Skip to main content
Skip table of contents

LogRhythm Rest

Overview

LogRhythm's SIEM Platform delivers comprehensive security analytics, log management, network and endpoint monitoring for rapid detection, response, and neutralization of threats. D3's integration with the LogRhythm latest REST API (version 7.8) provides the ability to ingest alarm, update alarm, and admin operations.

D3 SOAR is providing REST operations to function with LogRhythm Rest.

LogRhythm Rest is available for use in:

D3 SOAR

V14.0.582+

Category

SIEM XDR

Deployment Options

Option I, Option III

Connection

To connect to LogRhythm Rest from D3 SOAR, please follow this part to collect the required information below:

Parameter

Description

Example

Server URL

The server URL of the LogRhythm instance to connect to.

https://<Replace.Me>:8501

API Token

The API token to authenticate the connection.

********

Permission Requirements

Each endpoint in the LogRhythm Rest API requires a certain permission scope. The following are required scopes for the commands in this integration:

Refer to Configuring LogRhythm Rest to Work with D3 SOAR for the required permissions to configure in the user profile. Currently, all commands are compatible with several administrative roles in LogRhythm, including Global Administrator, Restricted Administrator, Global Analyst, and Restricted Analyst. However, LogRhythm's official documentation states that only the Global Administrator and Restricted Administrator roles have the required permissions to do so.

Therefore, while the Restricted Analyst role may be functional for the minimum requirement, LogRhythm's documentation actually specifies that the Restricted Administrator role is required.

For more information, see Generate LR API Token from LogRhythm's documentation.

Configuring LogRhythm Rest to Work with D3 SOAR

Creating a User Profile

  1. Log in to the LogRhythm console as a Global Administrator.

  2. Navigate to Tools > Administration > User Profile Manager.

  3. Click +New, then Allow Access.

  4. Enter a name for the user profile, then navigate to Security Role and select either Restrict Administrator or Global Administrator. If you opt for Restrict Administrator, make sure to visit the Entities tab (second tab) and select the specific entities you need access to. Choosing Global Administrator grants access to all entities automatically, so there is no need to specify them separately.

  5. Navigate to the Management Permissions tab. Assign permissions as listed below:

    • Entities > Display / Manage Entities: Set to View.

    • General Administration > Deployment Manager: Set to View.

    • General Administration > Manage TrueIdentity: Set to Manage.

For more information about user profiles, see Generate LR API Token from LogRhythm's documentation.

Creating a Person

  1. Navigate to Deployment Manager, then People. Right-click and select New.

  2. Fill in the required information for the new user and click OK to proceed.

  3. You will now see the newly created user listed. Note that the 'login' field is currently (none), which we will address in the next steps.

  4. Right-click on the user's name and select Create User Account.

  5. Start by assigning a username for the user login. Then, link the login to the profile of the user you just created. Next, select the appropriate default entity for this user. Finally, set a secure password for the account and click OK to complete the process.

  6. The user account is now fully set up and ready for use.

Generating an API Token

  1. Select Deployment Manager from the main toolbar, then select the Third Party Applications tab. In the grid area, right-click and choose New to open the 3rd-Party Application Properties dialog.

  2. Input the Application Name and Description. The application name must be unique. Note the Token Expiry in Days—important for token renewal before expiration. This value can be modified later. Click OK to save your application.

  3. The Client ID and secret are auto-generated by the system. You need to see both generated to proceed to the next step. If you do not see the client secret after creation, refresh the page.

  4. Right-click your new application and select Properties or double-click the application you created. You can optionally adjust the token validity period. Click Generate Token to open the Credentials dialog.

  5. Input a user name and password, then click OK. This generates a token.

  6. Copy and store the token in a secure location. You won't see it again. It will be used for the API Token parameter when configuring the integration connection in D3 SOAR.

