Logrhythm Axon
LogRhythm Axon is a cloud-native security operations platform that enhances threat detection and response capabilities.
LogRhythm Axon is a comprehensive security operations platform designed to streamline case management and incident response. By integrating with Swimlane Turbine, users can automate the creation, updating, and retrieval of security cases and activities, enhancing the efficiency of security operations. This integration empowers security teams to manage cases seamlessly, update statuses, and retrieve detailed activity logs, all within a low-code environment, reducing manual effort and accelerating response times.
The Swimlane Logrhythm Axon - SIEM connector integrates with Swimlane to do the Case Management (create, update, retrieve and search for cases).
Prerequisites
Before you can use the LogRhythm Axon connector for Turbine, you'll need access to the LogRhythm Axon API. This requires the following:
- an API key authentication using the following parameters:
- URL: The endpoint URL for accessing LogRhythm Axon's API services.
- API Key: A unique key provided by LogRhythm for authenticating API requests.
Capabilities
The Swimlane Logrhythm Axon SIEM connector has the following capabilities:
- Create a Case
- Create an Activity
- Change Status For Multiple Cases
- Search for cases in a tenant using a string
- Retrieve Activity Entries
- Retrieve all the cases for a tenant
- Retrive all cases for tenant
- Retrieve an activity by id for a tenant
- Update a Activity Description
- Update a Activity
- Update a case
API Keys
Analysts are able to manage API keys from their profile, authorizing third-party software to connect with Axon.
To manage API keys, from the Dashboard:
- In the upper right corner, click the User Menu icon. Click My Account. The My Account page appears. Click the API Keys tab. A list of the user's API keys appears. Add New API Key To add a new API key, from the API Keys tab:
- Click + Add New API Key in the top-right corner. The Add New API Key pop-up appears. Enter a descriptive, unique API Key Name for this new API key. Click Generate Key. The Copy API Key pop-up appears. Click the copy icon to copy the generated API key.
- Save the key in a secure location for your records. Generated API keys are not able to be retrieved once this window is closed.
- Click the Copy and Close button. The pop-up closes and the new API key is added to the list.
Authorization
To authorize an Axon API request, you must use an Axon API Key in the Authorization header of your request. For instructions on how to get an Axon API Key, see API Keys.
The Authorization header should not have a prefix. For example:
Authorization: abcd_1234-efghijk-567-lmno-8910pqr
Notes
Axion Case API Documentation: https://docs.logrhythm.com/axon/docs/axon-case-management-api-endpoints
Additional Documentation
Configurations
Logrhythm Axon API Key Authentication
Authenticates using an API Key
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
Authorization | API key | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Change Status For Multiple Cases
Update the status, severity, and add comments to multiple cases in LogRhythm Axon. Requires tenantId, status, severity, and comment.
Endpoint
- URL: /case-management-svc/v1/tenants/{{tenantId}}/cases
- Method: PUT
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.tenantId | string | Required | Parameters for the Change Status For Multiple Cases action |
status | string | Optional | Status value |
severity | string | Optional | Parameter for Change Status For Multiple Cases |
ownerId | string | Optional | Unique identifier |
description | string | Optional | Parameter for Change Status For Multiple Cases |
comment | string | Optional | Parameter for Change Status For Multiple Cases |
caseIds | string | Optional | Unique identifier |
Input Example
{"json_body":{"status":"NEW","severity":"CRITICAL","ownerId":"de4e","description":"description","comment":"comment","caseIds":"dew234"},"path_parameters":{"tenantId":"lrcxc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
computed | object | Output field: computed |
computed.additionalProp1 | object | Output field: computed.additionalProp1 |
computed.additionalProp2 | object | Output field: computed.additionalProp2 |
computed.additionalProp3 | object | Output field: computed.additionalProp3 |
requestId | string | Unique identifier |
error | object | Error message if any |
error.status | number | Status value |
error.message | string | Response message |
error.validationFailures | array | Unique identifier |
error.validationFailures.field | string | Unique identifier |
error.validationFailures.message | string | Unique identifier |
status | string | Status value |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"computed":{"additionalProp1":{},"additionalProp2":{},"additionalProp3":{}},"requestId":"string","error":{"status":0,"message":"string","validationFailures":[]},"status":"OK"}}
Create a Case
Create a new case in LogRhythm Axon using the specified tenant ID, name, status, and severity.
