LogRhythmRest v2
LogRhythm Pack.#
This Integration is part of theSupported versions
Supported Cortex XSOAR versions: 5.5.0 and later.
LogRhythm security intelligence. This integration was integrated and tested with version 7.7 of LogRhythm Rest API. Previous versions that have been declared EOL by the vendor, are not supported.
Some changes have been made that might affect your existing content. If you are upgrading from a previous of this integration, see Breaking Changes.
#
Configure LogRhythmRest v2 on Cortex XSOARNavigate to Settings > Integrations > Servers & Services.
Search for LogRhythmRest v2.
Click Add instance to create and configure a new integration instance.
Parameter Required Server URL True API Token True Fetch incidents False Incidents Fetch Interval False First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days) False Incident type False Alarms max fetch False Cases max fetch False Fetch incidents from type True Alarm status filter False Alarm rule name filter False Case tags filter False Case status filter False Case priority filter False Fetch case evidences False Use system proxy settings False Trust any certificate (not secure) False Click Test to validate the URLs, token, and connection.
#
CommandsYou can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
#
lr-alarms-listGets the details of the alarms using the filter criteria.
#
Base Commandlr-alarms-list
#
InputArgument Name | Description | Required |
---|---|---|
alarm_status | The alarm status. Possible values: "New", "Opened", "Working", "Escalated", Closed, "Closed_FalseAlarm", "Closed_Resolved", "Closed_Unresolved", "Closed_Reported", "Closed_Monitor". Possible values are: New, Opened, Working, Escalated, Closed, Closed_FalseAlarm, Closed_Resolved, Closed_Unresolved, Closed_Reported, Closed_Monitor. | Optional |
offset | The number of alarms to skip before starting to collect the result set. Default is 0. | Optional |
count | The numbers of alarms to return. Default is 50. | Optional |
alarm_rule_name | Filter by alarm rule name. | Optional |
entity_name | Filter by entity name. | Optional |
alarm_id | Filter by alarm ID. | Optional |
case_association | Filter by case ID. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.Alarm.alarmId | Number | The alarm ID. |
LogRhythm.Alarm.alarmDataCached | String | A flag indicating whether the alarm data is cached. |
LogRhythm.Alarm.alarmRuleName | String | The alarm rule name. |
LogRhythm.Alarm.alarmStatus | String | The alarm status |
LogRhythm.Alarm.dateInserted | Date | The alarm date inserted. |
LogRhythm.Alarm.entityName | String | The alarm entity name. |
LogRhythm.Alarm.associatedCases | String | The alarm associated cases. |
#
Command Example!lr-alarms-list count=2 alarm_status=Opened
#
Context Example#
Human Readable Output#
Alarms
Alarm Id Alarm Status Associated Cases Alarm Rule Name Date Inserted Entity Name Alarm Data Cached 882 Opened 7C2A040E-3014-41D5-ADF0-164A202D3518,
5FAA1AFB-5453-4FF7-92F8-28222A586368,
0795BCB1-28AA-4C3F-9739-B5431AE4004BLogRhythm Agent Heartbeat Missed 2021-10-13T09:13:20.103 EchoTestEntity N 334 Opened 15E63C0A-91EC-49E6-9694-32A432DD657E,
CCB51B6F-083D-442F-8E3F-67BD797A6B52,
10F65BB5-8B49-42FF-862E-ABDEDF1BA7DE,
C52E0A86-D894-4424-A7A6-EE152B232146,
58437431-2117-4982-A2B1-FDEC2F083A43LogRhythm Agent Heartbeat Missed 2021-08-29T11:30:48.083 EchoTestEntity N
#
lr-alarm-updateUpdates the alarm status and RBP based on the alarm ID supplied. alarm_status or rbp are required.
#
Base Commandlr-alarm-update
#
InputArgument Name | Description | Required |
---|---|---|
alarm_id | The alarm ID. | Required |
alarm_status | The alarm status. Possible values: "New", "Opened", "Working", "Escalated", Closed, "Closed_FalseAlarm", "Closed_Resolved", "Closed_Unresolved", "Closed_Reported", "Closed_Monitor". Possible values are: New, Opened, Working, Escalated, Closed, Closed_FalseAlarm, Closed_Resolved, Closed_Unresolved, Closed_Reported, Closed_Monitor. | Optional |
rbp | The alarm rbp. | Optional |
#
Context OutputThere is no context output for this command.
#
Command Example!lr-alarm-update alarm_id=200 alarm_status=Closed rbp=100
#
Human Readable OutputAlarm 200 has been updated.
#
lr-alarm-add-commentUpdates the Alarm History table with comments in the Comments column based on the alarm ID supplied.
#
Base Commandlr-alarm-add-comment
#
InputArgument Name | Description | Required |
---|---|---|
alarm_id | The alarm ID. | Required |
alarm_comment | The alarm comment. | Required |
#
Context OutputThere is no context output for this command.
#
Command Example!lr-alarm-add-comment alarm_id=200 alarm_comment=test
#
Human Readable OutputComment added successfully to the alarm 200.
#
lr-alarm-history-listGets the alarm history details by ID and filter criteria.
#
Base Commandlr-alarm-history-list
#
InputArgument Name | Description | Required |
---|---|---|
alarm_id | The alarm ID. | Required |
person_id | Filter by person ID. | Optional |
date_updated | Filter by when the alarm was updated. The returned value will be greater than or equal to the given date. | Optional |
type | Filter by history type. Possible type: "comment", "status", and "rbp". Possible values are: comment, status, rbp. | Optional |
offset | The number of items to skip before starting to collect the result set. Default is 0. | Optional |
count | The numbers of items to return. Default is 50. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.AlarmHistory.alarmId | Number | The alarm ID. |
LogRhythm.AlarmHistory.personId | Number | The ID of the person who edited the alarm (changed status/ added comment, etc.). |
LogRhythm.AlarmHistory.comments | String | The alarm comments. |
LogRhythm.AlarmHistory.dateInserted | Date | The date when the alarm was inserted. |
LogRhythm.AlarmHistory.dateUpdated | Date | The date when the alarm was updated. |
#
Command Example!lr-alarm-history-list alarm_id=200 type=status
#
Context Example#
Human Readable Output#
History for alarm 200
Alarm Id Comments Date Inserted Date Updated Person Id 200 Changed status to: Closed 2021-10-30T20:16:33.673 2021-10-30T20:16:33.673 1 200 Changed status to: Closed 2021-08-31T15:02:00.127 2021-08-31T15:02:00.127 1 200 Changed status to: Working 2021-08-26T05:17:38.19 2021-08-26T05:17:38.19 1 200 Changed status to: Working 2021-08-26T05:15:57.89 2021-08-26T05:15:57.89 1 200 Changed status to: Closed 2021-08-19T15:31:32.68 2021-08-19T15:31:32.68 1 200 Changed status to: Closed: Unresolved 2021-08-19T15:02:08.6 2021-08-19T15:02:08.6 1 200 Changed status to: Closed: Resolved 2021-08-19T15:01:34.403 2021-08-19T15:01:34.403 1 200 Changed status to: Escalated 2021-08-19T15:01:04.353 2021-08-19T15:01:04.353 1 200 Changed status to: Working 2021-08-19T15:00:38.097 2021-08-19T15:00:38.097 1 200 Changed status to: Opened 2021-08-19T15:00:00.247 2021-08-19T15:00:00.247 1 200 Changed status to: New 2021-08-19T14:59:27.707 2021-08-19T14:59:27.707 1 200 Changed status to: Closed: Monitor 2021-08-19T14:58:06.113 2021-08-19T14:58:06.113 1 200 Changed status to: Closed: False Alarm 2021-08-19T14:57:35.607 2021-08-19T14:57:35.607 1 200 Changed status to: Closed 2021-08-19T14:56:36.82 2021-08-19T14:56:36.82 1
#
lr-alarm-events-listGets a list of events for the specified alarm ID. Note: Currently, this command does not work as expected on LogRhythm's side. It always returns a list of one item, even if the given alarm ID is associated with more than one event.