Configuring D3 SOAR to Work with LogRhythm Rest

  1. Log in to D3 SOAR.

  2. Find the LogRhythm Rest integration.

    1. Navigate to Configuration on the top header menu.

    2. Click on the Integration icon on the left sidebar.

    3. Type LogRhythm Rest in the search box to find the integration, then click it to select it.

    4. Click + Connection, on the right side of the Connections section. A new connection window will appear.

  3. Configure the following fields to create a connection to LogRhythm Rest.

    1. Connection Name: The desired name for the connection.

    2. Site: Specifies the site to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all sites defined as internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.

    3. Recipient site for events from connections Shared to Internal Sites: This field appears if you selected Share to Internal Sites for Site to let you select the internal site to deploy the integration connection.

    4. Agent Name (Optional): Specifies the proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.

    5. Description (Optional): Add your desired description for the connection.

    6. Tenant (Optional): When configuring the connection from a master tenant site, you have the option to choose the specific tenant sites you want to share the connection with. Once you enable this setting, you can filter and select the desired tenant sites from the dropdowns to share the connection.

    7. Configure User Permissions: Defines which users have access to the connection.

    8. Active: Check the tick box to ensure the connection is available for use.

    9. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
      1. Input the Server URL. The default value is https://<Replace.Me>:8501.
      2. Input the API Token. Refer to Generating an API Token for instructions on obtaining a token.

    10. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Please refer to the password vault connection guide if needed.

    11. Connection Health Check: Updates the connection status you have created. A connection health check is done by scheduling the Test Connection command of this integration. This can only be done when the connection is active.
      To set up a connection health check, check the Connection Health Check tickbox. You can customize the interval (minutes) for scheduling the health check. An email notification can be set up after a specified number of failed connection attempts.

  4. Test the connection.

    1. Click Test Connection to verify the account credentials and network connection. If the Test Connection Passed alert window appears, the test connection is successful. You will see Passed with a green checkmark appear beside the Test Connection button. If the test connection fails, please check your connection parameters and try again.

    2. Click OK to close the alert window.

    3. Click + Add to create and add the configured connection.

Commands

LogRhythm Rest includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command, you can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the LogRhythm Rest API, please refer to the links below:

Reader Note

Certain permissions are required for each command. Please refer to the Permission Requirements and Configuring LogRhythm Rest to Work with D3 SOAR for details.

Note for Time-related parameters

The input format of time-related parameters may vary based on your account settings. As a result, the sample data provided in our commands is different from what you see. To set your preferred time format, follow these steps:

  1. Navigate to Configuration > Application Settings. Select Date/Time Format.

  2. Choose your desired date and time format.

After that, you will be able to view your preferred time format when configuring the DateTime input parameters for commands.

Fetch Event

Retrieves alarms from the Logrhythm platform based on the specified criteria. In cases where the command is scheduled to gather events from a specified Start Time, set the Order By parameter to "Date Inserted" and the Direction parameter to "Ascending". This configuration prevents the command from only fetching the most recent alarms.

Input

Input Parameter

Required/Optional

Description

Example

Start Time

Required

The start time of the time range to fetch alarms, in UTC format.

2021-01-05 00:00

Number of Event(s) Fetched

Optional

The maximum number of events (alarms) to return. If this parameter is not defined or set to a non-positive number, the default value of 20 will be used. The maximum permissible value is 100.

2

Alarm Rule Name

Optional

The full alarm rule name to filter retrieved alarms.

AIE: Test Rule - Calc.exe

Entity Name

Optional

The full entity name to filter retrieved alarms.

AIE: Test Rule - Calc.exe

Alarm Status

Optional

The alarm status to filter retrieved alarms.

Opened

Order By

Optional

The value (i.e. Alarm Rule Name, Alarm Status, Date Inserted, or Entity Name) by which to sort retrieved records. When scheduling a job, use the Date Inserted sorting option to ensure that each schedule retrieves new alarms. The default setting is Date Inserted.

DateInserted

Direction

Optional

The direction (i.e. Ascending or Descending) to sort retrieved records. When scheduling a job, use the Ascending sorting option to ensure that each schedule retrieves new alarms. The default setting is Descending.

Descending

Including Events

Optional

The option to include alarm-related events in the response data, when set to True.

False

Output

Raw Data

The primary response data from the API request.

D3 customizes the Raw Data by adding the "alarmStatusName" field.

