LogRhythmRest V2

LogRhythm security intelligence.

Analytics & SIEM · LogRhythm

Configuration parameters

  • url — Server URL (required)
  • credentials — (required)
  • isFetch — Fetch incidents
  • incidentFetchInterval — Incidents Fetch Interval
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • incidentType — Incident type
  • alarmsMaxFetch — Alarms max fetch
  • casesMaxFetch — Cases max fetch
  • fetchType — Fetch incidents from type (required)
  • alarm_status_filter — Alarm status filter
  • alarm_rule_name_filter — Alarm rule name filter
  • case_tags_filter — Case tags filter
  • case_status_filter — Case status filter
  • case_priority_filter — Case priority filter
  • fetch_case_evidences — Fetch case evidences
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)

Commands (37)

  • endpoint

    Returns information about an endpoint.

  • lr-add-host

    Add a new host to an entity.

  • lr-alarm-add-comment

    Updates the Alarm History table with comments in the Comments column based on the alarm ID supplied.

  • lr-alarm-drilldown

    Gets the drill-down logs per rule block for a specific alarm Id that fired associated with an AIE alarm.

  • lr-alarm-events-list

    Gets a list of events for the specified alarm ID.

  • lr-alarm-history-list

    Gets the alarm history details by ID and filter criteria.

  • lr-alarm-summary

    Get the alarm summary by the specified alarm ID.

  • lr-alarm-update

    Updates the alarm status and RBP based on the alarm ID supplied. alarm_status or rbp are required.

  • lr-alarms-list

    Gets the details of the alarms using the filter criteria.

  • lr-case-alarm-evidence-add

    Add multiple alarms as evidence on a case.

  • lr-case-collaborators-list

    Returns the owner and a list of collaborators associated with a specific case.

  • lr-case-collaborators-update

    Updates the owner and collaborators associated with a specific case.

  • lr-case-create

    Create a new case.

  • lr-case-evidence-delete

    Remove evidence from a case.

  • lr-case-evidence-list

    Return a list of evidence summaries for a case.

  • lr-case-file-evidence-add

    Upload a file as evidence on a case.

  • lr-case-file-evidence-download

    Download an item of file evidence from a case.

  • lr-case-note-evidence-add

    Add a note as evidence on a case.

  • lr-case-status-change

    Update the status of a case.

  • lr-case-tags-add

    Add tags to a case.

  • lr-case-tags-remove

    Remove tags from a case.

  • lr-case-update

    Update case information. For example, the case name, priority, and due date.

  • lr-cases-list

    Get cases details using filter criteria.

  • lr-entities-list

    Returns all Entities that match the specified criteria.

  • lr-execute-search-query

    Execute a search query on the LogRhythm log database.

  • lr-get-alarm-details

    Get the details of an alarm by the specified alarm ID.

  • lr-get-query-result

    Get the search query result for the specified task ID. The task ID can be retrieved from the lr-execute-search-query command.

  • lr-hosts-list

    Returns all hosts that match the specified criteria.

  • lr-hosts-status-update

    Updates the status of a host to retire or active.

  • lr-list-details-and-items-get

    Returns list details and list items based on the list GUID.

  • lr-list-items-add

    Adds more items to an existing list.

  • lr-list-items-remove

    Removes items from an existing list.

  • lr-list-summary-create-update

    Updates a list summary based on the GUID and other required details. Searches the system for existing list summaries by GUID. Creates a new list summary if the GUID does not exist. Otherwise, updates the list summary.

  • lr-lists-get

    Returns list details using the filter criteria.

  • lr-networks-list

    Returns all networks that match the specified criteria.

  • lr-tags-list

    Return a list of tags using filter criteria.

  • lr-users-list

    Returns user records based on the permissions of the currently logged in user and the specified criteria.