#
Base Commandlr-alarm-events-list
#
InputArgument Name | Description | Required |
---|---|---|
alarm_id | The alarm ID. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.AlarmEvents.alarmId | Number | The alarm ID. |
LogRhythm.AlarmEvents.account | String | The alarm event account. |
LogRhythm.AlarmEvents.action | String | The alarm event action. |
LogRhythm.AlarmEvents.amount | Unknown | The number of events related to the alarm. |
LogRhythm.AlarmEvents.bytesIn | Number | The number of bytes received or input from a device, system, or process. |
LogRhythm.AlarmEvents.bytesOut | Unknown | The number of bytes sent from a device, system, or process. |
LogRhythm.AlarmEvents.classificationId | Number | The alarm event classification ID. |
LogRhythm.AlarmEvents.classificationName | String | The alarm event classification name. |
LogRhythm.AlarmEvents.classificationTypeName | String | The alarm event classification type. |
LogRhythm.AlarmEvents.command | String | The specific command executed that was recorded in the log message. |
LogRhythm.AlarmEvents.commonEventId | Number | The common event name. |
LogRhythm.AlarmEvents.cve | String | The alarm event CVE. |
LogRhythm.AlarmEvents.commonEventName | String | The alarm event name. |
LogRhythm.AlarmEvents.count | Number | The number of alarm events. |
LogRhythm.AlarmEvents.directionId | Number | The direction by ID of the activity between a log’s origin and impacted zones. |
LogRhythm.AlarmEvents.directionName | String | The direction by name of the activity between a log’s origin and impacted zones. Values can be Internal, External, Outbound, Local, or Unknown. |
LogRhythm.AlarmEvents.domain | String | The alarm event domain. |
LogRhythm.AlarmEvents.duration | Number | The alarm event duration. |
LogRhythm.AlarmEvents.entityId | Number | The alarm event entity ID. |
LogRhythm.AlarmEvents.entityName | String | The alarm event entity name. |
LogRhythm.AlarmEvents.group | String | The alarm event group. |
LogRhythm.AlarmEvents.impactedEntityId | Number | The ID of the entity that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedEntityName | String | The name of the entity that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedHostId | Number | The ID of the host that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedHostName | String | The name of the host that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedInterface | String | The interface that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedIP | Unknown | The IP address that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedLocation.countryCode | String | The country code of the location that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedLocation.name | String | The country name of the location that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedLocation.latitude | Number | The latitude of the location that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedLocation.locationId | Number | The ID of the location that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedLocation.locationKey | String | The key of the location that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedLocation.longitude | Number | The longitude of the location that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedLocation.parentLocationId | Number | The parent location ID of the location that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedLocation.recordStatus | String | The record status of the location that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedLocation.regionCode | String | The region code of the location that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedLocation.type | String | The type of the location that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedLocation.dateUpdated | Date | The date the impacted location was last updated. |
LogRhythm.AlarmEvents.impactedMAC | String | The MAC that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedName | String | The name of the event that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedNATIP | String | The NAT IP address that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedNATPort | Unknown | The NAT port that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedNetwork.beginIPRange.value | String | The beginning of the IP range for the network that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedNetwork.dateUpdated | Date | The date the impacted network was last updated. |
LogRhythm.AlarmEvents.impactedNetwork.riskThreshold | String | The risk threshold of the network impacted by the alarm. |
LogRhythm.AlarmEvents.impactedNetwork.endIPRange.value | String | The end of the IP range for the network that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedNetwork.entityId | Number | The ID of the entity for the network that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedNetwork.hostZone | String | The host zone for the network that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedNetwork.locationId | Number | The location ID of the network that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedNetwork.longDesc | String | The long description of the network that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedNetwork.name | String | The name of the network that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedNetwork.networkId | Number | The ID of the network that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedNetwork.recordStatus | String | The status of the record of the network that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedNetwork.shortDesc | String | The short description of the network that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedPort | Number | The port that was impacted by the alarm. |
LogRhythm.AlarmEvents.impactedZone | String | The zone that was impacted by the alarm. |
LogRhythm.AlarmEvents.itemsPacketsIn | Number | Items such as packets received or input from a device, system, or process. |
LogRhythm.AlarmEvents.itemsPacketsOut | Number | Items such as packets sent from a device, system, or process. |
LogRhythm.AlarmEvents.logDate | Date | The event log date. |
LogRhythm.AlarmEvents.login | String | The user associated with the log activity. |
LogRhythm.AlarmEvents.logMessage | String | The event log message. |
LogRhythm.AlarmEvents.logSourceHostId | Unknown | The host ID of the log source of the event. |
LogRhythm.AlarmEvents.logSourceHostName | String | The log source host name. |
LogRhythm.AlarmEvents.logSourceName | String | The log source name. |
LogRhythm.AlarmEvents.logSourceTypeName | String | The log source type. |
LogRhythm.AlarmEvents.messageId | Number | The event message ID. |
LogRhythm.AlarmEvents.mpeRuleId | Number | The event MPE rule ID, |
LogRhythm.AlarmEvents.mpeRuleName | String | The event MPE rule name. |
LogRhythm.AlarmEvents.normalDateMax | Date | If the message is aggregated, the maximum creation date contained in the group of logs. It can be in UTC or user-selected time zone. |
LogRhythm.AlarmEvents.objectName | String | The object name of the event. |
LogRhythm.AlarmEvents.objectType | String | The object type of the event. |
LogRhythm.AlarmEvents.originEntityId | Number | The origin entity ID of the event. |
LogRhythm.AlarmEvents.originEntityName | String | The origin entity name of the event. |
LogRhythm.AlarmEvents.originHostId | Number | The host ID of where the event originated. |
LogRhythm.AlarmEvents.originHostName | String | The host name of where the event originated. |
LogRhythm.AlarmEvents.originInterface | String | The interface of where the event originated. |
LogRhythm.AlarmEvents.originIP | Unknown | The IP address of where the event originated. |
LogRhythm.AlarmEvents.originLocation.countryCode | String | The country code of the location of where the event originated. |
LogRhythm.AlarmEvents.originLocation.name | String | The name of the location of where the event originated. |
LogRhythm.AlarmEvents.originLocation.latitude | Number | The latitude of the location of where the event originated. |
LogRhythm.AlarmEvents.originLocation.locationId | Number | The location ID of the location of where the event originated. |
LogRhythm.AlarmEvents.originLocation.locationKey | String | The location key of where the event originated. |
LogRhythm.AlarmEvents.originLocation.longitude | Number | The longitude of the location of where the event originated. |
LogRhythm.AlarmEvents.originLocation.parentLocationId | Number | The parent location ID of where the event originated. |
LogRhythm.AlarmEvents.originLocation.recordStatus | String | The record status of the location of where the event originated. |
LogRhythm.AlarmEvents.originLocation.regionCode | String | The region code of the location of where the event originated. |
LogRhythm.AlarmEvents.originLocation.type | String | The type of location of where the event originated. |
LogRhythm.AlarmEvents.originLocation.dateUpdated | Date | The date the location of where the event originated was last updated. |
LogRhythm.AlarmEvents.originMAC | String | The MAC address of where the event originated. |
LogRhythm.AlarmEvents.originName | String | The name of where the event originated. |
LogRhythm.AlarmEvents.originNATIP | String | The NAT IP address of where the event originated. |
LogRhythm.AlarmEvents.originNATPort | Unknown | The NAT port of where the event originated. |
LogRhythm.AlarmEvents.originNetwork.beginIPRange.value | String | The beginning address of the IP range of the network where the event originated. |
LogRhythm.AlarmEvents.originNetwork.dateUpdated | Date | The date of the network when the event originate was last updated. |
LogRhythm.AlarmEvents.originNetwork.riskThreshold | String | The risk threshold of the network where the event originated. |
LogRhythm.AlarmEvents.originNetwork.endIPRange.value | String | The end of the IP range for the network where the event originated. |
LogRhythm.AlarmEvents.originNetwork.entityId | Number | The entity ID of the network where the event originated. |
LogRhythm.AlarmEvents.originNetwork.hostZone | String | The host zone of the network where the event originated. |
LogRhythm.AlarmEvents.originNetwork.locationId | Number | The ID of the location of the network where the event originated. |
LogRhythm.AlarmEvents.originNetwork.longDesc | String | The long description of the network where the event originated. |
LogRhythm.AlarmEvents.originNetwork.name | String | The name of the network where the event originated. |
LogRhythm.AlarmEvents.originNetwork.networkId | Number | The ID of the network where the event originated. |
LogRhythm.AlarmEvents.originNetwork.recordStatus | String | The record status of the network where the event originated. |
LogRhythm.AlarmEvents.originNetwork.shortDesc | String | The short description of the network where the event originated. |
LogRhythm.AlarmEvents.originPort | Number | The port where the event originated. |
LogRhythm.AlarmEvents.originZone | String | The zone where the event originated. |
LogRhythm.AlarmEvents.parentProcessId | String | The parent process ID of the event. |
LogRhythm.AlarmEvents.parentProcessName | String | The parent process name of the event. |
LogRhythm.AlarmEvents.parentProcessPath | String | The parent process path of the event. |
LogRhythm.AlarmEvents.policy | String | The event policy. |
LogRhythm.AlarmEvents.priority | Number | The event priority. |
LogRhythm.AlarmEvents.process | String | The event process. |
LogRhythm.AlarmEvents.processId | Number | The event process ID. |
LogRhythm.AlarmEvents.protocolId | Number | The event protocol ID. |
LogRhythm.AlarmEvents.protocolName | String | The event protocol name. |
LogRhythm.AlarmEvents.quantity | Number | The event quantity. |
LogRhythm.AlarmEvents.rate | Number | The event rate. |
LogRhythm.AlarmEvents.reason | String | The event reason. |
LogRhythm.AlarmEvents.recipient | String | The event recipient. |
LogRhythm.AlarmEvents.result | String | The event result. |
LogRhythm.AlarmEvents.responseCode | String | The event response code. |
LogRhythm.AlarmEvents.sender | String | The event sender. |
LogRhythm.AlarmEvents.session | String | The event session. |
LogRhythm.AlarmEvents.sessionType | String | The event session type. |
LogRhythm.AlarmEvents.serialNumber | String | The event serial number. |
LogRhythm.AlarmEvents.serviceId | Number | The event service ID. |
LogRhythm.AlarmEvents.serviceName | String | The event service name. |
LogRhythm.AlarmEvents.severity | String | The event severity. |
LogRhythm.AlarmEvents.status | String | The event status. |
LogRhythm.AlarmEvents.size | Number | The event size. |
LogRhythm.AlarmEvents.subject | String | The event subject. |
LogRhythm.AlarmEvents.threatId | String | The event threat ID. |
LogRhythm.AlarmEvents.threatName | String | The event threat name. |
LogRhythm.AlarmEvents.url | String | The event URL. |
LogRhythm.AlarmEvents.userAgent | String | The event user agent. |
LogRhythm.AlarmEvents.vendorInfo | String | The event vendor info. |
LogRhythm.AlarmEvents.vendorMsgId | String | The event vendor message ID. |
LogRhythm.AlarmEvents.version | String | The alarm event version |
LogRhythm.AlarmEvents.originUserIdentityName | String | The event origin user identity. |
LogRhythm.AlarmEvents.impactedUserIdentityName | String | The event impacted user identity. |
LogRhythm.AlarmEvents.originUserIdentityId | Unknown | The event origin user identity ID. |
LogRhythm.AlarmEvents.impactedUserIdentityId | Unknown | The event impacted user identity ID. |
LogRhythm.AlarmEvents.senderIdentityId | Unknown | The event sender identity ID. |
LogRhythm.AlarmEvents.senderIdentityName | String | The event sender identity name. |
LogRhythm.AlarmEvents.recipientIdentityId | Unknown | The event recipient identity ID. |
LogRhythm.AlarmEvents.recipientIdentityName | String | The event recipient identity. |
#
Command Example!lr-alarm-events-list alarm_id=200
#
Context Example#
Human Readable Output#
Events for alarm 200
Common Event Name Log Message Priority Log Date Impacted Host Id Impacted Zone Service Name Entity Name Classification Name Classification Type Name LogRhythm Agent Heartbeat Missed A heartbeat message from the LogRhythm System Monitor Agent service was not received in the allotted time. 100 2021-08-18T13:05:59.477 3 Internal LogRhythm Agent EchoTestEntity Error Operations
#
lr-alarm-summaryGet the alarm summary by the specified alarm ID.