SAMPLE DATA

JSON 
{
 "alarmsSearchDetails": [
  {
   "alarmId": *****,
   "alarmRuleName": "AIE: Test Rule - Calc.exe",
   "alarmStatus": 1,
   "alarmStatusName": "Opened",
   "alarmDataCached": "Y",
   "associatedCases": ["***-***-***-***-***"],
   "entityName": "Global Entity",
   "dateInserted": "1/20/2021 6:26:41 PM",
   "rBPMax": 79,
   "rBPAvg": 47,
  }
 ],
 "alarmsCount": 1,
 "statusCode": 200,
 "statusMessage": "OK",
 "responseMessage": "Success"
}
Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE 
{
    "AlarmIDs": "\"[*****]\"",
    "AlarmRuleNames": "\"[\\\"AIE: Test Rule - Calc.exe\\\"]\"",
    "AlarmStatusNames": "\"[\\\"Opened\\\"]\"",
    "AlarmStatuses": "\"[1]\"",
    "EntityNames": "\"[\\\"Global Entity\\\"]\"",
    "MaxRiskBasedPriorityscores": "\"[79]\"",
    "AverageRiskBasedPriorityscores": "\"[47]\""
}
Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

  • A connection issue with the integration

  • The API returned an error message

  • No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE 
Successful
Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

ALARMID

ALARMRULENAME

ALARMSTATUS

ALARMSTATUSNAME

ALARMDATACACHED

ASSOCIATEDCASES

ENTITYNAME

DATEINSERTED

RBPMAX

RBPAVG

***

AIE: Test Rule - Calc.exe

1

Opened

Y

['***-***-***-***-***']

Global Entity

1/20/2021 6:26:41 PM

79

47

Fetch Event Field Mapping

Please note that Fetch Event commands require event field mapping. Field mapping plays a key role in the data normalization process part of the event pipeline. Field mapping converts the original data fields from the different providers to the D3 fields which are standardized by the D3 Model. Please refer to Event and Incident Intake Field Mapping for details.

To customize field mapping, click + Add Field and add the custom field of your choice. You can also remove built-in field mappings by clicking x. Please note that two underscore characters will automatically prefix the defined Field Name as the System Name for a custom field mapping. Additionally, if an input Field Name contains any spaces, they will automatically be replaced with underscores for the corresponding System Name.

As a system integration, the LogRhythm Rest integration has some pre-configured field mappings for default field mapping.

  • Default Event Source
    The Default Event Source is the default set of field mappings that are applied when this fetch event command is executed. For out-of-the-box integrations, you will find a set of field mapping provided by the system. Default event source provides field mappings for common fields from fetched events. The default event source has a “Main Event JSON Path” (i.e., $.alarmsSearchDetails) that is used to extract a batch of events from the response raw data. Click Edit Event Source to view the “Main Event JSON Path”.

    • Main Event JSON Path: $.alarmsSearchDetails
      The Main Event JSON Path determines the root path where the system starts parsing raw response data into D3 event data. The JSON path begins with $, representing the root element. The path is formed by appending a sequence of child elements to $, each separated by a dot (.). Square brackets with nested quotation marks ([‘...’]) should be used to separate child elements in JSON arrays.
      For example, the root node of a JSON Path is alarmsSearchDetails. The child node denoting the Event Key field would be alarmId. Putting it together, the JSON Path expression to extract the Event Key is $.alarmsSearchDetails.alarmId.

The pre-configured field mappings are detailed below:

Field Name

Source Field

Unique Event Key

.alarmId

Event Type

.alarmRuleName

Start Time

.dateInserted

Status

.alarmStatus

Reader Note

The Unique Event Key field mapping is used to prevent duplicate event ingestions. D3 SOAR will check if the value of a selected JSON path matches any Unique Event Key of previously ingested events. If a match is found, the event will be dismissed. If no match is found, an event will be created. However, if no Unique Event Key is mapped, then the hash value from the event pending ingestion will be used to check for any matches with existing events. If no match is found, the event will be created.

