1. Logpoint Service Desk
  2. Community
  3. SIEM - Use Cases

Adding a Search Template

Avatar
Follow
0

Hi,

I would like to add a new parameters templete. But when I add the new parameter it doesn't works (for exemple when I add the source_address it doesn't works) ? I would like to know why ?

Thank you in advance for your help.

Share This Post:

4 comments

Date Votes
0
Avatar
Gustav Elkjær Rødsgaard

Hi Micropole,

In the right pane in the first column you should write “source_address” instead of just “source”.
The left part is a basequery which doesn’t relate to what parameters are added to be “customizeable” in the search template.

Please let me know if that works.

Best Regards,
Gustav Elkjær Rødsgaard

0
Avatar
Micropole

Hi Gustav Elkjær Rødsgaard,

Thank you for your answer. I did as you said but it’s still doesn't works. In fact, I using the field “user” too, maybe because of this parameter  that it doesn't works. In attacement of this mail I put a screen shot of the message that I receive.

Best Regards,

Micropole

0
Avatar
Gustav Elkjær Rødsgaard

Hi Micropole,

Seems like something is wrong with the user field aswell then. I have attached a screenshot with how the syntax works with a search template where you want to incorperate the fields user and source_address as both fields and part of the basequery.

Best Regards,
Gustav Elkjær Rødsgaard

0
Avatar
Micropole

Hi Gustav Elkjær Rødsgaard,

Thank you very much for your help.

Best regards,

Micropole

Please sign in to leave a comment.