#
Base Commandlr-alarm-summary
#
InputArgument Name | Description | Required |
---|---|---|
alarm_id | Numeric ID of the alarm to get. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.AlarmSummary.dateInserted | Date | The date the alarm was inserted. |
LogRhythm.AlarmSummary.rbpMax | Number | The alarm rbp max. |
LogRhythm.AlarmSummary.rbpAvg | Number | The alarm rbp average. |
LogRhythm.AlarmSummary.alarmRuleId | Number | The alarm rule ID. |
LogRhythm.AlarmSummary.alarmRuleGroup | String | The alarm rule group. |
LogRhythm.AlarmSummary.briefDescription | String | The alarm brief description. |
LogRhythm.AlarmSummary.additionalDetails | String | The alarm additional details. |
LogRhythm.AlarmSummary.alarmId | Number | The alarm ID. |
LogRhythm.AlarmSummary.alarmEventSummary.msgClassId | Number | The alarm summary message class ID. |
LogRhythm.AlarmSummary.alarmEventSummary.msgClassName | String | The alarm summary message class name. |
LogRhythm.AlarmSummary.alarmEventSummary.commonEventId | Number | The alarm summary common event ID. |
LogRhythm.AlarmSummary.alarmEventSummary.commonEventName | String | The alarm summary common event name. |
LogRhythm.AlarmSummary.alarmEventSummary.originHostId | Number | The alarm summary origin host ID. |
LogRhythm.AlarmSummary.alarmEventSummary.impactedHostId | Number | The alarm summary impacted host ID |
LogRhythm.AlarmSummary.alarmEventSummary.originUser | String | The alarm summary origin user. |
LogRhythm.AlarmSummary.alarmEventSummary.impactedUser | String | The alarm summary impacted user. |
LogRhythm.AlarmSummary.alarmEventSummary.originUserIdentityId | Unknown | The alarm summary origin user identity ID. |
LogRhythm.AlarmSummary.alarmEventSummary.impactedUserIdentityId | Unknown | The alarm summary impacted user identity ID. |
LogRhythm.AlarmSummary.alarmEventSummary.originUserIdentityName | String | The alarm summary origin user identity name. |
LogRhythm.AlarmSummary.alarmEventSummary.impactedUserIdentityName | String | The alarm summary impacted user identity name. |
LogRhythm.AlarmSummary.alarmEventSummary.originEntityName | String | The alarm summary origin entity name. |
LogRhythm.AlarmSummary.alarmEventSummary.impactedEntityName | String | The alarm summary impacted entity name. |
#
Command Example!lr-alarm-summary alarm_id=200
#
Context Example#
Human Readable Output#
Alarm summary
Additional Details Alarm Id Alarm Rule Group Alarm Rule Id Brief Description Date Inserted Rbp Avg Rbp Max Action:
1. Use LogRhythm to analyze and collect all information regarding the alarm, related events/logs, and surrounding logs from affected sources.
2. Check System Monitor service health (try restarting).
3. Check network connectivity between Agent and Mediator.
4. Check scsm.log for errors.
5. If the steps above do not provide a solution or if you require assistance, please contact LogRhythm Support.200 LogRhythm Diagnostics 98 Alarms on the occurrence of a LogRhythm Agent Heartbeat Missed event which could indicate a LogRhythm Agent going down. 2021-08-18T13:05:59.683 100 100 #
Alarm event summary
Common Event Id Common Event Name Impacted Entity Name Impacted Host Id Impacted User Impacted User Identity Id Impacted User Identity Name Msg Class Id Msg Class Name Origin Entity Name Origin Host Id Origin User Origin User Identity Id Origin User Identity Name -1100003 LogRhythm Agent Heartbeat Missed EchoTestEntity 3 3200 Error EchoTestEntity 3
#
lr-alarm-drilldownGets the drill-down logs per rule block for a specific alarm Id that fired associated with an AIE alarm.
#
Base Commandlr-alarm-drilldown
#
InputArgument Name | Description | Required |
---|---|---|
alarm_id | Numeric ID of the alarm to get. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.AlarmDrilldown.AlarmID | Number | The alarm ID. |
LogRhythm.AlarmDrilldown.AIERuleID | Number | The alarm AIE rule ID. |
LogRhythm.AlarmDrilldown.Status.value | Number | The value of the drilldown request. |
LogRhythm.AlarmDrilldown.Status.name | String | The name of the drilldown request. |
LogRhythm.AlarmDrilldown.Status.description | String | The description of the drilldown request. |
LogRhythm.AlarmDrilldown.RetryCount | Number | The number of times the Data Indexer is queried for the drill-down results. |
LogRhythm.AlarmDrilldown.LastDxTimestamp | Date | The timestamp, in UTC, at which the Data Indexer was queried to obtain the drill-down results. |
LogRhythm.AlarmDrilldown.DateInserted | Date | The timestamp, in UTC, when the Alarm was added to the cache. |
LogRhythm.AlarmDrilldown.AlarmGuid | String | The unique identification of the Alarm GUID. |
LogRhythm.AlarmDrilldown.WebConsoleId | String | The unique identification of the Web Console ID. |
LogRhythm.AlarmDrilldown.NotificationSent | Boolean | The unique identification of the Alarm GUID. |
LogRhythm.AlarmDrilldown.AIEMsgXml | String | The message XML associated with the event that triggered by the AI Engine. |
LogRhythm.AlarmDrilldown.EventID | Number | The event ID associated with the AI Engine alarm. |
LogRhythm.AlarmDrilldown.NormalMessageDate | Date | The date, in UTC, that specifies the time of occurrence of the log. |
LogRhythm.AlarmDrilldown.RuleBlocks.RuleBlockID | Number | The Rule Block Id associated with the AI Engine rule that triggered the alarm. |
LogRhythm.AlarmDrilldown.RuleBlocks.RuleBlockTypeID | Number | The type of rule block as specified in the Events Msg XML. |
LogRhythm.AlarmDrilldown.RuleBlocks.DrillDownLogs | String | Logs that triggered the AI Engine rule associated with the rule block. |
LogRhythm.AlarmDrilldown.RuleBlocks.AIECount | Number | The number of logs identified by the AI Engine that triggered the alarm. |
LogRhythm.AlarmDrilldown.RuleBlocks.DXCount | Number | The number of logs stored in the Data Indexer that matched the drill-down criteria. |
LogRhythm.AlarmDrilldown.RuleBlocks.NormalMessageDate | Date | The date, in UTC, that specifies the time of occurence of the log. |
LogRhythm.AlarmDrilldown.RuleBlocks.NormalMessageDateUpper | Date | The date, in UTC, that specifies the upper bound for the rule block triggered. |
LogRhythm.AlarmDrilldown.RuleBlocks.NormalMessageDateLower | Date | The date, in UTC, that specifies the lower bound for the rule block triggered. |
LogRhythm.AlarmDrilldown.RuleBlocks.DDSummaries.SummaryFieldType | Number | The Summary Field type selected for the rule block. |
LogRhythm.AlarmDrilldown.RuleBlocks.DDSummaries.DrillDownSummaries | String | The aggregate of the Summary Field type as found in the drill-down logs associated with the alarm. |
LogRhythm.AlarmDrilldown.RuleBlocks.DDSummaries.DefaultValue | String | The value populated from the ARM when an alarm is added to the cache. |
#
lr-get-alarm-detailsGet the details of an alarm by the specified alarm ID.
#
Base Commandlr-get-alarm-details
#
InputArgument Name | Description | Required |
---|---|---|
alarm_id | Numeric ID of the alarm to get. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.AlarmDetails.alarmId | Number | The alarm ID. |
LogRhythm.AlarmDetails.personId | Number | The person ID. |
LogRhythm.AlarmDetails.entityId | Number | The entity ID. |
LogRhythm.AlarmDetails.entityName | String | The name of the entity. |
LogRhythm.AlarmDetails.alarmDate | String | The date in UTC of the alarm. |
LogRhythm.AlarmDetails.alarmRuleID | Number | The Rule ID of the rule which triggered the alarm |
LogRhythm.AlarmDetails.alarmRuleName | String | The name of the rule which triggered the alarm |
LogRhythm.AlarmDetails.alarmStatus | String | The status of the alarm. |
LogRhythm.AlarmDetails.alarmStatusName | String | The name for the status of the alarm. |
LogRhythm.AlarmDetails.lastUpdatedID | Number | The ID of the last person to update the alarm. |
LogRhythm.AlarmDetails.lastUpdatedName | String | The name of the last person to update the alarm. |
LogRhythm.AlarmDetails.dateInserted | String | The date in UTC, that the alarm was inserted. |
LogRhythm.AlarmDetails.dateUpdated | String | The date in UTC, that the alarm was updated. |
LogRhythm.AlarmDetails.associatedCases | String | The cases associated with this alarm. |
LogRhythm.AlarmDetails.lastPersonID | Number | The ID of the last person to edit this alarm. |
LogRhythm.AlarmDetails.eventCount | Number | The amount of events that triggered this alarm. |
LogRhythm.AlarmDetails.eventDateFirst | String | The date in UTC of the first event to trigger this alarm. |
LogRhythm.AlarmDetails.eventDateLast | String | The date in UTC of the last event to trigger this alarm. |
LogRhythm.AlarmDetails.rBPMax | Number | The maximum Risk Based Priority for this alarm. |
LogRhythm.AlarmDetails.rBPAvg | Number | The average Risk Based Priority for this alarm. |
LogRhythm.AlarmDetails.executionTarget | Number | The target which the alarm was executed against. |
LogRhythm.AlarmDetails.alarmDataCached | String | The cached alarm data. |
#
lr-cases-listGet cases details using filter criteria.