Unlike most other D3 SOAR integrations, the LogRhythm Rest integration’s Fetch Event command’s Default Event Source mapping does not include Unique Event Key in order to fetch the same fetched alarm with multiple updates.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Fetch Event failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the LogRhythm Rest portal. Refer to the HTTP Status Code Registry for details.

Status Code: 400.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: The value for parameter (Number of Event(s) Fetched) is invalid.

Error Sample Data

Fetch Event failed.

Status Code: 400.

Message: The value for parameter (Number of Event(s) Fetched) is invalid.

Get Alarm Events

Returns all events associated with the given alarm IDs.

Reader Note

The parameter Alarm IDs is required to run this command.

  • Run the Fetch Event command to obtain Alarm IDs. Alarm IDs can be found in the returned raw data at the path $.alarmsSearchDetails[*].alarmId.

Input

Input Parameter

Required/Optional

Description

Example

Alarm IDs

Required

The IDs of the alarms to retrieve events. Alarm IDs can be obtained using the Fech Event command.

[1*****]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON 
[
    {
        "alarmsEventDetails": [
            {
                "account": "",
                "action": "",
                "amount": "",
                "bytesIn": "",
                "bytesOut": "",
                "classificationId": *****,
                "classificationName": "Suspicious",
                "classificationTypeName": "Security",
                "command": "",
                "commonEventId": *****,
                "cve": "",
                "commonEventName": "AIE: Test Rule - Calc.exe",
                "count": 1,
                "directionId": 0,
                "directionName": "Unknown",
                "domain": "",
                "duration": 0,
                "entityId": -*****,
                "entityName": "",
                "group": "",
                "impactedEntityId": -*****,
                "impactedEntityName": "Global Entity",
                "impactedHostId": -1,
                "impactedHostName": "",
                "impactedInterface": "",
                "impactedIP": "",
                "impactedLocation": {
                    "countryCode": "",
                    "name": "",
                    "latitude": 0,
                    "locationId": 0,
                    "locationKey": "",
                    "longitude": 0,
                    "parentLocationId": 0,
                    "recordStatus": "Deleted",
                    "regionCode": "",
                    "type": null,
                    "dateUpdated": "1/1/0001 12:00:00 AM"
                },
                "impactedMAC": "",
                "impactedName": "",
                "impactedNATIP": "",
                "impactedNATPort": "",
                "impactedNetwork": {
                    "beginIPRange": "",
                    "dateUpdated": "1/1/0001 12:00:00 AM",
                    "riskThreshold": "",
                    "endIPRange": "",
                    "entityId": 0,
                    "hostZone": "Unknown",
                    "locationId": 0,
                    "longDesc": "",
                    "name": "",
                    "networkId": 0,
                    "recordStatus": "Deleted",
                    "shortDesc": ""
                },
                "impactedPort": -1,
                "impactedZone": "Unknown",
                "itemsPacketsIn": 0,
                "itemsPacketsOut": 0,
                "logDate": "1/20/2021 6:26:54 PM",
                "login": "",
                "logMessage": "<_0 FactCount=\"1\" NormalMsgDate=\"2021-01-20 18:26:54\" NormalMsgDateLower=\"2021-01-20 18:26:54\" NormalMsgDateUpper=\"2021-01-20 18:26:55\" Process=\"calc.exe\" RuleBlockType=\"1\" /><_AIERuleID=\"*****\" DateEdited=\"2020-12-17 17:42:59\" />",
