applied during analysis or when a query runs. Useful for lookups that are only possible after logs have been received (for example, from a threat intelligence table). Dynamic enrichment uses less storage than static enrichment and is well-suited to small datasets and short time ranges.
Endpoints (Conditional): For log sources that require specific endpoint settings.
Queries (Conditional): SQL queries to extract targeted log data from an SQL Server.
Available Templates
Creating Log Source via a Template
For Syslog Collector-based templates, you can create a log source by entering device addresses and adding a repo, while other information is optional to add. If you want to configure additional information, go to Syslog Collector.
Creating a Template
Create new templates from previously created log sources and export them. These templates can later be imported into Log Source and used to configure the same or a different source.
To use the created template as a log source, click the template and click Save Configuration. The template is now saved as a log source. However, Logpoint must have the normalizers and repos used in the template. If the repos are not there, you must either create repos with the same names or select different ones. For normalizers, you can either install the normalizer or deselect it. If Logpoint does not have the signature-based normalization package used in the imported template, Log source automatically installs it.
You can also update the log source configurations created with this template. Select the log sources to update and click Update Log Sources.
Exporting Template
During export, all custom normalization packages in the template are also exported. For vendor normalization packages, only their metadata (name, version, and vid) is exported.
You must first configure the Log Source and save it as a template for export.
Importing Template
If you create a Log Source with an imported template consisting of a custom normalization package, the package is automatically created in your Logpoint. In the case of name conflict, the suffix “_1” is added to the custom package.
For vendor normalization packages, if your Logpoint has the same or a newer version of the vendor normalization package, the newer version is automatically selected. If your Logpoint is running an older version or does not have the required package, you must download and install the latest package from the Service Desk.
Last updated
Was this helpful?