LogRhythm Deprecated

Deprecated. Use the LogRhythmRest v2 integration instead.

Analytics & SIEM · LogRhythm (Deprecated)

Details

ID	`LogRhythm`
Provider	Exabeam
Category	Analytics & SIEM
From Version	5.0.0

README

Deprecated - version 7.3.2 is not supported by the vendor anymore. Use the LogRhythmRest v2 integration instead.

This integration was integrated and tested with LogRhythm v7.3.2 / UI 18.5.1.

Use Cases

Get alarms.
Update alarm data.
Get incidents from one day ago until the current time.

Prerequisites

Contact LogRhythm support for information about retrieving an API token. You can refer to the following LogRhythm documentation.

LogRhythm-SOAP-API-InstallationGuide
LogRhythm-SOAP-API-WindowsAuthenticationGuide

Configure LogRhythm on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for LogRhythm.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance
- Hostname or IP address
- Do not validate server certificate (not secure)
- Use system proxy settings
- Fetch incidents
- Default page size for alarm queries (for example: 2000)
- Timezone offset in minutes of the LogRhythm server machine
- Incident type
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Add an alarm comment: lr-add-alarm-comments
Get information for an alarm: lr-get-alarm-by-id
Get information for events: lr-get-alarm-events-by-id
Get the history of an alarm: lr-get-alarm-history-by-id
Update the status of an alarm: lr-update-alarm-status
Get information for multiple alarms: lr-get-alarms

1. Add an alarm comment

Adds a comment to an alarm.

Basic Command

lr-add-alarm-comments

Input

Argument Name	Description
alarm-id	Unique ID of the alarm
comments	Alarm comments

Command Example

!lr-add-alarm-comments alarm-id=18 comments="test comment" raw-response=true

Context Output

{  
   "DataID":"18",
   "Errors":"",
   "Key":"0",
   "Succeeded":"true",
   "Warnings":{  
      "-a":"http://schemas.microsoft.com/2003/10/Serialization/Arrays"
   }
}

2. Get information for an alarm

Returns information of an alarm.

Basic Command

lr-get-alarm-by-id

Input

Argument Name	Description
alarm-id	Unique ID of the alarm

Command Example

!lr-get-alarm-by-id alarm-id=18 raw-response=true

Context Output

{  
   "AlarmDate":"2018-03-27T09:18:04.41",
   "AlarmID":"18",
   "AlarmRuleID":"677",
   "AlarmRuleName":"LogRhythm AI Comm Manager Heartbeat Missed",
   "AlarmStatus":"New",
   "DateInserted":"2018-03-27T09:18:04.72",
   "DateUpdated":"2018-04-09T08:50:47.027",
   "EntityID":"1",
   "EntityName":"Primary Site",
   "EventCount":"1",
   "EventDateFirst":"2018-03-27T09:18:02.873",
   "EventDateLast":"2018-03-27T09:18:02.873",
   "LastUpdatedID":"3",
   "LastUpdatedName":"api, lrapi",
   "RBPAvg":"67",
   "RBPMax":"67"
}

3. Get information for events

Get alarm events.

Basic Command

lr-get-alarm-events-by-id

Input

Argument Name	Description
alarm-id	Unique ID of the alarm
include-raw-log	Include raw log

Command Example

!lr-get-alarm-events-by-id alarm-id=5 raw-response=true

Context Output

"Command":"",
"CommonEventID":"-1100001",
"CommonEventName":"LogRhythm Mediator Heartbeat Missed",
"Count":"1",
"DateInserted":"0001-01-01T00:00:00",
"Direction":"Local",
"DirectionName":"Local",
"Domain":"",
"Duration":"NaN",
"EntityID":"0",
"EntityName":{  
   "-nil":"true"
},
"Group":"",
"ImpactedEntityID":"1",
"ImpactedEntityName":"Primary Site",
"ImpactedHostID":"1",
"ImpactedHostName":"WIN-JSBOL5ERCQA",
"ImpactedIP":"",
...

4. Get the history of an alarm

Returns the history of an alarm.

