LogRhythmRest V2
LogRhythm security intelligence.
- Category
- Analytics & SIEM
- Pack
- LogRhythmRest
Configuration parameters
- url — Server URL (required)
- credentials — (required)
- isFetch — Fetch incidents
- incidentFetchInterval — Incidents Fetch Interval
- first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
- incidentType — Incident type
- alarmsMaxFetch — Alarms max fetch
- casesMaxFetch — Cases max fetch
- fetchType — Fetch incidents from type (required)
- alarm_status_filter — Alarm status filter
- alarm_rule_name_filter — Alarm rule name filter
- case_tags_filter — Case tags filter
- case_status_filter — Case status filter
- case_priority_filter — Case priority filter
- fetch_case_evidences — Fetch case evidences
- proxy — Use system proxy settings
- insecure — Trust any certificate (not secure)
Commands (37)
- endpoint — Returns information about an endpoint.
- lr-add-host — Add a new host to an entity.
- lr-alarm-add-comment — Updates the Alarm History table with comments in the Comments column based on the alarm ID supplied.
- lr-alarm-drilldown — Gets the drill-down logs per rule block for a specific alarm Id that fired associated with an AIE alarm.
- lr-alarm-events-list — Gets a list of events for the specified alarm ID.
- lr-alarm-history-list — Gets the alarm history details by ID and filter criteria.
- lr-alarm-summary — Get the alarm summary by the specified alarm ID.
- lr-alarm-update — Updates the alarm status and RBP based on the alarm ID supplied. alarm_status or rbp are required.
- lr-alarms-list — Gets the details of the alarms using the filter criteria.
- lr-case-alarm-evidence-add — Add multiple alarms as evidence on a case.
- lr-case-collaborators-list — Returns the owner and a list of collaborators associated with a specific case.
- lr-case-collaborators-update — Updates the owner and collaborators associated with a specific case.
- lr-case-create — Create a new case.
- lr-case-evidence-delete — Remove evidence from a case.
- lr-case-evidence-list — Return a list of evidence summaries for a case.
- lr-case-file-evidence-add — Upload a file as evidence on a case.
- lr-case-file-evidence-download — Download an item of file evidence from a case.
- lr-case-note-evidence-add — Add a note as evidence on a case.
- lr-case-status-change — Update the status of a case.
- lr-case-tags-add — Add tags to a case.
- lr-case-tags-remove — Remove tags from a case.
- lr-case-update — Update case information. For example, the case name, priority, and due date.
- lr-cases-list — Get cases details using filter criteria.
- lr-entities-list — Returns all Entities that match the specified criteria.
- lr-execute-search-query — Execute a search query on the LogRhythm log database.
- lr-get-alarm-details — Get the details of an alarm by the specified alarm ID.
- lr-get-query-result — Get the search query result for the specified task ID. The task ID can be retrieved from the lr-execute-search-query command.
- lr-hosts-list — Returns all hosts that match the specified criteria.
- lr-hosts-status-update — Updates the status of a host to retire or active.
- lr-list-details-and-items-get — Returns list details and list items based on the list GUID.
- lr-list-items-add — Adds more items to an existing list.
- lr-list-items-remove — Removes items from an existing list.
- lr-list-summary-create-update — Updates a list summary based on the GUID and other required details. Searches the system for existing list summaries by GUID. Creates a new list summary if the GUID does not exist. Otherwise, updates the list summary.
- lr-lists-get — Returns list details using the filter criteria.
- lr-networks-list — Returns all networks that match the specified criteria.
- lr-tags-list — Return a list of tags using filter criteria.
- lr-users-list — Returns user records based on the permissions of the currently logged in user and the specified criteria.