LogRhythmRestV2 - Search query
This playbook used generic polling to get query results using the command: lr-execute-search-query.
- Pack
- LogRhythmRest
- Tasks
- 4
Inputs
- number_of_days — Number of days to search.
- search_name — Name of the search.
- source_type — Log source type.
- host_name — Impacted host name.
- username — Username.
- subject — Email subject.
- sender — Email sender.
- recipient — Email recipient.
- hash — Hash.
- URL — URL.
- process_name — Process name.
- object — Log object.
- ip_address — IP address.
- max_massage — Maximum number of log messages to query.
- query_timeout — The query timeout in seconds.
- entity_id — Entity ID.
Outputs
- LogRhythm.Search.TaskStatus — Task Status.
- LogRhythm.Search.TaskId — Task Id.
- LogRhythm.Search.SearchName — The name of the search query in Cortex XSOAR.
- LogRhythm.Search.Results.originEntityId — Entity ID.
- LogRhythm.Search.Results.impactedIp — Impacted IP address.
- LogRhythm.Search.Results.classificationTypeName — Classification name.
- LogRhythm.Search.Results.logSourceName — Log source name.
- LogRhythm.Search.Results.entityName — Entity name.
- LogRhythm.Search.Results.normalDate — Date.
- LogRhythm.Search.Results.vendorMessageId — Vendor log message.
- LogRhythm.Search.Results.priority — Log priority.
- LogRhythm.Search.Results.sequenceNumber — Sequence number.
- LogRhythm.Search.Results.originHostId — Origin host ID.
- LogRhythm.Search.Results.mpeRuleId — LogRhythm rule ID.
- LogRhythm.Search.Results.originIp — Origin IP address.
- LogRhythm.Search.Results.mpeRuleName — LogRhythm rule name.
- LogRhythm.Search.Results.logSourceHostId — Log source host ID.
- LogRhythm.Search.Results.originHost — Origin host.
- LogRhythm.Search.Results.logDate — Log date.
- LogRhythm.Search.Results.classificationName — Log classification name.
Commands used
- lr-execute-search-query
- lr-get-query-result