Basic Command

lr-get-alarm-history-by-id

Input

Argument Name	Description
alarm-id	Unique ID of the alarm
include-notifications	Include notification history
include-comments	Include comments history

Command Example

!lr-get-alarm-history-by-id alarm-id=5 raw-response=true include-comments=true

Context Output

"AlarmID":"18",
"Comments":{  
   "AlarmCommentDataModel":[  
      {  
         "Comment":"Comment: test comment",
         "DateInserted":"2018-04-09T08:50:47.027",
         "ID":"11",
         "PersonID":"3",
         "PersonName":"api, lrapi"
      },
      {  
         "Comment":"Changed status to: New\r\nComment:",
         "DateInserted":"2018-04-08T15:34:51",
         "ID":"10",
         "PersonID":"3",
         "PersonName":"api, lrapi"
      },
      {  
         "Comment":"Comment: test 2",
         "DateInserted":"2018-04-08T15:34:07.91",
         "ID":"9",
         "PersonID":"3",

5. Update the status of an alarm

Updates the status of an alarm.

Basic Command

lr-update-alarm-status

Input

Argument Name	Description
alarm-id	Unique ID of the alarm
status	Enumeration status of the alarm
comments	Alarm comments

Command example

!lr-update-alarm-status alarm-id=5 status=New raw-response=true

Context Output

"DataID":"5",
"Errors":"",
"Key":"0",
"Succeeded":"true",
"Warnings":{  
   "-a":"http://schemas.microsoft.com/2003/10/Serialization/Arrays"
}

6. Get information for multiple alarms

Returns information for multiple alarms.

Basic Command

lr-get-alarms

Input

Argument Name	Description
start-date	Start date for the data query. For example: start-date="2018-03-27"
end-date	End date for the data query. For example: end-date="2018-04-08"
all-users	Alarms for all users
count	Number of alerts to retrieve, Defaults: 1000
status	Enumeration status of the alarm
time_frame	Time frame to retrieve alerts for ("Today", "Last2Days", "LastWeek", "LastMonth", and "Custom". If "Custom", you need to specify the start-date and end-date arguments, otherwise the command ignores the time_frame argument.

Command Example

!lr-get-alarms start-date="2018-03-27" end-date="2018-04-01" status=New all-users=true raw-response=true

Context Output

{  
   "AlarmDate":"2018-03-27T08:23:33.55",
   "AlarmID":"13",
   "AlarmRuleID":"102",
   "AlarmRuleName":"LogRhythm Mediator Heartbeat Missed",
   "AlarmStatus":"New",
   "DateInserted":"2018-03-27T08:23:33.987",
   "DateUpdated":"2018-03-27T08:23:34.053",
   "EntityID":"1",
   "EntityName":"Primary Site",
   "EventCount":"1",
   "EventDateFirst":"2018-03-27T08:23:31.517",
   "EventDateLast":"2018-03-27T08:23:31.517",
   "LastUpdatedID":"0",
   "LastUpdatedName":{  
      "-nil":"true"
   },
   "RBPAvg":"67",
   "RBPMax":"67"
}...

Configuration parameters

Host — Hostname, IP address or Server URL (required)
Credentials — Credentials (required)
Insecure — Trust any certificate (not secure)
useproxy — Use system proxy settings
isFetch — Fetch incidents
pageSize — Default page size for alarm queries
timeZone — Timezone offset in minutes of the LogRhythm server machine
incidentType — Incident type
use_ntlm — Use Windows Authentication
domain — Domain of the Windows authentication server (used for Windows authentication)

Commands (9)

lr-add-alarm-comments
Update alarm with comments
lr-add-host
Adds a new host to an entity.
lr-execute-query
Executes a query for logs that match query parameters.
lr-get-alarm-by-id
Retrieve a single alarm by the unique alarm identifier
lr-get-alarm-events-by-id
Retrieve a list of events associated to this alarm
lr-get-alarm-history-by-id
Retrieve a list of alarm status and comment updates
lr-get-alarms
Retrieve alarms in the specified time period. Alerts can be filtered by the alarm status.
lr-get-hosts-by-entity-id
Retrieves a list of hosts for a given entity, or an empty list if none is found.
lr-update-alarm-status
Update alarm status