Endpoint
- URL: /case-management-svc/v1/tenants/{{tenantId}}/cases
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.tenantId | string | Required | Parameters for the Create a Case action |
ownerUserId | string | Optional | Unique identifier |
name | string | Optional | Name of the resource |
description | string | Optional | Parameter for Create a Case |
incident | boolean | Optional | Unique identifier |
valid | boolean | Optional | Unique identifier |
status | string | Optional | Status value |
severity | string | Optional | Parameter for Create a Case |
observationName | string | Optional | Name of the resource |
collaborators | array | Optional | Parameter for Create a Case |
collaborators.collaboratorId | string | Required | Unique identifier |
Input Example
{"json_body":{"ownerUserId":"123456789","name":"Phishing from Sweden","description":"Possible phishing attempt from Sweden","incident":true,"valid":true,"status":"IN_PROGRESS","severity":"CRITICAL","observationName":"string","collaborators":[{"collaboratorId":"11223344"}]},"path_parameters":{"tenantId":"8zCDJVS~csLeIYhR9nXq.Pg6MYmsdr"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
id | string | Unique identifier |
tenantId | string | Unique identifier |
createdOn | string | Output field: createdOn |
updatedOn | string | Output field: updatedOn |
ownerUserId | string | Unique identifier |
number | number | Output field: number |
name | string | Name of the resource |
description | string | Output field: description |
incident | boolean | Unique identifier |
valid | boolean | Unique identifier |
status | string | Status value |
severity | string | Output field: severity |
observationName | string | Name of the resource |
createdBy | string | Output field: createdBy |
updatedBy | string | Output field: updatedBy |
firstLogDate | string | Date value |
lastLogDate | string | Date value |
collaborators | array | Output field: collaborators |
collaborators.tenantId | string | Unique identifier |
collaborators.id | string | Unique identifier |
collaborators.createdOn | string | Output field: collaborators.createdOn |
collaborators.updatedOn | string | Output field: collaborators.updatedOn |
collaborators.caseId | string | Unique identifier |
Output Example
{"id":"12345678-1234-1234-1234-123456789abc","tenantId":"string","createdOn":"string","updatedOn":"string","ownerUserId":"string","number":123,"name":"Example Name","description":"string","incident":true,"valid":true,"status":"active","severity":"string","observationName":"Example Name","createdBy":"string","updatedBy":"string"}
Create an Activity
Generate a new activity in LogRhythm Axon linked to a specific case, requiring tenantId, caseId, description, and type.
Endpoint
- URL: /case-management-svc/v1/tenants/{{tenantId}}/activities
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.tenantId | string | Required | tenantID |
caseId | string | Optional | Unique identifier |
description | string | Optional | Parameter for Create an Activity |
queryFilter | string | Optional | Parameter for Create an Activity |
type | string | Optional | Type of the resource |
logs | array | Optional | Parameter for Create an Activity |
logs.logId | string | Required | Unique identifier |
attachments | array | Optional | Parameter for Create an Activity |
attachments.name | string | Required | Name of the resource |
attachments.location | string | Required | Parameter for Create an Activity |
Input Example
{"json_body":{"caseId":"123456789","description":"Details of the event","queryFilter":"Details of the event","type":"COMMENT | LOG | ATTACHMENT","logs":[{"logId":"123456789"}],"attachments":[{"name":"File Name","location":"File Location"}]},"path_parameters":{"tenantId":"8zCDJVS~csLeIYhR9nXq.Pg6MYmsdr"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
id | string | Unique identifier |
tenantId | string | Unique identifier |
createdOn | string | Output field: createdOn |
updatedOn | string | Output field: updatedOn |
activityId | string | Unique identifier |
comment | string | Output field: comment |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"8zCDJVS~csLeIYhR9nXq.Pg6MYmsdr","tenantId":"string","createdOn":"2023-12-26T05:41:41.544Z","updatedOn":"2023-12-26T05:41:41.544Z","activityId":"123456789","comment":"Details of the event"}}
Retrieve Activity Entries
Retrieve all activity entries associated with a given case and tenant in LogRhythm Axon. Requires caseId and tenantId as path parameters.