#
Base Commandlr-cases-list
#
InputArgument Name | Description | Required |
---|---|---|
case_id | The case ID by which to filter the results. | Optional |
timestamp_filter_type | The type by which to filter case results combined with the argument timestamp. Possible values: "updatedAfter", "updatedBefore", "createdAfter", and "createdBefore". Possible values are: updatedAfter, updatedBefore, createdAfter, createdBefore. | Optional |
timestamp | The timestamp by which to filter case results combined with the argument timestamp_filter_type. | Optional |
priority | The priority by which to filter the results. Possible values: "1", "2", "3", "4", and "5", where 1 is the highest priority. Possible values are: 1, 2, 3, 4, 5. | Optional |
status | The status by which to filter the results. Possible values are "1", (created), "2" (completed), "3" (incident), "4" (mitigated), and "5" (resolved). Possible values are: 1, 2, 3, 4, 5. | Optional |
owners | A comma-separated list of owner numbers. | Optional |
tags | A comma-separated list of tag numbers. | Optional |
text | Filter results that have a case number or name that contains the specified value. | Optional |
evidence_type | Filter results that have evidence of the specified type. Possible values: "alarm", "userEvents", "log", no"te, and "file". Possible values are: alarm, userEvents, log, note, file. | Optional |
reference_id | Filter results that have evidence with the given reference identifier. For example, an alarm ID. | Optional |
external_id | Filter results that have the specified, unique, external identifier. | Optional |
offset | The number of cases to skip before starting to collect the result set. Default is 0. | Optional |
count | The number of cases to return. Default is 50. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.Case.id | String | The case ID. |
LogRhythm.Case.number | Number | The case number. |
LogRhythm.Case.externalId | String | The case external ID. |
LogRhythm.Case.dateCreated | Date | The date the case was created. |
LogRhythm.Case.dateUpdated | Date | The date the case was updated. |
LogRhythm.Case.dateClosed | Unknown | The date the case was closed. |
LogRhythm.Case.owner.number | Number | The ID of the case owner. |
LogRhythm.Case.owner.name | String | The name of the case owner. |
LogRhythm.Case.owner.disabled | Boolean | Whether the case owner is disabled. |
LogRhythm.Case.lastUpdatedBy.number | Number | The ID of the user who last updated the case. |
LogRhythm.Case.lastUpdatedBy.name | String | The name of the user who last updated the case. |
LogRhythm.Case.lastUpdatedBy.disabled | Boolean | Whether the user who last updated the case is disabled. |
LogRhythm.Case.name | String | The case name. |
LogRhythm.Case.status.name | String | The case status. |
LogRhythm.Case.status.number | Number | The case status number. |
LogRhythm.Case.priority | Number | The case priority. |
LogRhythm.Case.dueDate | Date | The datetime the case is due. |
LogRhythm.Case.resolution | Unknown | The case resolution. |
LogRhythm.Case.resolutionDateUpdated | Unknown | The date the case resolution was last updated. |
LogRhythm.Case.resolutionLastUpdatedBy | Unknown | The user who last updated the case resolution. |
LogRhythm.Case.summary | String | The case summary. |
LogRhythm.Case.entity.number | Number | The case entity number. |
LogRhythm.Case.entity.name | String | The case entity name. |
LogRhythm.Case.entity.fullName | String | The case entity full name. |
LogRhythm.Case.collaborators.number | Number | The case collaborator number. |
LogRhythm.Case.collaborators.name | String | The case collaborator name. |
LogRhythm.Case.collaborators.disabled | Boolean | Whether the case collaborator is disabled. |
LogRhythm.Case.tags.text | String | The case tag name. |
LogRhythm.Case.tags.number | Number | The case tag number. |
#
Command Example!lr-cases-list priority=5
#
Context Example#
Human Readable Output#
Cases
Collaborators Date Closed Date Created Date Updated Due Date Entity External Id Id Last Updated By Name Number Owner Priority Resolution Resolution Date Updated Resolution Last Updated By Status Summary Tags {'number': 1, 'name': 'LR Soap API', 'disabled': False} 2021-08-11T14:10:08.617291Z 2021-08-31T15:18:26.8118901Z 2021-08-12T14:10:08.617291Z number: -100
name: Global Entity
fullName: Global EntityB055F3D5-6F49-4D94-AEF1-FAEDC4A25251 number: 1
name: LR Soap API
disabled: falsetest case 4 number: 1
name: LR Soap API
disabled: false5 name: Incident
number: 3{'number': 1, 'name': 'LR Soap API', 'disabled': False} 2021-08-11T14:19:48.7669718Z 2021-08-11T14:19:48.7669718Z 2021-08-12T14:19:48.7669718Z number: -100
name: Global Entity
fullName: Global Entity75081347-EB56-4AEA-A6F9-A6EB6662F48E number: 1
name: LR Soap API
disabled: falsetest case from API 5 number: 1
name: LR Soap API
disabled: false5 name: Created
number: 1{'number': 1, 'name': 'LR Soap API', 'disabled': False} 2021-10-05T10:53:07.0405063Z 2021-10-05T10:53:07.0405063Z 2021-10-06T10:53:07.0405063Z number: -100
name: Global Entity
fullName: Global EntityBB8EB00A-F4A7-4710-BB1C-E89DA7BF866B number: 1
name: LR Soap API
disabled: falsetest 35 number: 1
name: LR Soap API
disabled: false5 name: Created
number: 1{'number': 1, 'name': 'LR Soap API', 'disabled': False} 2021-10-06T06:13:06.6792318Z 2021-10-06T06:13:06.6792318Z 2021-10-07T06:13:06.6792318Z number: -100
name: Global Entity
fullName: Global Entity5091AD33-E29E-41A4-A975-E792EFCFF8E1 number: 1
name: LR Soap API
disabled: falsetest 38 number: 1
name: LR Soap API
disabled: false5 name: Created
number: 1{'number': 1, 'name': 'LR Soap API', 'disabled': False} 2021-10-06T07:57:30.7682964Z 2021-10-06T07:57:30.7682964Z 2021-10-07T07:57:30.7682964Z number: -100
name: Global Entity
fullName: Global EntityB9F8031A-7420-4080-96A7-4FF9AB6B6ECF number: 1
name: LR Soap API
disabled: falsetest 39 number: 1
name: LR Soap API
disabled: false5 name: Created
number: 1{'number': 1, 'name': 'LR Soap API', 'disabled': False} 2021-10-06T09:30:58.6568951Z 2021-10-06T09:30:58.6568951Z 2021-10-07T09:30:58.6568951Z number: -100
name: Global Entity
fullName: Global Entity9D7AEA2E-F9D4-4787-9A9B-F8F0E9CE817E number: 1
name: LR Soap API
disabled: falsetest1111 40 number: 1
name: LR Soap API
disabled: false5 name: Created
number: 1{'number': 1, 'name': 'LR Soap API', 'disabled': False} 2021-10-06T09:37:39.7847983Z 2021-10-06T09:37:39.7847983Z 2021-10-07T09:37:39.7847983Z number: -100
name: Global Entity
fullName: Global Entity805BCD50-D301-4F20-9757-A96AC3B1E52C number: 1
name: LR Soap API
disabled: falsetest1111 41 number: 1
name: LR Soap API
disabled: false5 name: Created
number: 1{'number': 1, 'name': 'LR Soap API', 'disabled': False} 2021-10-06T09:44:06.4646762Z 2021-10-06T09:44:06.4646762Z 2021-10-07T09:44:06.4646762Z number: -100
name: Global Entity
fullName: Global EntityFE8A7A3F-2D33-449F-83A5-09D3351E67DC number: 1
name: LR Soap API
disabled: falsetest1111 42 number: 1
name: LR Soap API
disabled: false5 name: Created
number: 1{'number': 1, 'name': 'LR Soap API', 'disabled': False} 2021-10-18T11:45:02.190818Z 2021-10-18T11:45:02.190818Z 2021-10-19T11:45:02.190818Z number: -100
name: Global Entity
fullName: Global Entity01825095-3D3E-4082-9F3D-29BC68EBCE9F number: 1
name: LR Soap API
disabled: falsetest123123 58 number: 1
name: LR Soap API
disabled: false5 name: Created
number: 1{'number': 1, 'name': 'LR Soap API', 'disabled': False} 2021-10-19T05:44:36.6091003Z 2021-10-19T05:44:36.6091003Z 2021-10-20T05:44:36.6091003Z number: -100
name: Global Entity
fullName: Global Entity97F336B2-D18E-438A-8FB1-7F49DCB0A867 number: 1
name: LR Soap API
disabled: falsetest777777 59 number: 1
name: LR Soap API
disabled: false5 name: Created
number: 1{'number': 1, 'name': 'LR Soap API', 'disabled': False} 2021-10-19T05:51:51.6372007Z 2021-10-19T05:51:51.6372007Z 2021-10-20T05:51:51.6372007Z number: -100
name: Global Entity
fullName: Global Entity064C632E-E7E8-4913-A123-EB6153FE4BE4 number: 1
name: LR Soap API
disabled: falsetest777777 60 number: 1
name: LR Soap API
disabled: false5 name: Created
number: 1
#
lr-case-createCreate a new case.
