Logrhythm

LogRhythm is a leading SIEM platform that provides advanced threat detection and response capabilities.

LogRhythm is a leading security information and event management (SIEM) platform that provides comprehensive threat detection and response capabilities. The LogRhythm connector for Swimlane Turbine enables seamless integration with LogRhythm's advanced alarm and event management features. This integration allows Swimlane Turbine users to automate the retrieval and management of alarm data, streamline incident response workflows, and enhance overall security operations. By leveraging LogRhythm's robust capabilities, users can efficiently monitor, analyze, and respond to security threats within their environment.

Prerequisites

Before you can use the LogRhythm connector for Turbine, you'll need access to the LogRhythm API. This requires the following:

an HTTP Bearer token authentication using the following parameters:

URL: The endpoint URL for accessing LogRhythm's API services.

API Token: A valid API token for authenticating requests to LogRhythm.

Capabilities

The Logrhythm connector provides the following capabilities for both REST/SOAP APIs:

Get Alarm Events

Get Alarm History

Get Alarm Summary

Get Alarm URL

Get Alarm by ID

Get Drill-Down Summary

Get Drill-Down Logs and Summary

Search Alarms

Search Results

Search Tasks

Update Alarm Comment

Update Alarm Status

Additional Documentation

Logrhythm Connector Documentation

Logrhythm API Documentation

Configurations

HTTP Bearer Authentication

Authenticates using bearer token such as a JWT, etc.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
token	The API token	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get Alarm

Get detailed information for a specific alarm in LogRhythm using the provided alarmId as a path parameter.

Endpoint

URL: lr-alarm-api/alarms/{{alarmId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alarmId	number	Required	Parameters for the Get Alarm action

Input Example

{"path_parameters":{"alarmId":10}}

Output

Parameter	Type	Description
alarmDetails	object	Output field: alarmDetails
alarmDetails.alarmId	number	Unique identifier
alarmDetails.personId	number	Unique identifier
alarmDetails.entityId	number	Unique identifier
alarmDetails.entityName	string	Name of the resource
alarmDetails.alarmDate	string	Date value
alarmDetails.alarmRuleID	number	Unique identifier
alarmDetails.alarmRuleName	string	Name of the resource
alarmDetails.alarmStatus	string	Status value
alarmDetails.alarmStatusName	string	Name of the resource
alarmDetails.lastUpdatedID	number	Unique identifier
alarmDetails.lastUpdatedName	string	Name of the resource
alarmDetails.dateInserted	string	Output field: alarmDetails.dateInserted
alarmDetails.dateUpdated	string	Output field: alarmDetails.dateUpdated
alarmDetails.associatedCases	array	Output field: alarmDetails.associatedCases
alarmDetails.lastPersonID	number	Unique identifier
alarmDetails.eventCount	number	Count value
alarmDetails.eventDateFirst	string	Output field: alarmDetails.eventDateFirst
alarmDetails.eventDateLast	string	Output field: alarmDetails.eventDateLast
alarmDetails.rBPMax	number	Output field: alarmDetails.rBPMax
alarmDetails.rBPAvg	number	Output field: alarmDetails.rBPAvg
alarmDetails.executionTarget	number	Output field: alarmDetails.executionTarget
alarmDetails.smartResponseActions	array	Output field: alarmDetails.smartResponseActions
alarmDetails.smartResponseActions.srpName	string	Name of the resource
alarmDetails.smartResponseActions.executionTime	number	Time value

Output Example

{"alarmDetails":{"alarmId":123,"personId":123,"entityId":123,"entityName":"Example Name","alarmDate":"string","alarmRuleID":123,"alarmRuleName":"Example Name","alarmStatus":"active","alarmStatusName":"active","lastUpdatedID":123,"lastUpdatedName":"Example Name","dateInserted":"string","dateUpdated":"string","associatedCases":["string"],"lastPersonID":123},"statusCode":123,"statusMessage":"string","responseMessage":"string"}

Get Alarm Events

Get detailed events for a specified alarmId in LogRhythm.