Endpoint
- URL: /case-management-svc/v1/tenants/{{tenantId}}/activities/byCaseId/{{caseId}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.caseId | string | Required | Parameters for the Retrieve Activity Entries action |
path_parameters.tenantId | string | Required | Parameters for the Retrieve Activity Entries action |
parameters.afterId | string | Optional | Parameters for the Retrieve Activity Entries action |
parameters.limit | number | Optional | Parameters for the Retrieve Activity Entries action |
parameters.sort | string | Optional | Parameters for the Retrieve Activity Entries action |
Input Example
{"parameters":{"afterId":"0f54a194-d75a-4a60-8c68-d4b8e66c971c","limit":10,"sort":"asc"},"path_parameters":{"caseId":"ders","tenantId":"lrcxc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
computed | object | Output field: computed |
computed.additionalProp1 | object | Output field: computed.additionalProp1 |
computed.additionalProp2 | object | Output field: computed.additionalProp2 |
computed.additionalProp3 | object | Output field: computed.additionalProp3 |
requestId | string | Unique identifier |
error | object | Error message if any |
error.status | number | Status value |
error.message | string | Response message |
error.validationFailures | array | Unique identifier |
error.validationFailures.field | string | Unique identifier |
error.validationFailures.message | string | Unique identifier |
status | string | Status value |
paginationInfo | object | Output field: paginationInfo |
paginationInfo.totalCount | number | Count value |
paginationInfo.nextPage | string | Output field: paginationInfo.nextPage |
content | array | Response content |
content.tenantId | string | Unique identifier |
content.id | string | Unique identifier |
content.createdOn | string | Response content |
content.updatedOn | string | Response content |
content.caseId | string | Unique identifier |
content.description | string | Response content |
content.queryFilter | string | Response content |
Output Example
{"computed":{"additionalProp1":{},"additionalProp2":{},"additionalProp3":{}},"requestId":"string","error":{"status":123,"message":"string","validationFailures":[{}]},"status":"active","paginationInfo":{"totalCount":123,"nextPage":"string"},"content":[{"tenantId":"string","id":"12345678-1234-1234-1234-123456789abc","createdOn":"string","updatedOn":"string","caseId":"string","description":"string","queryFilter":"string","type":"string","createdBy":"string","updatedBy":"string","firstLogDate":"stri...
Retrieve all the cases for a tenant
Retrieve all cases associated with a specified tenant ID in LogRhythm Axon. Requires tenantId as a path parameter.
Endpoint
- URL: /case-management-svc/v1/tenants/{{tenantId}}/cases
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.tenantId | string | Required | The identifier of the tenant |
parameters.afterId | string | Optional | Parameters for the Retrieve all the cases for a tenant action |
parameters.limit | string | Optional | Parameters for the Retrieve all the cases for a tenant action |
parameters.sort | string | Optional | Parameters for the Retrieve all the cases for a tenant action |
Input Example
{"parameters":{"afterId":"0f54a194-d75a-4a60-8c68-d4b8e66c971c","limit":"10","sort":"field:asc"},"path_parameters":{"tenantId":"8zCDJVS~csLeIYhR9nXq.Pg6MYmsdr"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
computed | object | Output field: computed |
computed.additionalProp1 | object | Output field: computed.additionalProp1 |
computed.additionalProp2 | object | Output field: computed.additionalProp2 |
computed.additionalProp3 | object | Output field: computed.additionalProp3 |
requestId | string | Unique identifier |
error | object | Error message if any |
error.status | number | Status value |
error.message | string | Response message |
error.validationFailures | array | Unique identifier |
error.validationFailures.field | string | Unique identifier |
error.validationFailures.message | string | Unique identifier |
status | string | Status value |
paginationInfo | object | Output field: paginationInfo |
paginationInfo.totalCount | number | Count value |
paginationInfo.nextPage | string | Output field: paginationInfo.nextPage |
content | array | Response content |
content.tenantId | string | Unique identifier |
content.id | string | Unique identifier |
content.createdOn | string | Response content |
content.updatedOn | string | Response content |
content.ownerUserId | string | Unique identifier |
content.number | number | Response content |
content.name | string | Name of the resource |
Output Example
{"computed":{"additionalProp1":{},"additionalProp2":{},"additionalProp3":{}},"requestId":"string","error":{"status":123,"message":"string","validationFailures":[{}]},"status":"active","paginationInfo":{"totalCount":123,"nextPage":"string"},"content":[{"tenantId":"string","id":"12345678-1234-1234-1234-123456789abc","createdOn":"string","updatedOn":"string","ownerUserId":"string","number":123,"name":"Example Name","description":"string","incident":true,"valid":true,"status":"active","severity":"st...
