Logo
Sign in
  1. Logpoint Service Desk
  2. Products Hub
  3. Marketplace

PortWise

Avatar Permanently deleted user
December 11, 2024 08:17
Follow
app-115003784045.png

Release Details

Fields

Details

Name

PortWise

Version

5.0.0

Supported On

LogPoint v6.0.0 and later

Release Date

2020-05-14

Document Date 2020-05-14
Download PortWise_5.0.0.pak
SHA256  

f6da857efe2f00a1ee59112fdcccee55e32a5af116634ef95d262de0ce9d37de

 

Package Details

The application consist of the components:

  1. Dashboard Package
    • LP_PortWise Authentication Server 
  2. Normalization Packages
    • LP_PortWise Authentication Server Generic 
    • LP_PortWise Authentication Server 

Enhancement

A minor update has been done in the application’s normalizer for better signature handling.

General Description

The PortWise application normalizes PortWise events and enables you to analyze PortWise data using pre-set dashboard views. You can further customize the dashboard and searches to perform in-depth analysis.

Installation 

Follow these steps to install the PortWise v5.0.0 plugin:

  1. Download the PortWise package from the Download section above.
  2. Add the required PortWise server as a device in LogPoint.
  3. Create a collection policy with the Syslog collector and appropriate processing policy. 
  4. Assign the policy to the device.
  5. Add the dashboard.

Supported Version

The supported versions of PortWise with LogPoint in this configuration are:

  • PortWise Authentication Server v4.xx.xx

Log Format

Expected Log Format

PortWise

Log Samples

<134>PortWise Policy Service 4.12.13: user: usnh7298qfb4: AUTHORIZATION ACCESS_CHALLENGED: Request URI: http://xyz.com/abc/ [ Resource URI:http://xyz.com/ ] CHALLENGE_MECHANISMS:[ 0 ]

<134>PortWise Policy Service 4.12.13: user1: znfgvzvdi5c: AUTHENTICATION NOT_AVAILABLE_AUTHENTICATION_SERVICE: AUTHENTICATION_MECHANISM:[ 2 ] MECHANISM_MESSAGE:[ Got no reply from any configured server ]

<134>PortWise Policy Service 4.12.13: user2: usnh7298qfb4: AUTHENTICATION USER_CHALLENGED: AUTHENTICATION_MECHANISM:[ 0 ] MECHANISM_MESSAGE:[ Password Invalid]

<134>PortWise Policy Service 4.12.13: user3: usnh7298qfb4: AUTHENTICATION USER_AUTHENTICATED: AUTHENTICATION_MECHANISM:[ 10 ] MECHANISM_MESSAGE:[ User 'hari' authenticated. ]

<134>PortWise Authentication Service 4.12.13: RADIUS client with address 1.1.1.1 makes an access request to Web Authentication

<134>PortWise Authentication Service 4.12.13: RADIUS client with address 1.1.1.3 makes an access request to Web Authentication

<132>PortWise Administration Service 4.12.13: Login attempt failed using xxxxxxxx

<134>PortWise Administration Service 4.12.13: xinger: 791FAxxxxxxxxxxxxxxxxxxxxxxxxxxxx: abc logged in successfully

<134>PortWise Administration Service 4.12.13: xinger: Updated a PortWise account xxxxxx of type account (key=jkik7nrocauxxxx)

To export data to LogPoint use Syslog collector on port 514 on the LogPoint server.

Support

If you have any queries or require assistance, please feel free to contact our support team: 

Email: servicedesk@logpoint.com
Phone: +45 7060 6100

Best regards,
untitled.svg

Comments

Article is closed for comments.

Related articles

  • PostFix
  • FortiGate
  • Malware Threat Detection
  • Logpoint Service Parameter Tuning
  • InRange Process Plugin
Was this article helpful?
0 out of 0 found this helpful
Privacy policy    EULA    Terms of service   
Copyright © , Logpoint. All rights reserved.

Note: We use cookies that are essential for the smooth functioning of our website.