Source

LogRhythm.js LogRhythm.yml LogRhythm_description.md

Download History Raw

commonfields:
  id: LogRhythm
  version: -1
name: LogRhythm
display: LogRhythm (Deprecated)
category: Analytics & SIEM
provider: Exabeam
description: Deprecated. Use the LogRhythmRest v2 integration instead.
configuration:
- display: Hostname, IP address or Server URL
  name: Host
  defaultvalue: ""
  type: 0
  required: true
- display: Credentials
  name: Credentials
  defaultvalue: ""
  type: 9
  required: true
- display: Trust any certificate (not secure)
  name: Insecure
  defaultvalue: ""
  type: 8
  required: false
- display: Use system proxy settings
  name: useproxy
  defaultvalue: ""
  type: 8
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- display: Default page size for alarm queries
  name: pageSize
  defaultvalue: "2000"
  type: 0
  required: false
- display: Timezone offset in minutes of the LogRhythm server machine
  name: timeZone
  defaultvalue: ""
  type: 0
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- display: Use Windows Authentication
  name: use_ntlm
  defaultvalue: "false"
  type: 8
  required: false
- display: Domain of the Windows authentication server (used for Windows authentication)
  name: domain
  defaultvalue: ""
  type: 0
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: lr-add-alarm-comments
    arguments:
    - name: alarm-id
      required: true
      default: true
      description: The unique ID of the alarm
    - name: comments
      required: true
      description: The alarm comments
    outputs:
    - contextPath: LogRhythm.Alarm.Comment
      description: The alarm comment.
    - contextPath: LogRhythm.Alarm.ID
      description: The unique id of the alarm.
    description: Update alarm with comments
    execution: true
  - name: lr-get-alarm-by-id
    arguments:
    - name: alarm-id
      required: true
      default: true
      description: The unique ID of the alarm
    outputs:
    - contextPath: LogRhythm.Alarm.RBPMax
      description: Alarm maximum RBP(Risk Based Prioritization).
      type: number
    - contextPath: LogRhythm.Alarm.RuleName
      description: Alarm rule name.
      type: string
    - contextPath: LogRhythm.Alarm.EntityName
      description: entity name
      type: string
    - contextPath: LogRhythm.Alarm.Date
      description: Alarm date.
      type: date
    - contextPath: LogRhythm.Alarm.Status
      description: Alarm status.
      type: string
    - contextPath: LogRhythm.Alarm.RBPAvg
      description: Alarm average RBP(Risk Based Prioritization).
      type: number
    - contextPath: LogRhythm.Alarm.ID
      description: The unique id of the alarm.
      type: number
    description: Retrieve a single alarm by the unique alarm identifier
  - name: lr-get-alarm-events-by-id
    arguments:
    - name: alarm-id
      required: true
      default: true
      description: The unique ID of the alarm
    - name: include-raw-log
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Include raw log
    outputs:
    - contextPath: LogRhythm.Alarm.Event.LogSourceName
      description: Event log source.
      type: string
    - contextPath: LogRhythm.Alarm.Event.Command
      description: Event command.
      type: string
    - contextPath: LogRhythm.Alarm.Event.Subject
      description: Event subject.
      type: string
    - contextPath: LogRhythm.Alarm.Event.Process
      description: Event process name.
      type: string
    - contextPath: LogRhythm.Alarm.Event.ClassificationName
      description: Event classification.
      type: string
    - contextPath: LogRhythm.Alarm.Event.ImpactedEntityName
      description: Event entity (Impacted).
      type: string
    - contextPath: LogRhythm.Alarm.Event.OriginEntityName
      description: Event entity (Origin).
      type: string
    - contextPath: LogRhythm.Alarm.Event.VendorMsgID
      description: Event vendor Message ID.
      type: string
    - contextPath: LogRhythm.Alarm.Event.NormalDate
      description: Event date.
      type: date
    - contextPath: LogRhythm.Alarm.Event.Session
      description: Event session.
    - contextPath: LogRhythm.Alarm.Event.ImpactedHostName
      description: Event hostname (Impacted).
      type: string
    - contextPath: LogRhythm.Alarm.Event.CommonEventName
      description: Event name.
      type: string
    - contextPath: LogRhythm.Alarm.Event.ImpactedZoneName
      description: Event zone (Impacted).
