LogPoint

August 26, 2025 · View on GitHub

Overview

This integration provides tools to interact with the LogPoint SIEM platform, allowing you to execute queries, manage incidents, and list repositories.

Available Tools

List Repos

Tool Name: log_point_list_repos

Description: List available repos in Logpoint.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • max_repos_to_return (Optional[str], optional): Specify how many reports should be returned. Defaults to None.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Defaults to empty list.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution, including a list of available repositories.

Execute Query

Tool Name: log_point_execute_query

Description: Execute search query in Logpoint.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • query (string, required): Specify the query that needs to be executed in Logpoint.
  • time_frame (List[str], required): Specify the time frame for the query. If “Custom” is selected, you need to also provide start time and end time.
  • start_time (Optional[str], optional): Specify the start time for the query. Format: YYYY-MM-DDThh:mm:ssZ or timestamp. Defaults to None.
  • end_time (Optional[str], optional): Specify the end time for the query.Format: YYYY-MM-DDThh:mm:ssZ or timestamp. If nothing is provided action will use current time as end time. Defaults to None.
  • repos (Optional[str], optional): Specify a comma-separated list of names of the repos. If nothing is provided, action will search in all repos. Defaults to None.
  • max_results_to_return (Optional[str], optional): Specify how many results should be returned. Defaults to None.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Defaults to empty list.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution, including the query results.

Ping

Tool Name: log_point_ping

Description: Test connectivity to the Logpoint with parameters provided at the integration configuration page on the Marketplace tab.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Defaults to empty list.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution.

Update Incident Status

Tool Name: log_point_update_incident_status

Description: Update incident status in Logpoint.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • incident_id (string, required): Specify the id of the incident, which you want to update.
  • action (List[str], required): Specify the action for the incident.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Defaults to empty list.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution.

Execute Entity Query

Tool Name: log_point_execute_entity_query

Description: Execute query in Logpoint based on entities. Currently supported entity types: User, IP, Email Address, URL, File Hash, Hostname. Note: Email Address is a User entity that matches the format of email address.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • query (string, required): Specify the query that needs to be executed. Please refer to the action documentation for details.
  • time_frame (List[str], required): Specify the time frame for the query. If “Custom” is selected, you need also provide start time, end time by default will be current time.
  • stop_if_not_enough_entities (bool, required): If enabled, action will not start execution, unless all of the entity types are available for the specified ".. Entity Keys". Example: if "IP Entity Key" and "File Hash Entity Keys" are specified, but in the scope there are no file hashes then if this parameter is enabled, action will not execute the query.
  • cross_entity_operator (List[str], required): Specify what should be the logical operator used between different entity types.
  • start_time (Optional[str], optional): Specify the start time for the query. Format: YYYY-MM-DDThh:mm:ssZ or timestamp. Defaults to None.
  • end_time (Optional[str], optional): Specify the end time for the query. Format: YYYY-MM-DDThh:mm:ssZ or timestamp. If nothing is provided action will use current time as end time. Defaults to None.
  • repos (Optional[str], optional): Specify a comma-separated list of names of the repos. If nothing is provided, action will search in all repos. Defaults to None.
  • ip_entity_key (Optional[str], optional): Specify what key should be used with IP entities. Please refer to the action documentation for details. Defaults to None.
  • hostname_entity_key (Optional[str], optional): Specify what key should be used with Hostname entities, when preparing the filter. Please refer to the action documentation for details. Defaults to None.
  • file_hash_entity_key (Optional[str], optional): Specify what key should be used with File Hash entities. Please refer to the action documentation for details. Defaults to None.
  • user_entity_key (Optional[str], optional): Specify what key should be used with User entities. Please refer to the action documentation for details. Defaults to None.
  • url_entity_key (Optional[str], optional): Specify what key should be used with URL entities. Please refer to the action documentation for details. Defaults to None.
  • email_address_entity_key (Optional[str], optional): Specify what key should be used with Email Address entities. Please refer to the action documentation for details. Defaults to None.
  • max_results_to_return (Optional[str], optional): Specify how many results should be returned. Defaults to None.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Defaults to empty list.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution, including the query results based on entity filters.