Endpoint

URL: lr-alarm-api/alarms/{{alarmId}}/events

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alarmId	number	Required	Parameters for the Get Alarm Events action

Input Example

{"path_parameters":{"alarmId":10}}

Output

Parameter	Type	Description
alarmsEventDetails	array	Output field: alarmsEventDetails
alarmsEventDetails.account	string	Count value
alarmsEventDetails.action	string	Output field: alarmsEventDetails.action
alarmsEventDetails.amount	number	Output field: alarmsEventDetails.amount
alarmsEventDetails.bytesIn	string	Output field: alarmsEventDetails.bytesIn
alarmsEventDetails.bytesOut	string	Output field: alarmsEventDetails.bytesOut
alarmsEventDetails.classificationId	number	Unique identifier
alarmsEventDetails.classificationName	string	Name of the resource
alarmsEventDetails.classificationTypeName	string	Name of the resource
alarmsEventDetails.command	string	Output field: alarmsEventDetails.command
alarmsEventDetails.commonEventId	number	Unique identifier
alarmsEventDetails.cve	string	Output field: alarmsEventDetails.cve
alarmsEventDetails.commonEventName	string	Name of the resource
alarmsEventDetails.count	number	Count value
alarmsEventDetails.directionId	number	Unique identifier
alarmsEventDetails.directionName	string	Name of the resource
alarmsEventDetails.domain	string	Output field: alarmsEventDetails.domain
alarmsEventDetails.duration	number	Output field: alarmsEventDetails.duration
alarmsEventDetails.entityId	number	Unique identifier
alarmsEventDetails.entityName	string	Name of the resource
alarmsEventDetails.group	string	Output field: alarmsEventDetails.group
alarmsEventDetails.impactedEntityId	number	Unique identifier
alarmsEventDetails.impactedEntityName	string	Name of the resource
alarmsEventDetails.impactedHostId	number	Unique identifier
alarmsEventDetails.impactedHostName	string	Name of the resource

Output Example

{"alarmsEventDetails":[],"statusCode":123,"statusMessage":"string","responseMessage":"string"}

Get Alarm History

Get alarm history details in LogRhythm for a specified alarmId and other filter criteria.

Endpoint

URL: lr-alarm-api/alarms/{{alarmId}}/history

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alarmId	number	Required	Parameters for the Get Alarm History action
parameters.offset	number	Optional	The number of items to skip before starting to collect the result set.
parameters.count	number	Optional	The numbers of items to return.
parameters.orderby	string	Optional	Field name on which we want to sort the result.
parameters.dir	string	Optional	Provide order direction either ascending or descending.
parameters.dateUpdated	string	Optional	Filter criteria return value greater than or equal to the provided datetime.
parameters.personId	number	Optional	Filter criteria to get the result on the basis og provided personId.
parameters.type	string	Optional	User can provide comment/status/rbp.

Input Example

{"path_parameters":{"alarmId":10}}

Output

Parameter	Type	Description
statusCode	number	Status value
statusMessage	string	Status value
responseMessage	string	Response message
AlarmHistoryDetails	array	Output field: AlarmHistoryDetails
AlarmHistoryDetails.alarmId	number	Unique identifier
AlarmHistoryDetails.personId	number	Unique identifier
AlarmHistoryDetails.comments	string	Output field: AlarmHistoryDetails.comments
AlarmHistoryDetails.dateUpdated	string	Output field: AlarmHistoryDetails.dateUpdated
AlarmHistoryDetails.dateInserted	string	Output field: AlarmHistoryDetails.dateInserted

Output Example

{"statusCode":123,"statusMessage":"string","responseMessage":"string","AlarmHistoryDetails":[]}

Get Alarm Summary

Retrieve a detailed alarm summary in LogRhythm using the specified alarmId.