#
Base Commandlr-case-create
#
InputArgument Name | Description | Required |
---|---|---|
name | Name of the case. | Required |
priority | The priority by which to filter the results. Possible values: "1", "2", "3", "4", and "5", where 1 is the highest priority. Possible values are: 1, 2, 3, 4, 5. | Required |
external_id | Externally defined identifier for the case. | Optional |
due_date | The timedate of when the case is due, as an RFC 3339 formatted string. E.g., 2020-04-20T14:15:22Z. | Optional |
summary | Note summarizing the case. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.Case.id | String | The case ID. |
LogRhythm.Case.number | Number | The case number. |
LogRhythm.Case.externalId | String | The case external ID. |
LogRhythm.Case.dateCreated | Date | The date the case was created. |
LogRhythm.Case.dateUpdated | Date | The date the case was updated. |
LogRhythm.Case.dateClosed | Unknown | The date the case was closed. |
LogRhythm.Case.owner.number | Number | The ID of the case owner. |
LogRhythm.Case.owner.name | String | The name of the case owner. |
LogRhythm.Case.owner.disabled | Boolean | Whether the owner is disabled. |
LogRhythm.Case.lastUpdatedBy.number | Number | The ID of the user who last updated the case. |
LogRhythm.Case.lastUpdatedBy.name | String | The name of the user who last updated the case. |
LogRhythm.Case.lastUpdatedBy.disabled | Boolean | Whether the last user who updated the case is disabled. |
LogRhythm.Case.name | String | The case name. |
LogRhythm.Case.status.name | String | The case status. |
LogRhythm.Case.status.number | Number | The case status number. |
LogRhythm.Case.priority | Number | The case priority. |
LogRhythm.Case.dueDate | Date | The datetime the case is due. |
LogRhythm.Case.resolution | Unknown | The case resolution. |
LogRhythm.Case.resolutionDateUpdated | Unknown | The date the case resolution was last updated. |
LogRhythm.Case.resolutionLastUpdatedBy | Unknown | The user who last updated the case resolution. |
LogRhythm.Case.summary | String | The case summary. |
LogRhythm.Case.entity.number | Number | The case entity number. |
LogRhythm.Case.entity.name | String | The case entity name. |
LogRhythm.Case.entity.fullName | String | The case entity full name. |
LogRhythm.Case.collaborators.number | Number | The case collaborator number. |
LogRhythm.Case.collaborators.name | String | The case collaborator name. |
LogRhythm.Case.collaborators.disabled | Boolean | Whether the case collaborator is disabled. |
LogRhythm.Case.tags.text | String | The case tag name. |
LogRhythm.Case.tags.number | Number | The case tag number. |
#
Command Example``!lr-case-create name=test priority=1 external_id=8200 summary=
test case````
#
Context Example#
Human Readable Output#
Case created successfully
Collaborators Date Closed Date Created Date Updated Due Date Entity External Id Id Last Updated By Name Number Owner Priority Resolution Resolution Date Updated Resolution Last Updated By Status Summary Tags {'number': 1, 'name': 'LR Soap API', 'disabled': False} 2021-10-30T20:33:44.6636405Z 2021-10-30T20:33:44.6636405Z 2021-10-31T20:33:44.6636405Z number: -100
name: Global Entity
fullName: Global Entity8200 83E66AB6-5F9A-441E-BF96-52CA53E20BEA number: 1
name: LR Soap API
disabled: falsetest 98 number: 1
name: LR Soap API
disabled: false1 name: Created
number: 1test case
#
lr-case-updateUpdate case information. For example, the case name, priority, and due date.
#
Base Commandlr-case-update
#
InputArgument Name | Description | Required |
---|---|---|
case_id | Unique identifier for the case. | Required |
name | Name of the case. | Optional |
priority | The priority of the case. Possible values: "1", "2", "3", "4", and "5", where 1 is the highest priority. Possible values are: 1, 2, 3, 4, 5. | Optional |
external_id | Externally defined identifier for the case. | Optional |
due_date | The timedate of when the case is due, as an RFC 3339 formatted string. E.g., 2020-04-20T14:15:22Z. | Optional |
summary | Note summarizing the case. | Optional |
entity_id | Entity to assign to the case. | Optional |
resolution | Description of how the case was resolved. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.Case.id | String | The case ID. |
LogRhythm.Case.number | Number | The case number. |
LogRhythm.Case.externalId | String | The case external ID. |
LogRhythm.Case.dateCreated | Date | The date the case was created. |
LogRhythm.Case.dateUpdated | Date | The date the case was updated. |
LogRhythm.Case.dateClosed | Unknown | The date the case was closed. |
LogRhythm.Case.owner.number | Number | The ID of the case owner. |
LogRhythm.Case.owner.name | String | The name of the case owner. |
LogRhythm.Case.owner.disabled | Boolean | Whether the owner is disabled. |
LogRhythm.Case.lastUpdatedBy.number | Number | The ID of the user who last updated the case. |
LogRhythm.Case.lastUpdatedBy.name | String | The name of the user who last updated the case. |
LogRhythm.Case.lastUpdatedBy.disabled | Boolean | Whether the last user who updated the case is disabled. |
LogRhythm.Case.name | String | The case name. |
LogRhythm.Case.status.name | String | The case status. |
LogRhythm.Case.status.number | Number | The case status number. |
LogRhythm.Case.priority | Number | The case priority. |
LogRhythm.Case.dueDate | Date | The datetime the case is due. |
LogRhythm.Case.resolution | Unknown | The case resolution. |
LogRhythm.Case.resolutionDateUpdated | Unknown | The date the case resolution was last updated. |
LogRhythm.Case.resolutionLastUpdatedBy | Unknown | The user who last updated the case resolution. |
LogRhythm.Case.summary | String | The case summary. |
LogRhythm.Case.entity.number | Number | The case entity number. |
LogRhythm.Case.entity.name | String | The case entity name. |
LogRhythm.Case.entity.fullName | String | The case entity full name. |
LogRhythm.Case.collaborators.number | Number | The case collaborator number. |
LogRhythm.Case.collaborators.name | String | The case collaborator name. |
LogRhythm.Case.collaborators.disabled | Boolean | Whether the case collaborator is disabled. |
LogRhythm.Case.tags.text | String | The case tag name. |
LogRhythm.Case.tags.number | Number | The case tag number. |
#
Command Example!lr-case-update case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE priority=3
#
Context Example#
Human Readable Output#
Case 2E7FA20D-191E-4733-B7DC-A18BBFE762CE updated successfully
Collaborators Date Closed Date Created Date Updated Due Date Entity External Id Id Last Updated By Name Number Owner Priority Resolution Resolution Date Updated Resolution Last Updated By Status Summary Tags {'number': 1, 'name': 'LR Soap API', 'disabled': False} 2021-08-19T15:38:07.8995494Z 2021-08-31T15:31:24.9870972Z 2021-08-20T15:38:07.8995494Z number: -100
name: Global Entity
fullName: Global Entity9930 2E7FA20D-191E-4733-B7DC-A18BBFE762CE number: 1
name: LR Soap API
disabled: falsetest 17 number: 1
name: LR Soap API
disabled: false3 name: Incident
number: 3test case
#
lr-case-status-changeUpdate the status of a case.
#
Base Commandlr-case-status-change
#
InputArgument Name | Description | Required |
---|---|---|
case_id | Unique identifier for the case. | Required |
status | The case status. Possible values: "Created", "Completed", "Incident", "Mitigated", and "Resolved". Possible values are: Created, Completed, Incident, Mitigated, Resolved. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.Case.id | String | The case ID. |
LogRhythm.Case.number | Number | The case number. |
LogRhythm.Case.externalId | String | The case external ID. |
LogRhythm.Case.dateCreated | Date | The date the case was created. |
LogRhythm.Case.dateUpdated | Date | The date the case was updated. |
LogRhythm.Case.dateClosed | Unknown | The date the case was closed. |
LogRhythm.Case.owner.number | Number | The ID of the case owner. |
LogRhythm.Case.owner.name | String | The name of the case owner. |
LogRhythm.Case.owner.disabled | Boolean | Whether the owner is disabled. |
LogRhythm.Case.lastUpdatedBy.number | Number | The ID of the user who last updated the case. |
LogRhythm.Case.lastUpdatedBy.name | String | The name of the user who last updated the case. |
LogRhythm.Case.lastUpdatedBy.disabled | Boolean | Whether the last user who updated the case is disabled. |
LogRhythm.Case.name | String | The case name. |
LogRhythm.Case.status.name | String | The case status. |
LogRhythm.Case.status.number | Number | The case status number. |
LogRhythm.Case.priority | Number | The case priority. |
LogRhythm.Case.dueDate | Date | The datetime the case is due. |
LogRhythm.Case.resolution | Unknown | The case resolution. |
LogRhythm.Case.resolutionDateUpdated | Unknown | The date the case resolution was last updated. |
LogRhythm.Case.resolutionLastUpdatedBy | Unknown | The user who last updated the case resolution. |
LogRhythm.Case.summary | String | The case summary. |
LogRhythm.Case.entity.number | Number | The case entity number. |
LogRhythm.Case.entity.name | String | The case entity name. |
LogRhythm.Case.entity.fullName | String | The case entity full name. |
LogRhythm.Case.collaborators.number | Number | The case collaborator number. |
LogRhythm.Case.collaborators.name | String | The case collaborator name. |
LogRhythm.Case.collaborators.disabled | Boolean | Whether the case collaborator is disabled. |
LogRhythm.Case.tags.text | String | The case tag name. |
LogRhythm.Case.tags.number | Number | The case tag number. |
#
Command Example!lr-case-status-change case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE status=Incident
#
Context Example#
Human Readable Output#
Case status updated successfully
Collaborators Date Closed Date Created Date Updated Due Date Entity External Id Id Last Updated By Name Number Owner Priority Resolution Resolution Date Updated Resolution Last Updated By Status Summary Tags {'number': 1, 'name': 'LR Soap API', 'disabled': False} 2021-08-19T15:38:07.8995494Z 2021-08-31T15:31:24.9870972Z 2021-08-20T15:38:07.8995494Z number: -100
name: Global Entity
fullName: Global Entity9930 2E7FA20D-191E-4733-B7DC-A18BBFE762CE number: 1
name: LR Soap API
disabled: falsetest 17 number: 1
name: LR Soap API
disabled: false3 name: Incident
number: 3test case
#
lr-case-evidence-listReturn a list of evidence summaries for a case.