Retrieve an activity by id for a tenant
Retrieve details of a specific activity by its ID for a given tenant in LogRhythm Axon, requiring both 'id' and 'tenantId'.
Endpoint
- URL: /case-management-svc/v1/tenants/{{tenantId}}/activities/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.tenantId | string | Required | The identifier of the tenant |
path_parameters.id | string | Required | The system identifier for this object |
Input Example
{"path_parameters":{"tenantId":"8zCDJVS~csLeIYhR9nXq.Pg6MYmsdr","id":"qO0KZV3omJLq75A"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
computed | object | Output field: computed |
computed.additionalProp1 | object | Output field: computed.additionalProp1 |
computed.additionalProp2 | object | Output field: computed.additionalProp2 |
computed.additionalProp3 | object | Output field: computed.additionalProp3 |
requestId | string | Unique identifier |
error | object | Error message if any |
error.status | number | Status value |
error.message | string | Response message |
error.validationFailures | array | Unique identifier |
error.validationFailures.field | string | Unique identifier |
error.validationFailures.message | string | Unique identifier |
status | string | Status value |
content | object | Response content |
content.tenantId | string | Unique identifier |
content.id | string | Unique identifier |
content.createdOn | string | Response content |
content.updatedOn | string | Response content |
content.caseId | string | Unique identifier |
content.description | string | Response content |
content.queryFilter | string | Response content |
content.type | string | Type of the resource |
content.createdBy | string | Response content |
content.updatedBy | string | Response content |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"computed":{"additionalProp1":{},"additionalProp2":{},"additionalProp3":{}},"requestId":"string","error":{"status":0,"message":"string","validationFailures":[]},"status":"OK","content":{"tenantId":"string","id":"gTK-6p8CQBQaowSl2_2yqcm_UZEwxmTFz","createdOn":"2023-12-27T05:41:31.122Z","updatedOn":"2023-12-27T05:41:31.122Z","caseId":"123456789","description":"Details of the event","queryFilter":"Details of the event","type":"COMM...
Retrive all cases for tenant
Retrieve all cases for a specified tenant in LogRhythm Axon, with options to filter by severity or status. Requires tenantId as a path parameter.