Endpoint

URL: lr-alarm-api/alarms/{{alarmId}}/summary

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alarmId	number	Required	Parameters for the Get Alarm Summary action

Input Example

{"path_parameters":{"alarmId":10}}

Output

Parameter	Type	Description
alarmSummaryDetails	object	Output field: alarmSummaryDetails
alarmSummaryDetails.dateInserted	string	Output field: alarmSummaryDetails.dateInserted
alarmSummaryDetails.rbpMax	number	Output field: alarmSummaryDetails.rbpMax
alarmSummaryDetails.rbpAvg	number	Output field: alarmSummaryDetails.rbpAvg
alarmSummaryDetails.alarmRuleId	number	Unique identifier
alarmSummaryDetails.alarmRuleGroup	string	Output field: alarmSummaryDetails.alarmRuleGroup
alarmSummaryDetails.briefDescription	string	Output field: alarmSummaryDetails.briefDescription
alarmSummaryDetails.additionalDetails	string	Output field: alarmSummaryDetails.additionalDetails
alarmSummaryDetails.alarmEventSummary	array	Output field: alarmSummaryDetails.alarmEventSummary
alarmSummaryDetails.alarmEventSummary.msgClassId	number	Unique identifier
alarmSummaryDetails.alarmEventSummary.msgClassName	string	Name of the resource
alarmSummaryDetails.alarmEventSummary.commonEventId	number	Unique identifier
alarmSummaryDetails.alarmEventSummary.commonEventName	string	Name of the resource
alarmSummaryDetails.alarmEventSummary.originHostId	number	Unique identifier
alarmSummaryDetails.alarmEventSummary.impactedHostId	string	Unique identifier
alarmSummaryDetails.alarmEventSummary.originUser	string	Output field: alarmSummaryDetails.alarmEventSummary.originUser
alarmSummaryDetails.alarmEventSummary.impactedUser	string	Output field: alarmSummaryDetails.alarmEventSummary.impactedUser
alarmSummaryDetails.alarmEventSummary.originUserIdentityId	number	Unique identifier
alarmSummaryDetails.alarmEventSummary.impactedUserIdentityId	number	Unique identifier
alarmSummaryDetails.alarmEventSummary.originUserIdentityName	string	Unique identifier
alarmSummaryDetails.alarmEventSummary.impactedUserIdentityName	string	Unique identifier
alarmSummaryDetails.alarmEventSummary.originEntityName	string	Name of the resource
alarmSummaryDetails.alarmEventSummary.impactedEntityName	string	Name of the resource
statusCode	number	Status value
statusMessage	string	Status value

Output Example

{"alarmSummaryDetails":{"dateInserted":"string","rbpMax":123,"rbpAvg":123,"alarmRuleId":123,"alarmRuleGroup":"string","briefDescription":"string","additionalDetails":"string","alarmEventSummary":[{}]},"statusCode":123,"statusMessage":"string","responseMessage":"string"}

Get Alarm URL

Fetches the alarm URL from LogRhythm for quick access to specific alarms.

Endpoint

URL: lr-alarm-api/alarms/url

Method: GET

Output

Parameter	Type	Description
alarmURL	string	URL endpoint for the request
statusCode	number	Status value
statusMessage	string	Status value
responseMessage	string	Response message

Output Example

{"alarmURL":"string","statusCode":123,"statusMessage":"string","responseMessage":"string"}

Get Drill-Down Logs and Summary

Return drill-down logs and aggregate counts per rule block for a specific AIE alarm ID in LogRhythm. Requires the alarmId as a path parameter.

Endpoint

URL: lr-drilldown-cache-api/drilldown/{{alarmId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alarmId	number	Required	An alarm ID to initiate an AI Engine drill down.