      type: string
    - contextPath: LogRhythm.Alarm.Event.OriginZoneName
      description: Event zone (Origin).
      type: string
    - contextPath: LogRhythm.Alarm.Event.Severity
      description: Event severity.
      type: string
    - contextPath: LogRhythm.Alarm.ID
      description: The unique id of the alarm.
      type: number
    description: Retrieve a list of events associated to this alarm
  - name: lr-get-alarm-history-by-id
    arguments:
    - name: alarm-id
      required: true
      default: true
      description: The unique ID of the alarm
    - name: include-notifications
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Include notification history
    - name: include-comments
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Include comments history
    outputs:
    - contextPath: LogRhythm.Alarm.History.Comment
      description: Alarm history comment.
      type: string
    - contextPath: LogRhythm.Alarm.History.DateInserted
      description: Alarm history record date.
      type: date
    - contextPath: LogRhythm.Alarm.History.ID
      description: The unique id of the history record.
      type: number
    - contextPath: LogRhythm.Alarm.History.PersonID
      description: Alarm history person id
      type: number
    - contextPath: LogRhythm.Alarm.History.PersonName
      description: Alarm history person name
      type: string
    - contextPath: LogRhythm.Alarm.ID
      description: The unique id of the alarm.
      type: number
    description: Retrieve a list of alarm status and comment updates
  - name: lr-update-alarm-status
    arguments:
    - name: alarm-id
      required: true
      default: true
      description: The unique ID of the alarm
    - name: status
      required: true
      auto: PREDEFINED
      predefined:
      - New
      - Opened
      - Working
      - Escalated
      - Closed
      - Closed_FalseAlarm
      - Closed_Resolved
      - Closed_Unresolved
      - Closed_Reported
      - Closed_Monitor
      description: The enumeration status of the alarm
    - name: comments
      description: The alarm comments
    outputs:
    - contextPath: LogRhythm.Alarm.Status
      description: Alarm new status.
      type: string
    - contextPath: LogRhythm.Alarm.ID
      description: The unique id of the alarm.
      type: number
    description: Update alarm status
  - name: lr-get-alarms
    arguments:
    - name: start-date
      description: 'Start date for the data query, for example: "2018-03-27". Only use this argument if the time_frame argument is "Custom".'
    - name: end-date
      description: 'End date for the data query. For example: end-date="2018-04-08"'
    - name: all-users
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Alarms for all users
    - name: count
      description: Number of alerts to retrieve. If empty, will be set to default of 1000.
      defaultValue: "1000"
    - name: status
      required: true
      auto: PREDEFINED
      predefined:
      - New
      - Opened
      - Working
      - Escalated
      - Closed
      - Closed_FalseAlarm
      - Closed_Resolved
      - Closed_Unresolved
      - Closed_Reported
      - Closed_Monitor
      description: The enumeration status of the alarm
    - name: time_frame
      default: true
      auto: PREDEFINED
      predefined:
      - LastHour
      - Today
      - Last2Days
      - LastWeek
      - LastMonth
      - Custom
      description: If time_frame is Custom, specify the start time for the time range.
      defaultValue: Custom
    outputs:
    - contextPath: LogRhythm.Alarm.RBPMax
      description: Alarm maximum RBP(Risk Based Prioritization).
      type: number
    - contextPath: LogRhythm.Alarm.RuleName
      description: Alarm rule name.
      type: string
    - contextPath: LogRhythm.Alarm.EntityName
      description: entity name.
      type: string
    - contextPath: LogRhythm.Alarm.Date
      description: Alarm date.
      type: date
    - contextPath: LogRhythm.Alarm.Status
      description: Alarm status.
      type: string
    - contextPath: LogRhythm.Alarm.RBPAvg
      description: Alarm average RBP(Risk Based Prioritization).
      type: number
    - contextPath: LogRhythm.Alarm.ID
      description: The unique id of the alarm.
      type: number
    description: Retrieve alarms in the specified time period. Alerts can be filtered by the alarm status.
  - name: lr-get-hosts-by-entity-id