Endpoint
- URL: /case-management-svc/v1/tenants/{{tenantId}}/cases/byStatusAndPriorityAndOwnerPattern
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.tenantId | string | Required | Parameters for the Retrive all cases for tenant action |
parameters.afterId | string | Optional | Parameters for the Retrive all cases for tenant action |
parameters.limit | number | Optional | Parameters for the Retrive all cases for tenant action |
parameters.ownerEmail | string | Optional | Parameters for the Retrive all cases for tenant action |
parameters.severity | string | Optional | Parameters for the Retrive all cases for tenant action |
parameters.sort | string | Optional | Parameters for the Retrive all cases for tenant action |
parameters.status | string | Optional | Parameters for the Retrive all cases for tenant action |
Input Example
{"parameters":{"afterId":"0f54a194-d75a-4a60-8c68-d4b8e66c971c","limit":10,"ownerEmail":"%road_runn%","severity":"CRIT","sort":"field:asc","status":"CLO"},"path_parameters":{"tenantId":"lrcxc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
requestId | string | Unique identifier |
paginationInfo | object | Output field: paginationInfo |
paginationInfo.nextPage | string | Output field: paginationInfo.nextPage |
content | array | Response content |
content.tenantId | string | Unique identifier |
content.id | string | Unique identifier |
content.createdOn | string | Response content |
content.updatedOn | string | Response content |
content.ownerUserId | string | Unique identifier |
content.number | number | Response content |
content.name | string | Name of the resource |
content.description | string | Response content |
content.incident | boolean | Unique identifier |
content.valid | boolean | Unique identifier |
content.status | string | Status value |
content.severity | string | Response content |
content.createdBy | string | Response content |
content.updatedBy | string | Response content |
content.createdByEmail | string | Response content |
content.updatedByEmail | string | Response content |
content.observationName | string | Name of the resource |
content.observation | string | Response content |
content.firstLogDate | string | Response content |
Output Example
{"requestId":"string","paginationInfo":{"nextPage":"string"},"content":[{"tenantId":"string","id":"12345678-1234-1234-1234-123456789abc","createdOn":"string","updatedOn":"string","ownerUserId":"string","number":123,"name":"Example Name","description":"string","incident":true,"valid":true,"status":"active","severity":"string","createdBy":"string","updatedBy":"string","createdByEmail":"string"}]}
Search for cases in a tenant using a string
Perform a search for cases within a specified tenant in LogRhythm Axon using given search criteria, including tenant ID and search criteria parameters.
Endpoint
- URL: /case-management-svc/v1/tenants/{{tenantId}}/cases/search
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.tenantId | string | Required | Parameters for the Search for cases in a tenant using a string action |
parameters.afterId | string | Optional | Parameters for the Search for cases in a tenant using a string action |
parameters.caseStatus | string | Optional | Parameters for the Search for cases in a tenant using a string action |
parameters.searchCriteria | string | Required | Parameters for the Search for cases in a tenant using a string action |
parameters.limit | string | Optional | Parameters for the Search for cases in a tenant using a string action |
parameters.sort | string | Optional | Parameters for the Search for cases in a tenant using a string action |
Input Example
{"parameters":{"afterId":"0f54a194-d75a-4a60-8c68-d4b8e66c971c","caseStatus":"open or all","searchCriteria":"%feb%","limit":10,"sort":"field:asc"},"path_parameters":{"tenantId":"8zCDJVS~csLeIYhR9nXq.Pg6MYmsdr"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
computed | object | Output field: computed |
computed.additionalProp1 | object | Output field: computed.additionalProp1 |
computed.additionalProp2 | object | Output field: computed.additionalProp2 |
computed.additionalProp3 | object | Output field: computed.additionalProp3 |
requestId | string | Unique identifier |
error | object | Error message if any |
error.status | number | Status value |
error.message | string | Response message |
error.validationFailures | array | Unique identifier |
error.validationFailures.field | string | Unique identifier |
error.validationFailures.message | string | Unique identifier |
status | string | Status value |
paginationInfo | object | Output field: paginationInfo |
paginationInfo.totalCount | number | Count value |
paginationInfo.nextPage | string | Output field: paginationInfo.nextPage |
content | array | Response content |
content.tenantId | string | Unique identifier |
content.id | string | Unique identifier |
content.createdOn | string | Response content |
content.updatedOn | string | Response content |
content.ownerUserId | string | Unique identifier |
content.number | number | Response content |
content.name | string | Name of the resource |
Output Example
{"computed":{"additionalProp1":{},"additionalProp2":{},"additionalProp3":{}},"requestId":"string","error":{"status":123,"message":"string","validationFailures":[{}]},"status":"active","paginationInfo":{"totalCount":123,"nextPage":"string"},"content":[{"tenantId":"string","id":"12345678-1234-1234-1234-123456789abc","createdOn":"string","updatedOn":"string","ownerUserId":"string","number":123,"name":"Example Name","description":"string","incident":true,"valid":true,"status":"active","severity":"st...
Update a Activity
Update an activity in LogRhythm Axon using specific IDs and details such as caseId, description, and type.