#
Base Commandlr-case-evidence-list
#
InputArgument Name | Description | Required |
---|---|---|
case_id | Unique identifier for the case. | Required |
evidence_type | Filter results that have evidence of the specified type. Possible values are: "alarm", "userEvents", "log", "note", and "file". Possible values are: alarm, userEvents, log, note, file. | Optional |
status | Filter results that have a specific evidence status. Possible values: "pending", "completed", and "failed". Possible values are: pending, completed, failed. | Optional |
evidence_number | Filter results by evidence number. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.CaseEvidence.CaseID | String | The case ID. |
LogRhythm.CaseEvidence.Evidences.number | Number | The evidence number. |
LogRhythm.CaseEvidence.Evidences.dateCreated | Date | The date the evidence was created. |
LogRhythm.CaseEvidence.Evidences.dateUpdated | Date | The date the evidence was updated. |
LogRhythm.CaseEvidence.Evidences.createdBy.number | Number | The ID of the user who created the evidence. |
LogRhythm.CaseEvidence.Evidences.createdBy.name | String | The name of the user who created the evidence. |
LogRhythm.CaseEvidence.Evidences.createdBy.disabled | Boolean | Whether the user is disabled. |
LogRhythm.CaseEvidence.Evidences.lastUpdatedBy.number | Number | The ID of the user who last updated the case evidence. |
LogRhythm.CaseEvidence.Evidences.lastUpdatedBy.name | String | The name of the user who last updated the case evidence. |
LogRhythm.CaseEvidence.Evidences.lastUpdatedBy.disabled | Boolean | Whether the last user who updated the case evidence is disabled. |
LogRhythm.CaseEvidence.Evidences.type | String | The evidence type. |
LogRhythm.CaseEvidence.Evidences.status | String | The evidence status |
LogRhythm.CaseEvidence.Evidences.statusMessage | Unknown | The evidence status message. |
LogRhythm.CaseEvidence.Evidences.text | String | The evidence text. |
LogRhythm.CaseEvidence.Evidences.pinned | Boolean | Whether the evidence is pinned. |
LogRhythm.CaseEvidence.Evidences.datePinned | Unknown | The date the evidence was pinned. |
#
Command Example!lr-case-evidence-list case_id=583A7DAA-872A-4ECE-80B8-0DECB6FC3061
#
Context Example#
Human Readable Output#
Evidences for case 583A7DAA-872A-4ECE-80B8-0DECB6FC3061
Number Type Status Date Created Created By Text Alarm File 58 alarm completed 2021-08-19T14:21:01.7066667Z number: -100
name: LogRhythm Administrator
disabled: falsealarmId: 212
alarmDate: 2021-08-19T13:08:08.713Z
alarmRuleId: 98
alarmRuleName: LogRhythm Agent Heartbeat Missed
dateInserted: 2021-08-19T13:08:08.727Z
entityId: 2
entityName: EchoTestEntity
riskBasedPriorityMax: 3959 alarm completed 2021-08-19T14:21:11.7766667Z number: -100
name: LogRhythm Administrator
disabled: falsealarmId: 211
alarmDate: 2021-08-19T11:07:56.86Z
alarmRuleId: 98
alarmRuleName: LogRhythm Agent Heartbeat Missed
dateInserted: 2021-08-19T11:07:56.877Z
entityId: 2
entityName: EchoTestEntity
riskBasedPriorityMax: 3961 note completed 2021-08-19T14:25:33.5976206Z number: -100
name: LogRhythm Administrator
disabled: falsetest note
#
lr-case-alarm-evidence-addAdd multiple alarms as evidence on a case.
#
Base Commandlr-case-alarm-evidence-add
#
InputArgument Name | Description | Required |
---|---|---|
case_id | Unique identifier for the case. | Required |
alarm_numbers | A comma-separated list of alarm IDs. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.AlarmEvidence.CaseID | String | The case ID. |
LogRhythm.AlarmEvidence.Evidences.number | Number | The evidence number. |
LogRhythm.AlarmEvidence.Evidences.dateCreated | Date | The date the evidence was created. |
LogRhythm.AlarmEvidence.Evidences.dateUpdated | Date | The date the evidence was updated. |
LogRhythm.AlarmEvidence.Evidences.createdBy.number | Number | The ID of the user who created the evidence. |
LogRhythm.AlarmEvidence.Evidences.createdBy.name | String | The name of the user who created the evidence. |
LogRhythm.AlarmEvidence.Evidences.createdBy.disabled | Boolean | Whether the user is disabled. |
LogRhythm.AlarmEvidence.Evidences.lastUpdatedBy.number | Number | The ID of the user who last updated the alarm evidence. |
LogRhythm.AlarmEvidence.Evidences.lastUpdatedBy.name | String | The name of the user who last updated the alarm evidence. |
LogRhythm.AlarmEvidence.Evidences.lastUpdatedBy.disabled | Boolean | Whether the last user who updated the alarm evidence is disabled. |
LogRhythm.AlarmEvidence.Evidences.type | String | The evidence type. |
LogRhythm.AlarmEvidence.Evidences.status | String | The evidence status |
LogRhythm.AlarmEvidence.Evidences.statusMessage | Unknown | The evidence status message. |
LogRhythm.AlarmEvidence.Evidences.text | String | The evidence text. |
LogRhythm.AlarmEvidence.Evidences.pinned | Boolean | Whether the evidence is pinned. |
LogRhythm.AlarmEvidence.Evidences.datePinned | Unknown | The date the evidence was pinned. |
LogRhythm.AlarmEvidence.Evidences.alarm.alarmId | Number | The alarm ID. |
LogRhythm.AlarmEvidence.Evidences.alarm.alarmDate | Date | The alarm date. |
LogRhythm.AlarmEvidence.Evidences.alarm.alarmRuleId | Number | The alarm rule ID. |
LogRhythm.AlarmEvidence.Evidences.alarm.alarmRuleName | String | The alarm rule name. |
LogRhythm.AlarmEvidence.Evidences.alarm.dateInserted | Date | The date the alarm was inserted. |
LogRhythm.AlarmEvidence.Evidences.alarm.entityId | Number | The alarm entity ID. |
LogRhythm.AlarmEvidence.Evidences.alarm.entityName | String | The alarm entity name. |
LogRhythm.AlarmEvidence.Evidences.alarm.riskBasedPriorityMax | Number | The maximum Risk Based Priority (RBP) threshold of events to monitor. |
#
Command Example!lr-case-alarm-evidence-add case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE alarm_numbers=200,201
#
Context Example#
Human Readable Output#
Alarms added as evidence to case 2E7FA20D-191E-4733-B7DC-A18BBFE762CE successfully
Number Type Status Date Created Created By Text Alarm File 62 alarm completed 2021-08-19T15:41:35.54Z number: 1
name: LR Soap API
disabled: falsealarmId: 200
alarmDate: 2021-08-18T13:05:59.663Z
alarmRuleId: 98
alarmRuleName: LogRhythm Agent Heartbeat Missed
dateInserted: 2021-08-18T13:05:59.683Z
entityId: 2
entityName: EchoTestEntity
riskBasedPriorityMax: 10063 alarm completed 2021-08-19T15:41:35.54Z number: 1
name: LR Soap API
disabled: falsealarmId: 201
alarmDate: 2021-08-18T15:06:10.623Z
alarmRuleId: 98
alarmRuleName: LogRhythm Agent Heartbeat Missed
dateInserted: 2021-08-18T15:06:10.637Z
entityId: 2
entityName: EchoTestEntity
riskBasedPriorityMax: 39
#
lr-case-note-evidence-addAdd a note as evidence on a case.
#
Base Commandlr-case-note-evidence-add
#
InputArgument Name | Description | Required |
---|---|---|
case_id | Unique identifier for the case. | Required |
note | Note text. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.NoteEvidence.CaseID | String | The case ID. |
LogRhythm.NoteEvidence.Evidences.number | Number | The evidence number. |
LogRhythm.NoteEvidence.Evidences.dateCreated | Date | The date the evidence was created. |
LogRhythm.NoteEvidence.Evidences.dateUpdated | Date | The date the evidence was updated. |
LogRhythm.NoteEvidence.Evidences.createdBy.number | Number | The ID of the user who created the evidence. |
LogRhythm.NoteEvidence.Evidences.createdBy.name | String | The name of the user who created the evidence. |
LogRhythm.NoteEvidence.Evidences.createdBy.disabled | Boolean | Whether the user is disabled. |
LogRhythm.NoteEvidence.Evidences.lastUpdatedBy.number | Number | The ID of the user who last updated the evidence. |
LogRhythm.NoteEvidence.Evidences.lastUpdatedBy.name | String | The name of the user who last updated the evidence. |
LogRhythm.NoteEvidence.Evidences.lastUpdatedBy.disabled | Boolean | Whether the last user who updated the evidence is disabled. |
LogRhythm.NoteEvidence.Evidences.type | String | The evidence type. |
LogRhythm.NoteEvidence.Evidences.status | String | The evidence status, |
LogRhythm.NoteEvidence.Evidences.statusMessage | Unknown | The evidence status message. |
LogRhythm.NoteEvidence.Evidences.text | String | The evidence text. |
LogRhythm.NoteEvidence.Evidences.pinned | Boolean | Whether the evidence is pinned. |
LogRhythm.NoteEvidence.Evidences.datePinned | Unknown | The date the evidence was pinned. |
#
Command Example!lr-case-note-evidence-add case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE note=test
#
Context Example#
Human Readable Output#
Note added as evidence to case 2E7FA20D-191E-4733-B7DC-A18BBFE762CE successfully
Number Type Status Date Created Created By Text Alarm File 243 note completed 2021-10-30T20:17:09.2251906Z number: 1
name: LR Soap API
disabled: falsetest
#
lr-case-file-evidence-addUpload a file as evidence on a case.
#
Base Commandlr-case-file-evidence-add
#
InputArgument Name | Description | Required |
---|---|---|
case_id | Unique identifier for the case,. | Required |
entryId | The entry ID of the file to attach. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.FileEvidence.CaseID | String | The case ID. |
LogRhythm.FileEvidence.Evidences.number | Number | The evidence number. |
LogRhythm.FileEvidence.Evidences.dateCreated | Date | The date the evidence was created. |
LogRhythm.FileEvidence.Evidences.dateUpdated | Date | The date the evidence was updated. |
LogRhythm.FileEvidence.Evidences.createdBy.number | Number | The ID of the user who created the evidence. |
LogRhythm.FileEvidence.Evidences.createdBy.name | String | The name of the user who created the evidence. |
LogRhythm.FileEvidence.Evidences.createdBy.disabled | Boolean | Whether the user is disabled. |
LogRhythm.FileEvidence.Evidences.lastUpdatedBy.number | Number | The ID of the user who last updated the evidence. |
LogRhythm.FileEvidence.Evidences.lastUpdatedBy.name | String | The name of the user who last updated the evidence. |
LogRhythm.FileEvidence.Evidences.lastUpdatedBy.disabled | Boolean | Whether the last user who updated the evidence is disabled. |
LogRhythm.FileEvidence.Evidences.type | String | The evidence type. |
LogRhythm.FileEvidence.Evidences.status | String | The evidence status |
LogRhythm.FileEvidence.Evidences.statusMessage | Unknown | The evidence status message. |
LogRhythm.FileEvidence.Evidences.text | String | The evidence text. |
LogRhythm.FileEvidence.Evidences.pinned | Boolean | Whether the evidence is pinned. |
LogRhythm.FileEvidence.Evidences.datePinned | Unknown | The date the evidence was pinned. |
#
Command Example!lr-case-file-evidence-add case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE entryId=8502@383ed6ae-1fd7-431a-858d-a11f2620c73b
#
Context Example#
Human Readable Output#
File added as evidence to case 2E7FA20D-191E-4733-B7DC-A18BBFE762CE successfully
Number Type Status Date Created Created By Text Alarm File 244 file pending 2021-10-30T20:33:46.8Z number: 1
name: LR Soap API
disabled: falsename: File.jpeg
size: 170781
#
lr-case-evidence-deleteRemove evidence from a case.
