Logrhythm - Search query

This playbook used generic polling to gets query result using the command: lr-execute-search-query

Pack

LogRhythmRest

Tasks

4

Inputs

• number_of_days — Number of days to search.
• source_type — Log source type.
• host_name — Impacted host name.
• username — Username.
• subject — Email Subject.
• sender — Email Sender.
• recipient — Email Recipient.
• hash — Hash.
• URL — URL.
• process_name — Process name.
• object — Log object.
• ip_address — IP Address.
• max_massage — Maximum number of log message to query.
• query_timeout — Execute search query to LogRhythm log database.

Outputs

• Logrhythm.Search.Results.TaskStatus — Task Status.
• Logrhythm.Search.Results.TaskID — Task ID.
• Logrhythm.Search.Results.Items.originEntityId — Entity ID.
• Logrhythm.Search.Results.Items.impactedIp — Impacted IP.
• Logrhythm.Search.Results.Items.classificationTypeName — Classification Name.
• Logrhythm.Search.Results.Items.logSourceName — Log Source Name.
• Logrhythm.Search.Results.Items.entityName — Entity Name.
• Logrhythm.Search.Results.Items.normalDate — Date.
• Logrhythm.Search.Results.Items.vendorMessageId — Vendor Log message.
• Logrhythm.Search.Results.Items.priority — Log priority.
• Logrhythm.Search.Results.Items.sequenceNumber — Seq number.
• Logrhythm.Search.Results.Items.originHostId — Origin Host ID.
• Logrhythm.Search.Results.Items.mpeRuleId — Log Rhythm rule ID.
• Logrhythm.Search.Results.Items.originIp — Origin IP.
• Logrhythm.Search.Results.Items.mpeRuleName — Log Rhythm rule name.
• Logrhythm.Search.Results.Items.logSourceHostId — Log Source host ID.
• Logrhythm.Search.Results.Items.originHost — Origin Host.
• Logrhythm.Search.Results.Items.logDate — Log Date.
• Logrhythm.Search.Results.Items.classificationName — Log classification name.

Commands used

• lr-execute-search-query
• lr-get-query-result