Endpoint
- URL: /case-management-svc/v1/tenants/{{tenantId}}/activities/{{id}}
- Method: PUT
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.tenantId | string | Required | The identifier of the tenant |
path_parameters.id | string | Required | The system identifier for this object |
caseId | string | Optional | Unique identifier |
description | string | Optional | Parameter for Update a Activity |
queryFilter | string | Optional | Parameter for Update a Activity |
type | string | Optional | Type of the resource |
logs | array | Optional | Parameter for Update a Activity |
logs.logId | string | Required | Unique identifier |
attachments | array | Optional | Parameter for Update a Activity |
attachments.name | string | Required | Name of the resource |
attachments.location | string | Required | Parameter for Update a Activity |
Input Example
{"json_body":{"caseId":"123456789","description":"Details of the event","queryFilter":"Details of the event","type":"COMMENT | LOG | ATTACHMENT","logs":[{"logId":"123456789"}],"attachments":[{"name":"File Name","location":"File Location"}]},"path_parameters":{"tenantId":"8zCDJVS~csLeIYhR9nXq.Pg6MYmsdr","id":"qO0KZV3omJLq75A"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
computed | object | Output field: computed |
computed.additionalProp1 | object | Output field: computed.additionalProp1 |
computed.additionalProp2 | object | Output field: computed.additionalProp2 |
computed.additionalProp3 | object | Output field: computed.additionalProp3 |
requestId | string | Unique identifier |
error | object | Error message if any |
error.status | number | Status value |
error.message | string | Response message |
error.validationFailures | array | Unique identifier |
error.validationFailures.field | string | Unique identifier |
error.validationFailures.message | string | Unique identifier |
status | string | Status value |
content | object | Response content |
content.id | string | Unique identifier |
content.tenantId | string | Unique identifier |
content.createdOn | string | Response content |
content.updatedOn | string | Response content |
content.caseId | string | Unique identifier |
content.description | string | Response content |
content.queryFilter | string | Response content |
content.type | string | Type of the resource |
content.createdBy | string | Response content |
content.updatedBy | string | Response content |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"computed":{"additionalProp1":{},"additionalProp2":{},"additionalProp3":{}},"requestId":"string","error":{"status":0,"message":"string","validationFailures":[]},"status":"OK","content":{"id":"--HvIoX","tenantId":"string","createdOn":"2023-12-27T06:02:43.005Z","updatedOn":"2023-12-27T06:02:43.005Z","caseId":"123456789","description":"Details of the event","queryFilter":"Details of the event","type":"COMMENT | LOG | ATTACHMENT","c...
Update a Activity Description
Update the description of an activity in LogRhythm Axon using specified 'id' and 'tenantId'.
Endpoint
- URL: /case-management-svc/v1/tenants/{{tenantId}}/activities/{{id}}
- Method: PATCH
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.tenantId | string | Required | Parameters for the Update a Activity Description action |
path_parameters.id | string | Required | Parameters for the Update a Activity Description action |
Input Example
{"path_parameters":{"tenantId":"8zCDJVS~csLeIYhR9nXq.Pg6MYmsdr","id":"123456789"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
computed | object | Output field: computed |
computed.additionalProp1 | object | Output field: computed.additionalProp1 |
computed.additionalProp2 | object | Output field: computed.additionalProp2 |
computed.additionalProp3 | object | Output field: computed.additionalProp3 |
requestId | string | Unique identifier |
error | object | Error message if any |
error.status | number | Status value |
error.message | string | Response message |
error.validationFailures | array | Unique identifier |
error.validationFailures.field | string | Unique identifier |
error.validationFailures.message | string | Unique identifier |
status | string | Status value |
content | object | Response content |
content.id | string | Unique identifier |
content.tenantId | string | Unique identifier |
content.createdOn | string | Response content |
content.updatedOn | string | Response content |
content.caseId | string | Unique identifier |
content.description | string | Response content |
content.queryFilter | string | Response content |
content.type | string | Type of the resource |
content.createdBy | string | Response content |
content.updatedBy | string | Response content |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"computed":{"additionalProp1":{},"additionalProp2":{},"additionalProp3":{}},"requestId":"string","error":{"status":0,"message":"string","validationFailures":[]},"status":"OK","content":{"id":"XxS1jZd","tenantId":"string","createdOn":"2023-12-27T06:55:29.980Z","updatedOn":"2023-12-27T06:55:29.980Z","caseId":"123456789","description":"Details of the event","queryFilter":"Details of the event","type":"COMMENT | LOG | ATTACHMENT","c...