Input Example

{"path_parameters":{"alarmId":10}}

Output

Parameter	Type	Description
DrillDownResults	object	Result of the operation
DrillDownResults.AlarmID	number	The alarm associated with the drill down.
DrillDownResults.AIERuleID	number	AI Engine rule ID associated with the triggered alarm.
DrillDownResults.Status	number	Drill-down request status (0=NQ, 1=Q, 2=SentToSH, 3=R, 4=C).
DrillDownResults.RetryCount	number	The number of times the Data Indexer is queried for the drill-down results.
DrillDownResults.LastDxTimestamp	string	Timestamp, in UTC, at which the Data Indexer was queried.
DrillDownResults.DateInserted	string	Timestamp, in UTC, when the alarm was added to the cache.
DrillDownResults.AlarmGuid	string	Unique identification of the Alarm GUID.
DrillDownResults.WebConsoleId	string	Unique identification of the Alarm GUID.
DrillDownResults.NotificationSent	boolean	Flag indicating the status of notification sent for the alarm.
DrillDownResults.AIEMsgXml	string	The message XML associated with the event triggered by the AI Engine.
DrillDownResults.EventID	number	The event ID associated with the AI Engine alarm.
DrillDownResults.NormalMessageDate	string	Date, in UTC, that specifies the time of occurrence of the log.
DrillDownResults.RuleBlocks	array	Result of the operation
DrillDownResults.RuleBlocks.RuleBlockID	number	The Rule Block ID associated with the AI Engine rule that triggered the alarm.
DrillDownResults.RuleBlocks.RuleBlockTypeID	number	The type of rule block as specified in the Events Msg XML.
DrillDownResults.RuleBlocks.DrillDownLogs	array	Logs that triggered the AI Engine rule associated with the rule block.
DrillDownResults.RuleBlocks.AIECount	number	The number of logs identified by the AI Engine that triggered the alarm.
DrillDownResults.RuleBlocks.DXCount	number	The number of logs stored in the Data Indexer that matched the drill-down criteria.
DrillDownResults.RuleBlocks.NormalMessageDate	string	Date, in UTC, that specifies the time of occurrence of the log.
DrillDownResults.RuleBlocks.NormalMessageDateUpper	string	Date, in UTC, that specifies the upper bound for the rule block triggered.
DrillDownResults.RuleBlocks.NormalMessageDateLower	string	Date, in UTC, that specifies the lower bound for the rule block triggered.
DrillDownResults.RuleBlocks.DDSummaries	array	Result of the operation
DrillDownResults.RuleBlocks.DDSummaries.SummaryFieldType	number	The Summary Field type selected for the rule block.
DrillDownResults.RuleBlocks.DDSummaries.DrillDownSummaries	string	Aggregate of the Summary Field type as found in the drill-down logs.

Output Example

{"DrillDownResults":{"AlarmID":123,"AIERuleID":123,"Status":123,"RetryCount":123,"LastDxTimestamp":"string","DateInserted":"string","AlarmGuid":"string","WebConsoleId":"string","NotificationSent":true,"AIEMsgXml":"string","EventID":123,"NormalMessageDate":"string","RuleBlocks":[{}]},"statusCode":123,"statusMessage":"string","responseMessage":"string"}

Get Drill-Down Summary

Return drill-down summary information per rule block for a specific AIE alarm ID in LogRhythm. The alarm must be from an AIE rule with Auto Drilldown enabled.

Endpoint

URL: lr-drilldown-cache-api/drilldown/{{alarmId}}/summary

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alarmId	number	Required	An alarm ID to initiate an AI Engine drill down.

Input Example

{"path_parameters":{"alarmId":10}}

Output

Parameter	Type	Description
DrilldownSummary	object	Output field: DrilldownSummary
DrilldownSummary.RuleBlockID	number	The Rule Block ID associated with the AI Engine rule that triggered the alarm.
DrilldownSummary.DDSummaries	array	Output field: DrilldownSummary.DDSummaries
DrilldownSummary.DDSummaries.SummaryFieldType	string	A mapping of Summary Field type.
DrilldownSummary.DDSummaries.DrillDownSummaries	string	A set of log counts based on the Summary Field criteria.
statusCode	number	Status value
statusMessage	string	Status value
responseMessage	string	Response message

Output Example

{"DrilldownSummary":{"RuleBlockID":123,"DDSummaries":[{}]},"statusCode":123,"statusMessage":"string","responseMessage":"string"}

Search Alarms

Search and retrieve alarm details in LogRhythm using various filter criteria.

