PointSharp
ArchivedThe PointSharp application normalizes PointSharp events and enables you to analyze PointSharp data. You can further customize the dashboard and searches to perform an in-depth analysis.
Release Details
Package Details
- Compiled Normalizer
- PointSharpNormalizer
- Dashboard Package
- LP_PointSharp
- Search Template
- LP_PointSharp
Enhancement
Installation
Follow these steps to install the PointSharp v5.1.0 application:
- Download the PointSharp package from the Download section above.
- Add the required PointSharp server as a device in LogPoint.
- Create a collection policy with the Syslog collector and an appropriate processing policy.
- Assign the policy to the device.
- Add the dashboards.
Important Notice
The PointSharp application adds its logs to the Windows Event logs, so you must use it with the LogPoint Agent (LPA) or the NXLog application.
Log Format
Expected Log Format
PointSharp
Log Sample
<14>Apr 29 13:00:01 logpoint.comPointSharpID: {"EventTime":"2019-04-29 13:00:01","Hostname":"logpoint.com","Keywords":"45035996273704960","EventType":"AUDIT_SUCCESS", "SeverityValue":2,"Severity": "INFO","EventID":1,"SourceName":"xxxxxxxxxxxxx","TaskValue":0,"RecordNumber":866335, "ExecutionProcessID":0,"ExecutionThreadID":0, "Channel":"PointSharpID_AuditLog","Message":"PointSharp ID - Authentication\nMethod:\tOATH\nCode:\tAccept\nUser:\xxxxxxx\n User Storage: AD\nMsg:\tOATH(WD, STATEFUL): PointSharp ID accepted user xxxxxx. Token: mobiletoken\n\nClient: xxx.xxx.xxx.xx\nSmartAuth: xx-SmartAuth [Policy:'PsidToken' == 'OTP' -> OATH] \nSession ID: 2YkM45abQT3QbLoX8LuAMprR+/8=","Opcode":"Info","EventData":"<Data>PointSharp ID - Authentication\nMethod:\tOATH\nCode:\tAccept\nUser:\xxxxx\nUser Storage: AD\nMsg:\tOATH(WD, STATEFUL): PointSharp ID accepted user xxxxxx. Token: mobiletoken\n\nClient: xxx.xxx.xxx.xx\nSmartAuth: xx-SmartAuth [Policy:'PsidToken' == 'OTP' -> OATH]\n Session ID: 2YkM45abQT3QbLxxxxxxxxxx+/8=</Data>","EventReceivedTime":"2019-04-29 13:00:02","SourceModuleName":"xxxxxxxxx_xx","SourceModuleType":"xx_xxxxxxxxxxx"
To export data to LogPoint, use the Syslog collector on port 514 of the LogPoint server.
Support
If you have any questions or require assistance, create a support ticket.
Comments
Article is closed for comments.