Update a Case
Update a specific case in LogRhythm Axon using ID and tenantId, modifying attributes like name, status, severity, and creator.
Endpoint
- URL: /case-management-svc/v1/tenants/{{tenantId}}/cases/{{id}}
- Method: PUT
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Update a Case action |
path_parameters.tenantId | string | Required | Parameters for the Update a Case action |
ownerUserId | string | Optional | Unique identifier |
name | string | Optional | Name of the resource |
description | string | Optional | Parameter for Update a Case |
incident | boolean | Optional | Unique identifier |
valid | boolean | Optional | Unique identifier |
status | string | Optional | Status value |
severity | string | Optional | Parameter for Update a Case |
createdBy | string | Optional | Parameter for Update a Case |
observationName | string | Optional | Name of the resource |
collaborators | array | Optional | Parameter for Update a Case |
collaborators.collaboratorId | string | Optional | Unique identifier |
Input Example
{"json_body":{"ownerUserId":"123456789","name":"Phishing from Sweden","description":"Possible phishing attempt from Sweden","incident":true,"valid":true,"status":"IN_PROGRESS","severity":"CRITICAL","createdBy":"a913a019-3d35-44cb-b444-5abc993b4195","observationName":"string","collaborators":[{"collaboratorId":"11223344"}]},"path_parameters":{"id":"515c5526-4ddd-4de1-bc5c-950052320bc4","tenantId":"lrcxc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
computed | object | Output field: computed |
computed.additionalProp1 | object | Output field: computed.additionalProp1 |
computed.additionalProp2 | object | Output field: computed.additionalProp2 |
computed.additionalProp3 | object | Output field: computed.additionalProp3 |
requestId | string | Unique identifier |
error | object | Error message if any |
error.status | number | Status value |
error.message | string | Response message |
error.validationFailures | array | Unique identifier |
error.validationFailures.field | string | Unique identifier |
error.validationFailures.message | string | Unique identifier |
status | string | Status value |
content | object | Response content |
content.tenantId | string | Unique identifier |
content.id | string | Unique identifier |
content.createdOn | string | Response content |
content.updatedOn | string | Response content |
content.ownerUserId | string | Unique identifier |
content.number | number | Response content |
content.name | string | Name of the resource |
content.description | string | Response content |
content.incident | boolean | Unique identifier |
content.valid | boolean | Unique identifier |
Output Example
{"computed":{"additionalProp1":{},"additionalProp2":{},"additionalProp3":{}},"requestId":"string","error":{"status":123,"message":"string","validationFailures":[{}]},"status":"active","content":{"tenantId":"string","id":"12345678-1234-1234-1234-123456789abc","createdOn":"string","updatedOn":"string","ownerUserId":"string","number":123,"name":"Example Name","description":"string","incident":true,"valid":true,"status":"active","severity":"string","observationName":"Example Name","createdBy":"strin...
Response Headers
Header | Description | Example |
|---|---|---|
content-length | The length of the response body in bytes | 5428 |
content-security-policy | HTTP response header: content-security-policy | frame-ancestors 'self'; |
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |
permissions-policy | HTTP response header: permissions-policy | camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), usb=() |
referrer-policy | HTTP response header: referrer-policy | same-origin |
server | Information about the software used by the origin server | istio-envoy |
strict-transport-security | HTTP response header: strict-transport-security | max-age=31536000; includeSubDomains |
x-content-type-options | HTTP response header: x-content-type-options | nosniff |
x-dns-prefetch-control | HTTP response header: x-dns-prefetch-control | off |
x-download-options | HTTP response header: x-download-options | noopen |
x-envoy-upstream-service-time | HTTP response header: x-envoy-upstream-service-time | 58 |
x-frame-options | HTTP response header: x-frame-options | SAMEORIGIN |
x-xss-protection | HTTP response header: x-xss-protection | 1; mode=block |