Endpoint

URL: lr-alarm-api/alarms

Method: GET

Input

Argument Name	Type	Required	Description
parameters.offset	number	Optional	The number of items to skip before starting to collect the result set.
parameters.count	number	Optional	The numbers of items to return.
parameters.orderby	string	Optional	Field name on which we want to sort the result.
parameters.dir	string	Optional	Provide order direction either ascending or descending.
parameters.alarmRuleName	string	Optional	Provide alarm rule name to get the result
parameters.alarmStatus	string	Optional	Can provide enum value in string or number format [New = 0, Opened = 1, Working = 2, Escalated = 3, Closed = 4, Closed_FalseAlarm = 5, Closed_Resolved = 6, Closed_Unresolved = 7, Closed_Reported = 8, Closed_Monitor = 9]
parameters.entityName	string	Optional	Filter result by entity name.
parameters.Notification	string	Optional	Filter result by notification.
parameters.caseAssociation	string	Optional	Filter result by case associated to the alarm.
parameters.dateInserted	string	Optional	Filter result by date inserted.

Input Example

{"parameters":{"offset":123,"count":123,"orderby":"string","dir":"string","alarmRuleName":"Example Name","alarmStatus":"active","entityName":"Example Name","Notification":"string","caseAssociation":"string","dateInserted":"string"}}

Output

Parameter	Type	Description
statusCode	number	Status value
statusMessage	string	Status value
responseMessage	string	Response message
alarmsSearchDetails	array	Output field: alarmsSearchDetails
alarmsSearchDetails.alarmId	number	Unique identifier
alarmsSearchDetails.alarmRuleName	string	Name of the resource
alarmsSearchDetails.alarmStatus	string	Status value
alarmsSearchDetails.alarmDataCached	string	Response data
alarmsSearchDetails.associatedCases	array	Output field: alarmsSearchDetails.associatedCases
alarmsSearchDetails.entityName	string	Name of the resource
alarmsSearchDetails.dateInserted	string	Output field: alarmsSearchDetails.dateInserted

Output Example

{"statusCode":123,"statusMessage":"string","responseMessage":"string","alarmsSearchDetails":[]}

Search Results

Retrieve indexed results from LogRhythm's web indexer using TaskId as input.

Endpoint

URL: lr-search-api/actions/search-result

Method: POST

Input

Argument Name	Type	Required	Description
data	object	Optional	Response data
data.searchGuid	string	Optional	This is a GUID field. It accepts TaskId returned from Search Task.
data.search	object	Optional	Response data
data.search.sort	array	Optional	Response data
data.search.sort.fieldName	string	Optional	Response data
data.search.sort.order	string	Optional	Response data
data.search.fields	array	Optional	Response data
data.paginator	object	Optional	Response data
data.paginator.origin	number	Optional	Response data
data.paginator.page_size	number	Optional	Response data

Input Example

{"data":{"searchGuid":"string","search":{"sort":[{"fieldName":"Example Name","order":"string"}],"fields":["string"]},"paginator":{"origin":123,"page_size":123}}}

Search Task

Initiate a search for logs or events in LogRhythm and receive TaskId and TaskStatus. Use the returned task details as input for subsequent tasks.