    arguments:
    - name: entity-id
      required: true
      description: The entity ID.
    outputs:
    - contextPath: LogRhythm.Host.DateUpdated
      description: The date when the host was last updated.
      type: date
    - contextPath: LogRhythm.Host.EntityID
      description: The entity ID.
      type: number
    - contextPath: LogRhythm.Host.HostID
      description: The unique ID of the host object.
      type: number
    - contextPath: LogRhythm.Host.HostName
      description: ' The name of the host.'
      type: string
    - contextPath: LogRhythm.Host.LongDescription
      description: ' The long description of the host.'
      type: string
    - contextPath: LogRhythm.Host.OSVersion
      description: ' The host OS version.'
      type: string
    - contextPath: LogRhythm.Host.RecordStatus
      description: The record status of the host.
      type: string
    - contextPath: LogRhythm.Host.RiskThreshold
      description: The record status of the host.
      type: string
    - contextPath: LogRhythm.Host.ShortDescription
      description: ' The short description of the host. '
      type: string
    - contextPath: LogRhythm.Host.ThreatThreshold
      description: The threat threshold of the host.
      type: string
    - contextPath: LogRhythm.Host.OSType
      description: The host OS type.
      type: string
    description: Retrieves a list of hosts for a given entity, or an empty list if none is found.
  - name: lr-add-host
    arguments:
    - name: entity-id
      required: true
      description: The entity ID.
    - name: host-name
      required: true
      description: The LogRhythm hostname.
    - name: short-description
      description: Short description for the host.
    - name: long-description
      description: Long description for the host.
    - name: risk-threshold
      auto: PREDEFINED
      predefined:
      - None
      - LowLow
      - LowMedium
      - LowHigh
      - MediumLow
      - MediumMedium
      - MediumHigh
      - HighLow
      - HighMedium
      - HighHigh
      description: The risk threshold.
      defaultValue: None
    - name: os-type
      auto: PREDEFINED
      predefined:
      - Unknown
      - Other
      - WindowsNT4
      - Windows2000Professional
      - Windows2000Server
      - Windows2003Standard
      - Windows2003Enterprise
      - Windows95
      - WindowsXP
      - WindowsVista
      - Linux
      - Solaris
      - AIX
      - HPUX
      - Windows
      description: The host OS type.
      defaultValue: Unknown
    - name: os-version
      description: The version of the host OS.
      defaultValue: None
    - name: threat-threshold
      auto: PREDEFINED
      predefined:
      - None
      - LowLow
      - LowMedium
      - LowHigh
      - MediumLow
      - MediumMedium
      - MediumHigh
      - HighLow
      - HighMedium
      - HighHigh
      description: The threat threshold.
      defaultValue: None
    - name: ip-address
      description: Use an IP address to identify the host.
    - name: dns-name
      description: Use the DNS name to identify the host.
    - name: windows-name
      description: Use the Windows name to identify the host.
    outputs:
    - contextPath: LogRhythm.Host.DateUpdated
      description: The date when the host was last updated.
      type: date
    - contextPath: LogRhythm.Host.EntityID
      description: The entity ID.
      type: number
    - contextPath: LogRhythm.Host.HostID
      description: The unique ID of the host object.
      type: number
    - contextPath: LogRhythm.Host.HostName
      description: The name of the host.
      type: string
    - contextPath: LogRhythm.Host.LongDescription
      description: The long description of the host.
      type: string
    - contextPath: LogRhythm.Host.OSVersion
      description: The host OS version.
      type: string
    - contextPath: LogRhythm.Host.RecordStatus
      description: The record status of the host.
      type: string
    - contextPath: LogRhythm.Host.RiskThreshold
      description: The record status of the host.
      type: string
    - contextPath: LogRhythm.Host.ShortDescription
      description: 'The short description of the host. '
      type: string
    - contextPath: LogRhythm.Host.ThreatThreshold
      description: The threat threshold of the host.
      type: string
    - contextPath: LogRhythm.Host.OSType
      description: The host OS type.
      type: string