#
Base Commandlr-case-evidence-delete
#
InputArgument Name | Description | Required |
---|---|---|
case_id | Unique identifier for the case. | Required |
evidence_number | Unique, numeric identifier for the evidence to remove. | Required |
#
Context OutputThere is no context output for this command.
#
Command Example!lr-case-evidence-delete case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE evidence_number=65
#
Human Readable OutputEvidence deleted successfully from case 2E7FA20D-191E-4733-B7DC-A18BBFE762CE.
#
lr-case-file-evidence-downloadDownload an item of file evidence from a case.
#
Base Commandlr-case-file-evidence-download
#
InputArgument Name | Description | Required |
---|---|---|
case_id | Unique identifier for the case. | Required |
evidence_number | Unique, numeric identifier for the evidence. | Required |
#
Context OutputThere is no context output for this command.
#
Command Example!lr-case-file-evidence-download case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE evidence_number=66
#
Context Example#
Human Readable Output#
lr-case-tags-addAdd tags to a case.
#
Base Commandlr-case-tags-add
#
InputArgument Name | Description | Required |
---|---|---|
case_id | Unique identifier for the case. | Required |
tag_numbers | A comma-separated list of tag numbers to add. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.Case.id | String | The case ID. |
LogRhythm.Case.number | Number | The case number. |
LogRhythm.Case.externalId | String | The case external ID. |
LogRhythm.Case.dateCreated | Date | The date the case was created. |
LogRhythm.Case.dateUpdated | Date | The date the case was updated. |
LogRhythm.Case.dateClosed | Unknown | The date the case was closed. |
LogRhythm.Case.owner.number | Number | The ID of the case owner. |
LogRhythm.Case.owner.name | String | The name of the case owner. |
LogRhythm.Case.owner.disabled | Boolean | Whether the owner is disabled or not |
LogRhythm.Case.lastUpdatedBy.number | Number | The ID of the user who last updated the case. |
LogRhythm.Case.lastUpdatedBy.name | String | The name of the user who last updated the case. |
LogRhythm.Case.lastUpdatedBy.disabled | Boolean | Whether the last user who updated the case is disabled. |
LogRhythm.Case.name | String | The case name. |
LogRhythm.Case.status.name | String | The case status. |
LogRhythm.Case.status.number | Number | The case status number. |
LogRhythm.Case.priority | Number | The case priority. |
LogRhythm.Case.dueDate | Date | The datetime the case is due. |
LogRhythm.Case.resolution | Unknown | The case resolution. |
LogRhythm.Case.resolutionDateUpdated | Unknown | The date the case resolution was last updated. |
LogRhythm.Case.resolutionLastUpdatedBy | Unknown | The user who last updated the case resolution. |
LogRhythm.Case.summary | String | The case summary. |
LogRhythm.Case.entity.number | Number | The case entity number. |
LogRhythm.Case.entity.name | String | The case entity name. |
LogRhythm.Case.entity.fullName | String | The case entity full name. |
LogRhythm.Case.collaborators.number | Number | The case collaborator number. |
LogRhythm.Case.collaborators.name | String | The case collaborator name. |
LogRhythm.Case.collaborators.disabled | Boolean | Whether the case collaborator is disabled. |
LogRhythm.Case.tags.text | String | The case tag name. |
LogRhythm.Case.tags.number | Number | The case tag number. |
#
Command Example!lr-case-tags-add case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE tag_numbers=2,3
#
Context Example#
Human Readable Output#
Tags added successfully to case 2E7FA20D-191E-4733-B7DC-A18BBFE762CE
Collaborators Date Closed Date Created Date Updated Due Date Entity External Id Id Last Updated By Name Number Owner Priority Resolution Resolution Date Updated Resolution Last Updated By Status Summary Tags {'number': 1, 'name': 'LR Soap API', 'disabled': False} 2021-08-19T15:38:07.8995494Z 2021-10-30T20:17:15.9861818Z 2021-08-20T15:38:07.8995494Z number: -100
name: Global Entity
fullName: Global Entity9930 2E7FA20D-191E-4733-B7DC-A18BBFE762CE number: 1
name: LR Soap API
disabled: falsetest 17 number: 1
name: LR Soap API
disabled: false3 name: Incident
number: 3test case {'number': 2, 'text': 'tag #2'},
{'number': 3, 'text': 'tag #3'}
#
lr-case-tags-removeRemove tags from a case.
#
Base Commandlr-case-tags-remove
#
InputArgument Name | Description | Required |
---|---|---|
case_id | Unique identifier for the case. | Required |
tag_numbers | A comma-separated list of tag numbers to remove. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.Case.id | String | The case ID. |
LogRhythm.Case.number | Number | The case number. |
LogRhythm.Case.externalId | String | The case external ID. |
LogRhythm.Case.dateCreated | Date | The date the case was created. |
LogRhythm.Case.dateUpdated | Date | The date the case was updated. |
LogRhythm.Case.dateClosed | Unknown | The date the case was closed. |
LogRhythm.Case.owner.number | Number | The ID of the case owner. |
LogRhythm.Case.owner.name | String | The name of the case owner. |
LogRhythm.Case.owner.disabled | Boolean | Whether the owner is disabled or not |
LogRhythm.Case.lastUpdatedBy.number | Number | The ID of the user who last updated the case. |
LogRhythm.Case.lastUpdatedBy.name | String | The name of the user who last updated the case. |
LogRhythm.Case.lastUpdatedBy.disabled | Boolean | Whether the last user who updated the case is disabled. |
LogRhythm.Case.name | String | The case name. |
LogRhythm.Case.status.name | String | The case status. |
LogRhythm.Case.status.number | Number | The case status number. |
LogRhythm.Case.priority | Number | The case priority. |
LogRhythm.Case.dueDate | Date | The datetime the case is due. |
LogRhythm.Case.resolution | Unknown | The case resolution. |
LogRhythm.Case.resolutionDateUpdated | Unknown | The date the case resolution was last updated. |
LogRhythm.Case.resolutionLastUpdatedBy | Unknown | The user who last updated the case resolution. |
LogRhythm.Case.summary | String | The case summary. |
LogRhythm.Case.entity.number | Number | The case entity number. |
LogRhythm.Case.entity.name | String | The case entity name. |
LogRhythm.Case.entity.fullName | String | The case entity full name. |
LogRhythm.Case.collaborators.number | Number | The case collaborator number. |
LogRhythm.Case.collaborators.name | String | The case collaborator name. |
LogRhythm.Case.collaborators.disabled | Boolean | Whether the case collaborator is disabled. |
LogRhythm.Case.tags.text | String | The case tag name. |
LogRhythm.Case.tags.number | Number | The case tag number. |
#
Command Example!lr-case-tags-remove case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE tag_numbers=1,2
#
Context Example#
Human Readable Output#
Tags removed successfully from case 2E7FA20D-191E-4733-B7DC-A18BBFE762CE
Collaborators Date Closed Date Created Date Updated Due Date Entity External Id Id Last Updated By Name Number Owner Priority Resolution Resolution Date Updated Resolution Last Updated By Status Summary Tags {'number': 1, 'name': 'LR Soap API', 'disabled': False} 2021-08-19T15:38:07.8995494Z 2021-10-30T20:17:17.3901952Z 2021-08-20T15:38:07.8995494Z number: -100
name: Global Entity
fullName: Global Entity9930 2E7FA20D-191E-4733-B7DC-A18BBFE762CE number: 1
name: LR Soap API
disabled: falsetest 17 number: 1
name: LR Soap API
disabled: false3 name: Incident
number: 3test case {'number': 3, 'text': 'tag #3'}
#
lr-tags-listReturn a list of tags using filter criteria.
#
Base Commandlr-tags-list
#
InputArgument Name | Description | Required |
---|---|---|
tag_name | Filter results that have a tag name that contains the specified value. | Optional |
offset | The number of tags to skip before starting to collect the result set. Default is 0. | Optional |
count | The numbers of tags to return. Default is 50. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.Tag.number | Number | The tag number. |
LogRhythm.Tag.text | String | The tag text. |
LogRhythm.Tag.dateCreated | Date | The date the tag was created. |
LogRhythm.Tag.createdBy.number | Number | The ID of the user who created the tag. |
LogRhythm.Tag.createdBy.name | String | The name of the user who created the tag. |
LogRhythm.Tag.createdBy.disabled | Boolean | Whether the user is disabled. |
#
Command Example!lr-tags-list count=2
#
Context Example#
Human Readable Output#
Tags
Number Text Date Created Created By 2 tag #2 2021-08-11T13:44:00.4433333Z number: 1
name: LR Soap API
disabled: false3 tag #3 2021-08-11T13:44:05.7433333Z number: 1
name: LR Soap API
disabled: false
#
lr-case-collaborators-listReturns the owner and a list of collaborators associated with a specific case.
