LogRhythmRestV2 - Search query

Inputs

• number_of_days — Number of days to search.
• search_name — Name of the search.
• source_type — Log source type.
• host_name — Impacted host name.
• username — Username.
• subject — Email subject.
• sender — Email sender.
• recipient — Email recipient.
• hash — Hash.
• URL — URL.
• process_name — Process name.
• object — Log object.
• ip_address — IP address.
• max_massage — Maximum number of log messages to query.
• query_timeout — The query timeout in seconds.
• entity_id — Entity ID.

Outputs

• LogRhythm.Search.TaskStatus — Task Status.
• LogRhythm.Search.TaskId — Task Id.
• LogRhythm.Search.SearchName — The name of the search query in Cortex XSOAR.
• LogRhythm.Search.Results.originEntityId — Entity ID.
• LogRhythm.Search.Results.impactedIp — Impacted IP address.
• LogRhythm.Search.Results.classificationTypeName — Classification name.
• LogRhythm.Search.Results.logSourceName — Log source name.
• LogRhythm.Search.Results.entityName — Entity name.
• LogRhythm.Search.Results.normalDate — Date.
• LogRhythm.Search.Results.vendorMessageId — Vendor log message.
• LogRhythm.Search.Results.priority — Log priority.
• LogRhythm.Search.Results.sequenceNumber — Sequence number.
• LogRhythm.Search.Results.originHostId — Origin host ID.
• LogRhythm.Search.Results.mpeRuleId — LogRhythm rule ID.
• LogRhythm.Search.Results.originIp — Origin IP address.
• LogRhythm.Search.Results.mpeRuleName — LogRhythm rule name.
• LogRhythm.Search.Results.logSourceHostId — Log source host ID.
• LogRhythm.Search.Results.originHost — Origin host.
• LogRhythm.Search.Results.logDate — Log date.
• LogRhythm.Search.Results.classificationName — Log classification name.

Commands used