Logrhythm - Search query

id: Logrhythm - Search query
version: -1
name: Logrhythm - Search query
description: 'This playbook used generic polling to gets query result using the command:
  lr-execute-search-query'
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 08c7da4e-0e4d-4d09-8d66-0193617229c9
    type: start
    task:
      id: 08c7da4e-0e4d-4d09-8d66-0193617229c9
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: d5af053b-a802-4c47-84f7-e7f551bdec72
    type: regular
    task:
      id: d5af053b-a802-4c47-84f7-e7f551bdec72
      version: -1
      name: Execute search query
      description: Execute search query to Log Rhythm log database
      script: '|||lr-execute-search-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      hash:
        complex:
          root: inputs.hash
      host-name:
        complex:
          root: inputs.host-name
      host_name:
        complex:
          root: inputs.host_name
      ip_address:
        complex:
          root: inputs.ip_address
      ipaddress:
        complex:
          root: inputs.ipaddress
      max_massage:
        complex:
          root: inputs.max_massage
      number-of-date:
        complex:
          root: inputs.number-of-date
      number_of_days:
        complex:
          root: inputs.number_of_days
      object:
        complex:
          root: inputs.object
      process-name:
        complex:
          root: inputs.process-name
      process_name:
        complex:
          root: inputs.process_name
      query_timeout:
        complex:
          root: inputs.query_timeout
      recipient:
        complex:
          root: inputs.recipient
      sender:
        complex:
          root: inputs.sender
      source-type:
        complex:
          root: inputs.source-type
      source_type:
        complex:
          root: inputs.source_type
      subject:
        complex:
          root: inputs.subject
      url:
        complex:
          root: inputs.URL
      username:
        complex:
          root: inputs.username
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 4e4d26f7-8bb3-4062-8012-6a1eba98aa64
    type: playbook
    task:
      id: 4e4d26f7-8bb3-4062-8012-6a1eba98aa64
      version: -1
      name: GenericPolling
      description: |-
        Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continuously running the command in Step \#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      Ids:
        complex:
          root: Logrhythm.Search.Task
          accessor: TaskID
      Interval:
        simple: "1"
      PollingCommandArgName:
        simple: task_id
      PollingCommandName:
        simple: lr-get-query-result
      Timeout:
        simple: "60"
      dt:
        simple: Logrhythm.Search.Results(val.TaskStatus == 'Searching').TaskID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 82c34a2f-02b5-47c6-8e4e-09448f1a743f
    type: regular
    task:
      id: 82c34a2f-02b5-47c6-8e4e-09448f1a743f
      version: -1
      name: Get results
      description: Get search query result with task ID output from lr-execute-search-query
        command
      script: '|||lr-get-query-result'
      type: regular
      iscommand: true
      brand: ""
    scriptarguments:
      task_id:
        complex:
          root: Logrhythm.Search.Task
          accessor: taskID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 590,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: number_of_days
  value:
    simple: "7"
  required: true
  description: Number of days to search.
  playbookInputQuery:
- key: source_type
  value: {}
  required: false
  description: Log source type.
  playbookInputQuery:
- key: host_name
  value: {}
  required: false
  description: Impacted host name.
  playbookInputQuery:
- key: username
  value: {}
  required: false
  description: Username.
  playbookInputQuery:
- key: subject
  value: {}
  required: false
  description: Email Subject.
  playbookInputQuery:
- key: sender
  value: {}
  required: false
  description: Email Sender.
  playbookInputQuery:
- key: recipient
  value: {}
  required: false
  description: Email Recipient.
  playbookInputQuery:
- key: hash
  value: {}
  required: false
  description: Hash.
  playbookInputQuery:
- key: URL
  value: {}
  required: false
  description: URL.
  playbookInputQuery:
- key: process_name
  value: {}
  required: false
  description: Process name.
  playbookInputQuery:
- key: object
  value: {}
  required: false
  description: Log object.
  playbookInputQuery:
- key: ip_address
  value: {}
  required: false
  description: IP Address.
  playbookInputQuery:
- key: max_massage
  value:
    simple: "10"
  required: false
  description: Maximum number of log message to query.
  playbookInputQuery:
- key: query_timeout
  value:
    simple: "60"
  required: false
  description: Execute search query to LogRhythm log database.
  playbookInputQuery:
outputs:
- contextPath: Logrhythm.Search.Results.TaskStatus
  description: Task Status.
  type: string
- contextPath: Logrhythm.Search.Results.TaskID
  description: Task ID.
  type: string
- contextPath: Logrhythm.Search.Results.Items.originEntityId
  description: Entity ID.
  type: number
- contextPath: Logrhythm.Search.Results.Items.impactedIp
  description: Impacted IP.
  type: string
- contextPath: Logrhythm.Search.Results.Items.classificationTypeName
  description: Classification Name.
  type: string
- contextPath: Logrhythm.Search.Results.Items.logSourceName
  description: Log Source Name.
  type: string
- contextPath: Logrhythm.Search.Results.Items.entityName
  description: Entity Name.
  type: string
- contextPath: Logrhythm.Search.Results.Items.normalDate
  description: Date.
  type: date
- contextPath: Logrhythm.Search.Results.Items.vendorMessageId
  description: Vendor Log message.
  type: string
- contextPath: Logrhythm.Search.Results.Items.priority
  description: Log priority.
  type: number
- contextPath: Logrhythm.Search.Results.Items.sequenceNumber
  description: Seq number.
  type: string
- contextPath: Logrhythm.Search.Results.Items.originHostId
  description: Origin Host ID.
  type: number
- contextPath: Logrhythm.Search.Results.Items.mpeRuleId
  description: Log Rhythm rule ID.
  type: number
- contextPath: Logrhythm.Search.Results.Items.originIp
  description: Origin IP.
  type: string
- contextPath: Logrhythm.Search.Results.Items.mpeRuleName
  description: Log Rhythm rule name.
  type: string
- contextPath: Logrhythm.Search.Results.Items.logSourceHostId
  description: Log Source host ID.
  type: number
- contextPath: Logrhythm.Search.Results.Items.originHost
  description: Origin Host.
  type: string
- contextPath: Logrhythm.Search.Results.Items.logDate
  description: Log Date.
  type: date
- contextPath: Logrhythm.Search.Results.Items.classificationName
  description: Log classification name.
  type: string
tests:
- LogRhythm REST test
fromversion: 5.0.0