#
Base Commandlr-case-collaborators-list
#
InputArgument Name | Description | Required |
---|---|---|
case_id | Unique identifier for the case. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.CaseCollaborator.CaseID | String | The case ID. |
LogRhythm.CaseCollaborator.owner.number | Number | The ID of the case owner. |
LogRhythm.CaseCollaborator.owner.name | String | The name of the case owner. |
LogRhythm.CaseCollaborator.owner.disabled | Boolean | Whether the owner is disabled. |
LogRhythm.CaseCollaborator.collaborators.number | Number | The case collaborator number. |
LogRhythm.CaseCollaborator.collaborators.name | String | The case collaborator name. |
LogRhythm.CaseCollaborator.collaborators.disabled | Boolean | Whether the case collaborator is disabled. |
#
Command Example!lr-case-collaborators-list case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE
#
Context Example#
Human Readable Output#
Case owner
Disabled Name Number false LR Soap API 1 #
Case collaborators
Disabled Name Number false LR Soap API 1
#
lr-case-collaborators-updateUpdates the owner and collaborators associated with a specific case.
#
Base Commandlr-case-collaborators-update
#
InputArgument Name | Description | Required |
---|---|---|
case_id | Unique identifier for the case. | Required |
owner | Unique, numeric identifier for the person. | Required |
collaborators | A comma-separated list of user IDs. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.CaseCollaborator.CaseID | String | The case ID. |
LogRhythm.CaseCollaborator.owner.number | Number | The ID of the case owner. |
LogRhythm.CaseCollaborator.owner.name | String | The name of the case owner. |
LogRhythm.CaseCollaborator.owner.disabled | Boolean | Whether the owner is disabled. |
LogRhythm.CaseCollaborator.collaborators.number | Number | The case collaborator ID. |
LogRhythm.CaseCollaborator.collaborators.name | String | The case collaborator name. |
LogRhythm.CaseCollaborator.collaborators.disabled | Boolean | Whether the case collaborator is disabled. |
#
Command Example!lr-case-collaborators-update case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE collaborators=1 owner=1
#
Context Example#
Human Readable Output#
Case 2E7FA20D-191E-4733-B7DC-A18BBFE762CE updated successfully#
Case owner
Disabled Name Number false LR Soap API 1 #
Case collaborators
Disabled Name Number false LR Soap API 1
#
lr-entities-listReturns all Entities that match the specified criteria.
#
Base Commandlr-entities-list
#
InputArgument Name | Description | Required |
---|---|---|
parent_entity_id | Filter by the object parent entity ID. | Optional |
entity_id | Filter by the entity ID. | Optional |
offset | The number of entities to skip before starting to collect the result set. Default is 0. | Optional |
count | The number of entities to return. Default is 50. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.Entity.id | Number | The entity ID. |
LogRhythm.Entity.name | String | The entity name. |
LogRhythm.Entity.fullName | String | The entity full name. |
LogRhythm.Entity.recordStatusName | String | The entity record status. |
LogRhythm.Entity.shortDesc | String | The entity short description. |
LogRhythm.Entity.dateUpdated | Date | The date the entity was updated. |
#
Command Example!lr-entities-list count=2
#
Context Example#
Human Readable Output#
Entities
Id Name Full Name Record Status Name Short Desc Date Updated 2 EchoTestEntity EchoTestEntity Active LogRhythm ECHO 2021-10-12T14:01:21.54Z -100 Global Entity Global Entity Active Global entity containing shared network and host records 2021-10-27T16:27:14.363Z
#
lr-hosts-listReturns all hosts that match the specified criteria.
#
Base Commandlr-hosts-list
#
InputArgument Name | Description | Required |
---|---|---|
host_id | Filter by host ID. | Optional |
host_name | Filter by host name. | Optional |
entity_name | Filter by entity name. | Optional |
record_status | Filter by record status. Possible values: "all", "active", "retired". Possible values are: all, active, retired. | Optional |
offset | The number of hosts to skip before starting to collect the result set. Default is 0. | Optional |
count | The number of hosts to return. Default is 50. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.Host.id | Number | The host ID. |
LogRhythm.Host.entity.id | Number | The host entity ID. |
LogRhythm.Host.entity.name | String | The host entity name. |
LogRhythm.Host.name | String | The host name. |
LogRhythm.Host.riskLevel | String | The host risk level. |
LogRhythm.Host.threatLevel | String | The host threat level. |
LogRhythm.Host.threatLevelComments | String | The threat level comments |
LogRhythm.Host.recordStatusName | String | The host record status name. |
LogRhythm.Host.hostZone | String | The host zone. |
LogRhythm.Host.location.id | Number | The host location ID. |
LogRhythm.Host.os | String | The operating system type supported by LogRhythm. |
LogRhythm.Host.useEventlogCredentials | Boolean | Whether to use the event log credentials. |
LogRhythm.Host.osType | String | The agent server type on which the operating system is installed. |
LogRhythm.Host.dateUpdated | Date | The date the host was updated. |
LogRhythm.Host.shortDesc | String | The host short description. |
LogRhythm.Host.osVersion | String | The host operation system version. |
LogRhythm.Host.hostIdentifiers.type | String | The host identifier type. |
LogRhythm.Host.hostIdentifiers.value | String | The host identifier value. |
LogRhythm.Host.hostIdentifiers.dateAssigned | Date | The date the host identifier was assigned. |
LogRhythm.Host.eventlogPassword | String | The event log password. |
#
Command Example!lr-hosts-list count=2
#
Context Example#
Human Readable Output#
Hosts
Date Updated Entity Host Identifiers Host Roles Host Zone Id Location Name Os Os Type Record Status Name Risk Level Threat Level Threat Level Comments Use Eventlog Credentials 2021-07-27T15:56:14.34Z id: -100
name: Global EntityInternal -1000001 id: -1 AI Engine Server Unknown Server Active None None false 2021-07-27T15:56:14.343Z id: 1
name: Primary SiteInternal -1000002 id: -1 AI Engine Server Unknown Server Active None None false
#
lr-users-listReturns user records based on the permissions of the currently logged in user and the specified criteria.
#
Base Commandlr-users-list
#
InputArgument Name | Description | Required |
---|---|---|
user_ids | A comma-separated list of user IDs. | Optional |
entity_ids | A comma-separated list of entity IDs. | Optional |
user_status | Filter by user status. Possible values: "Active" and "Retired". Possible values are: Active, Retired. | Optional |
offset | The ID of users to skip before starting to collect the result set. Default is 0. | Optional |
count | The IDs of the users to return. Default is 50. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.User.firstName | String | The user first name. |
LogRhythm.User.lastName | String | The user last name. |
LogRhythm.User.userType | String | The user type |
LogRhythm.User.fullName | String | The user full name. |
LogRhythm.User.objectPermissions.readAccess | String | The user read access permissions. |
LogRhythm.User.objectPermissions.writeAccess | String | The user write access permissions. |
LogRhythm.User.objectPermissions.entity.id | Number | The user permissions entity ID. |
LogRhythm.User.objectPermissions.entity.name | String | The user permissions entity name. |
LogRhythm.User.objectPermissions.owner.id | Number | The user permissions owner ID. |
LogRhythm.User.objectPermissions.owner.name | String | The user permissions owner. |
LogRhythm.User.id | Number | The user ID. |
LogRhythm.User.recordStatusName | String | The user record status. |
LogRhythm.User.dateUpdated | Date | The date the user was updated. |
#
Command Example!lr-users-list count=2
#
Context Example#
Human Readable Output#
Users
Id Full Name User Type First Name Last Name Record Status Name Date Updated Object Permissions 1 LR Soap API Role Active 2021-07-27T20:38:31.443Z readAccess: PublicGlobalAdmin
writeAccess: PublicGlobalAdmin
entity: {"id": 1, "name": "Primary Site"}
owner: {"id": -100, "name": "LogRhythmAdmin"}-101 LogRhythm Analyst Role LogRhythm Analyst Active 2021-07-27T15:07:47.05Z readAccess: PublicAll
writeAccess: PublicGlobalAdmin
entity: {"id": -100, "name": "Global Entity"}
owner: {"id": -100, "name": "LogRhythmAdmin"}
#
lr-lists-getReturns list details using the filter criteria.
#
Base Commandlr-lists-get
#
InputArgument Name | Description | Required |
---|---|---|
list_type | The list type. Possible values: "None", "Application", "Classification", "CommonEvent", "Host", "Location", "MsgSource", "MsgSourceType", "MPERule", "Network", "User", "GeneralValue", "Entity", "RootEntity", "IP", "IPRange", and "Identity". Possible values are: None, Application, Classification, CommonEvent, Host, Location, MsgSource, MsgSourceType, MPERule, Network, User, GeneralValue, Entity, RootEntity, IP, IPRange, Identity. | Optional |
list_name | The name of the object or regex match. | Optional |
can_edit | Specifies if Write Only (true) or Read Only (false) lists are required for a user. Possible values: "true" and "false". Possible values are: true, false. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
LogRhythm.List.listType | String | The list type. |
LogRhythm.List.status | String | The list status. |
LogRhythm.List.name | String | The list name. |
LogRhythm.List.shortDescription | String | The list short description. |
LogRhythm.List.useContext | String | The use context type. |
LogRhythm.List.autoImportOption.enabled | Boolean | Whether the list auto import is enabled. |
LogRhythm.List.autoImportOption.usePatterns | Boolean | Whether the auto import use patterns is enabled. |
LogRhythm.List.autoImportOption.replaceExisting | Boolean | Whether the auto import replace existing is enabled. |
LogRhythm.List.id | Number | The list ID. |
LogRhythm.List.guid | String | The list GUID. |
LogRhythm.List.dateCreated | Date | The date the list was created. |
LogRhythm.List.dateUpdated | Date | The date the list was updated. |
LogRhythm.List.readAccess | String | The read permission level. |
LogRhythm.List.writeAccess | String | The write permission level. |
LogRhythm.List.restrictedRead | Boolean | Whether the list is read restricted. |
LogRhythm.List.entityName | String | The list entity name. |
LogRhythm.List.entryCount | Number | The list entry count. |
LogRhythm.List.needToNotify | Boolean | Whether the list will notify the user when updated. |
LogRhythm.List.doesExpire | Boolean | Whether the list expires. |
LogRhythm.List.owner | Number | The ID of the list owner. |
LogRhythm.List.longDescription | String | The list long description. |
LogRhythm.List.timeToLiveSeconds | Number | The list time for the list to live in seconds. |
LogRhythm.List.revisitDate | Date | The list revisit date. |
#
Command Example!lr-lists-get