    description: Adds a new host to an entity.
  - name: lr-execute-query
    arguments:
    - name: keyword
      required: true
      description: Filter log message by keywords.
    - name: start-date
      description: 'Start date for the query, for example: "2018-03-27". Only use this argument if the time_frame argument is "Custom".'
    - name: end-date
      description: 'End date for the query, for example: end-date="2018-04-20". Only use this argument if the time_frame argument is "Custom".'
    - name: time_frame
      auto: PREDEFINED
      predefined:
      - LastHour
      - Today
      - Last2Days
      - LastWeek
      - LastMonth
      - Custom
      description: If time_frame is "Custom", specify the start time for the time range.
      defaultValue: Custom
    outputs:
    - contextPath: LogRhythm.Log.ClassificationName
      description: 'The name of one of three major activity groups: "Operations", "Audit", or "Security", and a more specific sub-classification.'
      type: string
    - contextPath: LogRhythm.Log.CommonEventName
      description: A short, plain-language description of the log that determines its Classification.
      type: string
    - contextPath: LogRhythm.Log.Count
      description: The number of times the log entry occurred when aggregated with other identical log entries.
      type: number
    - contextPath: LogRhythm.Log.Direction
      description: Direction by name of activity between a log's Origin and Impacted Zones. Values can be "Internal", "External", "Outbound", "Local", or "Unknown".
      type: string
    - contextPath: LogRhythm.Log.EntityName
      description: The name of the entity.
      type: string
    - contextPath: LogRhythm.Log.ImpactedHostName
      description: The name of the host, such as a DNS name or NetBIOS name impacted by the log activity.
      type: string
    - contextPath: LogRhythm.Log.ImpactedZone
      description: The name of the Impacted Zone.
      type: string
    - contextPath: LogRhythm.Log.LogDate
      description: The creation date contained in the log. It can be in UTC or a user-selected time zone.
      type: date
    - contextPath: LogRhythm.Log.LogMessage
      description: The log message generated due to the activity detected by the source.
      type: string
    - contextPath: LogRhythm.Log.LogSourceHost
      description: The system or device where the log source originated.
      type: string
    - contextPath: LogRhythm.Log.LogSourceHostName
      description: The name of the log source host.
      type: string
    - contextPath: LogRhythm.Log.MPERuleName
      description: Message Processing Engine (MPE) Rule. It identifies and normalizes a log message and assigns it a Common Event.
      type: string
    - contextPath: LogRhythm.Log.MessageType
      description: 'The message type. Values can be: "Message", "Log", "Known Log", "Event", or "Alarm".'
      type: string
    - contextPath: LogRhythm.Log.OriginEntityName
      description: The resolved Entity of the origin host.
      type: string
    - contextPath: LogRhythm.Log.OriginHostName
      description: The name of the host, such as a DNS name or NetBIOS name that was the origin of the log activity.
      type: string
    - contextPath: LogRhythm.Log.OriginZone
      description: 'The enumeration value of the resolved Zone that was the origin of the activity. Values can be: "Internal", "External", or "DMZ".'
      type: string
    - contextPath: LogRhythm.Log.Session
      description: User, system, or application session.
      type: string
    - contextPath: LogRhythm.Log.Priority
      description: Calculated Risk Based Priority (RBP) of the log entry.
      type: number
    - contextPath: LogRhythm.Log.Severity
      description: Value indicating the severity of the log.
      type: string
    - contextPath: LogRhythm.Log.VendorMsgID
      description: Unique, vendor-assigned value that IDs the log message.
      type: number
    - contextPath: LogRhythm.Log.ImpactedName
      description: The name of the impacted device.
      type: string
    - contextPath: LogRhythm.Log.ObjectName
      description: 'The name for an Object. Note: Object will store the full path and name but ObjectName will only store the object name.'
      type: string
    description: Executes a query for logs that match query parameters.
  isfetch: true
deprecated: true
tests:
- LogRhythm-Test-Playbook
fromversion: 5.0.0