                "logSourceHostId": -*****,
                "logSourceHostName": "AI Engine Server",
                "logSourceName": "AI Engine",
                "logSourceTypeName": "LogRhythm AI Engine",
                "messageId": *****,
                "mpeRuleId": -1,
                "mpeRuleName": "",
                "normalDateMax": "1/1/0001 12:00:00 AM",
                "objectName": "",
                "objectType": "",
                "originEntityId": -100,
                "originEntityName": "Global Entity",
                "originHostId": -1,
                "originHostName": "",
                "originInterface": "",
                "originIP": "",
                "originLocation": {
                    "countryCode": "",
                    "name": "",
                    "latitude": 0,
                    "locationId": 0,
                    "locationKey": "",
                    "longitude": 0,
                    "parentLocationId": 0,
                    "recordStatus": "Deleted",
                    "regionCode": "",
                    "type": null,
                    "dateUpdated": "1/1/0001 12:00:00 AM"
                },
                "originMAC": "",
                "originName": "",
                "originNATIP": "",
                "originNATPort": "",
                "originNetwork": {
                    "beginIPRange": "",
                    "dateUpdated": "1/1/0001 12:00:00 AM",
                    "riskThreshold": "",
                    "endIPRange": "",
                    "entityId": 0,
                    "hostZone": "Unknown",
                    "locationId": 0,
                    "longDesc": "",
                    "name": "",
                    "networkId": 0,
                    "recordStatus": "Deleted",
                    "shortDesc": ""
                },
                "originPort": -1,
                "originZone": "Unknown",
                "parentProcessId": "",
                "parentProcessName": "",
                "parentProcessPath": "",
                "policy": "",
                "priority": 24,
                "process": "calc.exe",
                "processId": 9,
                "protocolId": -1,
                "protocolName": "",
                "quantity": 0,
                "rate": 0,
                "reason": "",
                "recipient": "",
                "result": "",
                "responseCode": "",
                "sender": "",
                "session": "",
                "sessionType": "",
                "serialNumber": "",
                "serviceId": -1,
                "serviceName": "",
                "severity": "",
                "status": "",
                "size": 0,
                "subject": "",
                "threatId": "",
                "threatName": "",
                "url": "",
                "userAgent": "",
                "vendorInfo": "",
                "vendorMsgId": "",
                "version": "",
                "originUserIdentityName": "",
                "impactedUserIdentityName": "",
                "originUserIdentityId": "",
                "impactedUserIdentityId": "",
                "senderIdentityId": "",
                "senderIdentityName": "",
                "recipientIdentityId": "",
                "recipientIdentityName": ""
            }
        ],
        "eventsCount": 1,
        "statusCode": 200,
        "statusMessage": "OK",
        "responseMessage": "Success"
    }
]
Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE 
{
    "EventIDs": "\"[*****]\"",
    "EventNames": "\"[\\\"AIE: Test Rule - *****.exe\\\"]\"",
    "Severities": "\"[\\\"medium\\\"]\"",
    "ImpactedEntityNames": "\"[\\\"Global Entity\\\"]\"",
    "LogSourceHostIds": "\"[-*****]\""
}
Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

  • A connection issue with the integration

  • The API returned an error message

  • No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE 
Successful
Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

ACCOUNT

ACTION

AMOUNT

BYTESIN

BYTESOUT

CLASSIFICATIONID

CLASSIFICATIONNAME

CLASSIFICATIONTYPENAME

COMMAND

COMMONEVENTID

CVE

COMMONEVENTNAME

COUNT

DIRECTIONID

DIRECTIONNAME

DOMAIN

DURATION

ENTITYID

ENTITYNAME

GROUP

IMPACTEDENTITYID

IMPACTEDENTITYNAME

IMPACTEDHOSTID

IMPACTEDHOSTNAME

IMPACTEDINTERFACE

IMPACTEDIP

IMPACTEDLOCATION

IMPACTEDMAC

IMPACTEDNAME

IMPACTEDNATIP

IMPACTEDNATPORT

IMPACTEDNETWORK

IMPACTEDPORT

IMPACTEDZONE

ITEMSPACKETSIN

ITEMSPACKETSOUT

LOGDATE

LOGIN

LOGMESSAGE

LOGSOURCEHOSTID

LOGSOURCEHOSTNAME

LOGSOURCENAME

LOGSOURCETYPENAME

MESSAGEID

MPERULEID

MPERULENAME

NORMALDATEMAX

OBJECTNAME

OBJECTTYPE

ORIGINENTITYID

ORIGINENTITYNAME

ORIGINHOSTID

ORIGINHOSTNAME

ORIGININTERFACE

ORIGINIP

ORIGINLOCATION

ORIGINMAC

ORIGINNAME

ORIGINNATIP

ORIGINNATPORT

ORIGINNETWORK

ORIGINPORT

ORIGINZONE

PARENTPROCESSID

PARENTPROCESSNAME

PARENTPROCESSPATH

POLICY

PRIORITY

PROCESS

PROCESSID

PROTOCOLID

PROTOCOLNAME

QUANTITY

RATE

REASON

RECIPIENT

RESULT

RESPONSECODE

SENDER

SESSION

SESSIONTYPE

SERIALNUMBER

SERVICEID

SERVICENAME

SEVERITY

STATUS

SIZE

SUBJECT

THREATID

THREATNAME

URL

USERAGENT

VENDORINFO

VENDORMSGID

VERSION

ORIGINUSERIDENTITYNAME

IMPACTEDUSERIDENTITYNAME

ORIGINUSERIDENTITYID

IMPACTEDUSERIDENTITYID

SENDERIDENTITYID

SENDERIDENTITYNAME

RECIPIENTIDENTITYID

RECIPIENTIDENTITYNAME

2200

Suspicious

Security

***

AIE: Test Rule - Calc.exe

1

0

Unknown

0

-1000001

-100

Global Entity

-1

{'countryCode': '', 'name': '', 'latitude': 0, 'locationId': 0, 'locationKey': '', 'longitude': 0, 'parentLocationId': 0, 'recordStatus': 'Deleted', 'regionCode': '', 'type': None, 'dateUpdated': '1/1/0001 12:00:00 AM'}

{'beginIPRange': '', 'dateUpdated': '1/1/0001 12:00:00 AM', 'riskThreshold': '', 'endIPRange': '', 'entityId': 0, 'hostZone': 'Unknown', 'locationId': 0, 'longDesc': '', 'name': '', 'networkId': 0, 'recordStatus': 'Deleted', 'shortDesc': ''}

-1

Unknown

0

0

1/20/2021 6:26:54 PM

<_0 FactCount="1" NormalMsgDate="2021-01-20 18:26:54" NormalMsgDateLower="2021-01-20 18:26:54" NormalMsgDateUpper="2021-01-20 18:26:55" Process="calc.exe" RuleBlockType="1" /><_AIERuleID="1000000002" DateEdited="2020-12-17 17:42:59" />

-1000001

AI Engine Server

AI Engine

LogRhythm AI Engine

***

-1

1/1/0001 12:00:00 AM

-100

Global Entity

-1

{'countryCode': '', 'name': '', 'latitude': 0, 'locationId': 0, 'locationKey': '', 'longitude': 0, 'parentLocationId': 0, 'recordStatus': 'Deleted', 'regionCode': '', 'type': None, 'dateUpdated': '1/1/0001 12:00:00 AM'}

{'beginIPRange': '', 'dateUpdated': '1/1/0001 12:00:00 AM', 'riskThreshold': '', 'endIPRange': '', 'entityId': 0, 'hostZone': 'Unknown', 'locationId': 0, 'longDesc': '', 'name': '', 'networkId': 0, 'recordStatus': 'Deleted', 'shortDesc': ''}

-1

Unknown

24

calc.exe

9

-1

0

0

-1

0

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Get Alarm Events failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the LogRhythm Rest portal. Refer to the HTTP Status Code Registry for details.

Status Code: 404.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Alarm does not exist for the supplied AlarmId.

Error Sample Data

Get Alarm Events failed.

Status Code: 404.

Message: Alarm does not exist for the supplied AlarmId.

List Entities

Returns all entities that match the specified criteria.

Input

Input Parameter

Required/Optional

Description

Example

Entity Name

Optional

The partial or full entity name to filter retrieved entities.

AI

Limit

Optional

The maximum number of entities to return. If this parameter is not defined or set to a non-positive number, the default value of 20 will be used. The maximum permissible value is 1000.

10

Offset

Optional

The number of items to skip before starting to collect the result set. If this parameter is not defined or set to a non-positive number, the default value of 0 will be used.

1

Order By

Optional

The value (i.e., ID or Name) by which to sort retrieved records. The default setting is ID.

ID

Direction

Optional

The direction (i.e. Ascending or Descending) to sort retrieved records. The default setting is Ascending.

Ascending

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON 
[
    {
        "id": ***,
        "name": "Primary Site",
        "fullName": "Primary Site",
        "recordStatusName": "Active",
        "shortDesc": "This entity was created by the deployment wizard as a default Entity.  The name and properties can be changed.",
        "dateUpdated": "2021-03-21T01:41:16.607Z"
    },
    {
        "id": -***,
        "name": "Global Entity",
        "fullName": "Global Entity",
        "recordStatusName": "Active",
        "shortDesc": "Global entity containing shared network and host records",
        "dateUpdated": "2021-03-06T20:11:30.78Z"
    }
]
Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE 
{
    "EntityIDs": "\"[***, -***]\"",
    "EntityNames": "\"[\\\"Primary Site\\\", \\\"Global Entity\\\"]\""
}
Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

  • A connection issue with the integration

  • The API returned an error message

  • No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE 
Successful
Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

ID

NAME

FULLNAME

RECORDSTATUSNAME

SHORTDESC

DATEUPDATED

***

Primary Site

Primary Site

Active

This entity was created by the deployment wizard as a default Entity. The name and properties can be changed.

2021-03-21T01:41:16.607Z

-***

Global Entity

Global Entity

Active

Global entity containing shared network and host records

2021-03-06T20:11:30.78Z

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

List Entities failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the LogRhythm Rest portal. Refer to the HTTP Status Code Registry for details.

Status Code: 400.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: The value for parameter (Limit) is invalid.

Error Sample Data

List Entities failed.

Status Code: 400.

Message: The value for parameter (Limit) is invalid.

List Log Sources

Returns a summary of all accepted log sources.

Input

Input Parameter

Required/Optional

Description

Example

Source Name

Optional

The name of the log source to filter returned records. The input must be a prefix (e.g. AI) or the complete name of the source (e.g. AI Engine).

AI

Status

Optional

The log source status (i.e., All, Active or Retired) to filter returned records. The default setting is All.

All

Description

Optional

The segment of the description to filter returned records. The input must be a prefix (e.g. CS) or the complete name of the source (e.g. CS Falcon).

description

Limit

Optional

The maximum number of records to return. If this parameter is not defined or set to a non-positive number, the default value of 20 will be used. The maximum permissible value is 1000.

10

Offset

Optional

The number of items to skip before starting to collect the result set. If this parameter is not defined or set to a non-positive number, the default value of 0 will be used.

1

Order By

Optional

The value (i.e., ID or Name) by which to sort retrieved records. The default setting is ID.

ID

Direction

Optional

The direction (i.e. Ascending or Descending) to sort retrieved records. The default setting is Ascending.

Ascending

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON 
[
    {
        "id": -*****,
        "systemMonitorId": -*****,
        "name": "AI Engine",
        "host": {
            "id": -*****,
            "name": "AI Engine Server"
        },
        "entity": {
            "id": -*****,
            "name": "Global Entity"
        },
        "logSourceType": {
            "id": -*****,
            "name": "LogRhythm AI Engine"
        },
        "mpePolicy": {},
        "recordStatus": "Active",
        "status": "Enabled",
        "isVirtual": False,
        "logMartMode": *****,
        "isLoadBalanced": False,
        "mpeProcessingMode": "EventForwardingEnabled",
        "isArchivingEnabled": False,
        "maxMsgCount": 0,
        "defMsgTTLValue": 0,
        "dateUpdated": "2020-05-15T18:59:42.953Z",
        "isSilentLogSourceEnabled": False,
        "cryptoMode": 0,
        "signMode": 0,
        "defMsgTTL": 0,
        "defMsgArchiveMode": "Override_NoArchive",
        "msgPerCycle": 0,
        "collectionDepth": 0,
        "udlaStateFieldType": "Increment",
        "recursionDepth": 0,
        "isDirectory": False,
        "inclusions": "''",
        "exclusions": "''",
        "compressionType": "none",
        "collectionThreadTimeout": 120,
        "virtualSourceSortOrder": 0,
        "virtualSourceCatchAllID": -1,
        "persistentConnection": False,
        "autoAcceptanceRuleId": "",
        "maxLogDate": "1900-01-01T00:00:00Z"
    }
]
Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE 
{
    "SourceIDs": "\"[-*****]\"",
    "SourceNames": "\"[\\\"AI Engine\\\"]\"",
    "SourceStatuses": "\"[\\\"Active\\\"]\""
}
Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

  • A connection issue with the integration

  • The API returned an error message

  • No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE 
Successful
Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

ID

SYSTEMMONITORID

NAME

HOST

ENTITY

LOGSOURCETYPE

MPEPOLICY

RECORDSTATUS

STATUS

ISVIRTUAL

LOGMARTMODE

ISLOADBALANCED

MPEPROCESSINGMODE

ISARCHIVINGENABLED

MAXMSGCOUNT

DEFMSGTTLVALUE

DATEUPDATED

ISSILENTLOGSOURCEENABLED

CRYPTOMODE

SIGNMODE

DEFMSGTTL

DEFMSGARCHIVEMODE

MSGPERCYCLE

COLLECTIONDEPTH

UDLASTATEFIELDTYPE

RECURSIONDEPTH

ISDIRECTORY

INCLUSIONS

EXCLUSIONS

COMPRESSIONTYPE

COLLECTIONTHREADTIMEOUT

VIRTUALSOURCESORTORDER

VIRTUALSOURCECATCHALLID

PERSISTENTCONNECTION

AUTOACCEPTANCERULEID

MAXLOGDATE

-*****

-*****

AI Engine

{'id': -*****, 'name': 'AI Engine Server'}

{'id': -*****, 'name': 'Global Entity'}

{'id': -*****, 'name': 'LogRhythm AI Engine'}

{}

Active

Enabled

False

1*****

False

EventForwardingEnabled

False

0

0

2020-05-15T18:59:42.953Z

False

0

0

0

Override_NoArchive

0

0

Increment

0

False

'

'

none

1*****

0

-1

False

1900-01-01T00:00:00Z

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

List Log Sources failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the LogRhythm Rest portal. Refer to the HTTP Status Code Registry for details.

Status Code: 400.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: The value for parameter (Limit) is invalid.

Error Sample Data

List Log Sources failed.

Status Code: 400.

Message: The value for parameter (Limit) is invalid.

Update Alarms

Updates the status and risk-based priority score for the specified alarms.

Reader Note

The parameter Alarm IDs is required to run this command.

  • Run the Fetch Event command to obtain Alarm IDs. Alarm IDs can be found in the returned raw data at the path $.alarmsSearchDetails[*].alarmId.

Input

Input Parameter

Required/Optional

Description

Example

Alarm IDs

Required

The IDs of the alarms to update. Alarm IDs can be obtained using the Fech Event command.

[1*****]

Alarm Status

Optional

The updated status for the alarms. The default status is None.

Opened

Risk-Based Priority Score

Required

The updated risk-based priority score (1-100) for the alarms.

60

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON 
[
    {
        "alarmID": 1*****,
        "message": "Alarm updated successfully."
    }
]
Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

  • A connection issue with the integration

  • The API returned an error message

  • No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE 
Successful
Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

ALARMID

MESSAGE

1*****

Alarm updated successfully.

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Update Alarms failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the LogRhythm Rest portal. Refer to the HTTP Status Code Registry for details.

Status Code: 404.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Alarm does not exist for the supplied AlarmId.

Error Sample Data

Update Alarms failed.

Status Code: 404.

Message: Alarm does not exist for the supplied AlarmId.

Test Connection

Allows you to perform a health check on an integration connection. You can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.

Input

N/A

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

  • A connection issue with the integration

  • The API returned an error message

  • No response from the API

You can view more details about an error in the Error tab.

SAMPLE DATA

CODE 
Successful

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Test Connection failed. Failed to check the connector.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the LogRhythm Rest portal. Refer to the HTTP Status Code Registry for details.

Status Code: 400.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Bad Request.

Error Sample Data

Test Connection failed. Failed to check the connector.

Status Code: 400.

Message: Bad Request.

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.

Contact Support Close