Endpoint

URL: lr-search-api/actions/search-task

Method: POST

Input

Argument Name	Type	Required	Description
maxMsgsToQuery	number	Optional	Parameter for Search Task
queryTimeout	number	Optional	Parameter for Search Task
searchMode	string	Optional	Parameter for Search Task
dateCriteria	object	Optional	Parameter for Search Task
dateCriteria.dateMin	string	Optional	Parameter for Search Task
dateCriteria.dateMax	string	Optional	Parameter for Search Task
dateCriteria.useInsertedDate	boolean	Optional	Date value
dateCriteria.lastIntervalValue	number	Optional	Value for the parameter
dateCriteria.lastIntervalUnit	string	Optional	Parameter for Search Task
queryLogSources	array	Optional	Parameter for Search Task
logSourceIds	array	Optional	Unique identifier
queryFilter	object	Optional	Parameter for Search Task
queryFilter.msgFilterType	number	Optional	Type of the resource
queryFilter.filterGroup	object	Optional	Parameter for Search Task
queryFilter.filterGroup.filterItemType	number	Optional	Type of the resource
queryFilter.filterGroup.fieldOperator	number	Optional	Parameter for Search Task
queryFilter.filterGroup.filterMode	number	Optional	Parameter for Search Task
queryFilter.filterGroup.filterGroupOperator	number	Optional	Parameter for Search Task
queryFilter.filterGroup.filterItems	array	Optional	Parameter for Search Task
queryFilter.filterGroup.filterItems.filterItemType	number	Optional	Type of the resource
queryFilter.filterGroup.filterItems.fieldOperator	number	Optional	Parameter for Search Task
queryFilter.filterGroup.filterItems.filterMode	number	Optional	Parameter for Search Task
queryFilter.filterGroup.filterItems.filterType	number	Optional	Type of the resource
queryFilter.filterGroup.filterItems.values	array	Optional	Value for the parameter
queryFilter.filterGroup.filterItems.values.filterType	string	Optional	Type of the resource

Input Example

{"maxMsgsToQuery":123,"queryTimeout":123,"searchMode":"string","dateCriteria":{"dateMin":"string","dateMax":"string","useInsertedDate":true,"lastIntervalValue":123,"lastIntervalUnit":"string"},"queryLogSources":[123],"logSourceIds":[123],"queryFilter":{"msgFilterType":123,"filterGroup":{"filterItemType":123,"fieldOperator":123,"filterMode":123,"filterGroupOperator":123,"filterItems":[{"filterItemType":123,"fieldOperator":123,"filterMode":123,"filterType":123,"values":[],"name":"Example Name"}]}},"queryEventManager":true}

Output

Parameter	Type	Description
taksId	number	Unique identifier
taskStatus	string	Status value
responseMessage	string	Response message
statusMessage	string	Status value
statusCode	number	Status value

Output Example

{"taksId":123,"taskStatus":"string","responseMessage":"string","statusMessage":"string","statusCode":123}

Update Alarm Comment

Update the AlarmHistory table in LogRhythm by adding comments to the Comments column using the supplied AlarmId. Returns a 404 error if the AlarmId does not exist.

Endpoint

URL: lr-alarm-api/alarms/{{alarmId}}/comment

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.alarmId	number	Required	Parameters for the Update Alarm Comment action
alarmComment	string	Optional	Parameter for Update Alarm Comment

Input Example

{"path_parameters":{"alarmId":10}}

Output

Parameter	Type	Description
statusCode	number	Status value
statusMessage	string	Status value
responseMessage	string	Response message

Output Example

{"statusCode":123,"statusMessage":"string","responseMessage":"string"}

Update Alarm Status

Update the status and RBP of an alarm in LogRhythm using the specified alarmId. Returns a 404 error if the ID does not exist; otherwise, updates the AlarmHistory table.

Endpoint

URL: lr-alarm-api/alarms/{{alarmId}}

Method: PATCH

Input

Argument Name	Type	Required	Description
path_parameters.alarmId	number	Required	Parameters for the Update Alarm Status action
alarmStatus	string	Optional	Status value
rBP	number	Optional	Parameter for Update Alarm Status

Input Example

{"path_parameters":{"alarmId":10}}

Output

Parameter	Type	Description
statusCode	number	Status value
statusMessage	string	Status value
responseMessage	string	Response message

Output Example

{"statusCode":123,"statusMessage":"string","responseMessage":"string"}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT