LogRhythmRest v2

This Integration is part of the LogRhythm Pack.

Supported versions

Supported Cortex XSOAR versions: 5.5.0 and later.

LogRhythm security intelligence. This integration was integrated and tested with version 7.7 of LogRhythm Rest API. Previous versions that have been declared EOL by the vendor, are not supported.

Some changes have been made that might affect your existing content. If you are upgrading from a previous of this integration, see Breaking Changes.

Configure LogRhythmRest v2 on Cortex XSOAR

1. Navigate to Settings > Integrations > Servers & Services.

2. Search for LogRhythmRest v2.

3. Click Add instance to create and configure a new integration instance.

   Parameter	Required
   Server URL	True
   API Token	True
   Fetch incidents	False
   Incidents Fetch Interval	False
   First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)	False
   Incident type	False
   Alarms max fetch	False
   Cases max fetch	False
   Fetch incidents from type	True
   Alarm status filter	False
   Alarm rule name filter	False
   Case tags filter	False
   Case status filter	False
   Case priority filter	False
   Fetch case evidences	False
   Use system proxy settings	False
   Trust any certificate (not secure)	False

4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

lr-alarms-list

---

Gets the details of the alarms using the filter criteria.

Base Command

lr-alarms-list

Input

Argument Name	Description	Required
alarm_status	The alarm status. Possible values: "New", "Opened", "Working", "Escalated", Closed, "Closed_FalseAlarm", "Closed_Resolved", "Closed_Unresolved", "Closed_Reported", "Closed_Monitor". Possible values are: New, Opened, Working, Escalated, Closed, Closed_FalseAlarm, Closed_Resolved, Closed_Unresolved, Closed_Reported, Closed_Monitor.	Optional
offset	The number of alarms to skip before starting to collect the result set. Default is 0.	Optional
count	The numbers of alarms to return. Default is 50.	Optional
alarm_rule_name	Filter by alarm rule name.	Optional
entity_name	Filter by entity name.	Optional
alarm_id	Filter by alarm ID.	Optional
case_association	Filter by case ID.	Optional

Context Output

Path	Type	Description
LogRhythm.Alarm.alarmId	Number	The alarm ID.
LogRhythm.Alarm.alarmDataCached	String	A flag indicating whether the alarm data is cached.
LogRhythm.Alarm.alarmRuleName	String	The alarm rule name.
LogRhythm.Alarm.alarmStatus	String	The alarm status
LogRhythm.Alarm.dateInserted	Date	The alarm date inserted.
LogRhythm.Alarm.entityName	String	The alarm entity name.
LogRhythm.Alarm.associatedCases	String	The alarm associated cases.

Command Example

!lr-alarms-list count=2 alarm_status=Opened

Context Example

{

"LogRhythm": {

"Alarm": [

{

"alarmDataCached": "N",

"alarmId": 882,

"alarmRuleName": "LogRhythm Agent Heartbeat Missed",

"alarmStatus": "Opened",

"associatedCases": [

"7C2A040E-3014-41D5-ADF0-164A202D3518",

" 5FAA1AFB-5453-4FF7-92F8-28222A586368",

" 0795BCB1-28AA-4C3F-9739-B5431AE4004B"

],

"dateInserted": "2021-10-13T09:13:20.103",

"entityName": "EchoTestEntity"

},

{

"alarmDataCached": "N",

"alarmId": 334,

"alarmRuleName": "LogRhythm Agent Heartbeat Missed",

"alarmStatus": "Opened",

"associatedCases": [

"15E63C0A-91EC-49E6-9694-32A432DD657E",

" CCB51B6F-083D-442F-8E3F-67BD797A6B52",

" 10F65BB5-8B49-42FF-862E-ABDEDF1BA7DE",

" C52E0A86-D894-4424-A7A6-EE152B232146",

" 58437431-2117-4982-A2B1-FDEC2F083A43"

],

"dateInserted": "2021-08-29T11:30:48.083",

"entityName": "EchoTestEntity"

}

]

}

}

Human Readable Output

Alarms

Alarm Id	Alarm Status	Associated Cases	Alarm Rule Name	Date Inserted	Entity Name	Alarm Data Cached
882	Opened	7C2A040E-3014-41D5-ADF0-164A202D3518, 5FAA1AFB-5453-4FF7-92F8-28222A586368, 0795BCB1-28AA-4C3F-9739-B5431AE4004B	LogRhythm Agent Heartbeat Missed	2021-10-13T09:13:20.103	EchoTestEntity	N
334	Opened	15E63C0A-91EC-49E6-9694-32A432DD657E, CCB51B6F-083D-442F-8E3F-67BD797A6B52, 10F65BB5-8B49-42FF-862E-ABDEDF1BA7DE, C52E0A86-D894-4424-A7A6-EE152B232146, 58437431-2117-4982-A2B1-FDEC2F083A43	LogRhythm Agent Heartbeat Missed	2021-08-29T11:30:48.083	EchoTestEntity	N

lr-alarm-update

---

Updates the alarm status and RBP based on the alarm ID supplied. alarm_status or rbp are required.

Base Command

lr-alarm-update

Input

Argument Name	Description	Required
alarm_id	The alarm ID.	Required
alarm_status	The alarm status. Possible values: "New", "Opened", "Working", "Escalated", Closed, "Closed_FalseAlarm", "Closed_Resolved", "Closed_Unresolved", "Closed_Reported", "Closed_Monitor". Possible values are: New, Opened, Working, Escalated, Closed, Closed_FalseAlarm, Closed_Resolved, Closed_Unresolved, Closed_Reported, Closed_Monitor.	Optional
rbp	The alarm rbp.	Optional

Context Output

There is no context output for this command.

Command Example

!lr-alarm-update alarm_id=200 alarm_status=Closed rbp=100

Human Readable Output

Alarm 200 has been updated.

lr-alarm-add-comment

---

Updates the Alarm History table with comments in the Comments column based on the alarm ID supplied.

Base Command

lr-alarm-add-comment

Input

Argument Name	Description	Required
alarm_id	The alarm ID.	Required
alarm_comment	The alarm comment.	Required

Context Output

There is no context output for this command.

Command Example

!lr-alarm-add-comment alarm_id=200 alarm_comment=test

Human Readable Output

Comment added successfully to the alarm 200.

lr-alarm-history-list

---

Gets the alarm history details by ID and filter criteria.

Base Command

lr-alarm-history-list

Input

Argument Name	Description	Required
alarm_id	The alarm ID.	Required
person_id	Filter by person ID.	Optional
date_updated	Filter by when the alarm was updated. The returned value will be greater than or equal to the given date.	Optional
type	Filter by history type. Possible type: "comment", "status", and "rbp". Possible values are: comment, status, rbp.	Optional
offset	The number of items to skip before starting to collect the result set. Default is 0.	Optional
count	The numbers of items to return. Default is 50.	Optional

Context Output

Path	Type	Description
LogRhythm.AlarmHistory.alarmId	Number	The alarm ID.
LogRhythm.AlarmHistory.personId	Number	The ID of the person who edited the alarm (changed status/ added comment, etc.).
LogRhythm.AlarmHistory.comments	String	The alarm comments.
LogRhythm.AlarmHistory.dateInserted	Date	The date when the alarm was inserted.
LogRhythm.AlarmHistory.dateUpdated	Date	The date when the alarm was updated.

Command Example

!lr-alarm-history-list alarm_id=200 type=status

Context Example

{

"LogRhythm": {

"AlarmHistory": [

{

"alarmId": 200,

"comments": "Changed status to: Closed",

"dateInserted": "2021-10-30T20:16:33.673",

"dateUpdated": "2021-10-30T20:16:33.673",

"personId": 1

},

{

"alarmId": 200,

"comments": "Changed status to: Closed",

"dateInserted": "2021-08-31T15:02:00.127",

"dateUpdated": "2021-08-31T15:02:00.127",

"personId": 1

},

{

"alarmId": 200,

"comments": "Changed status to: Working",

"dateInserted": "2021-08-26T05:17:38.19",

"dateUpdated": "2021-08-26T05:17:38.19",

"personId": 1

},

{

"alarmId": 200,

"comments": "Changed status to: Working",

"dateInserted": "2021-08-26T05:15:57.89",

"dateUpdated": "2021-08-26T05:15:57.89",

"personId": 1

},

{

"alarmId": 200,

"comments": "Changed status to: Closed",

"dateInserted": "2021-08-19T15:31:32.68",

"dateUpdated": "2021-08-19T15:31:32.68",

"personId": 1

},

{

"alarmId": 200,

"comments": "Changed status to: Closed: Unresolved",

"dateInserted": "2021-08-19T15:02:08.6",

"dateUpdated": "2021-08-19T15:02:08.6",

"personId": 1

},

{

"alarmId": 200,

"comments": "Changed status to: Closed: Resolved",

"dateInserted": "2021-08-19T15:01:34.403",

"dateUpdated": "2021-08-19T15:01:34.403",

"personId": 1

},

{

"alarmId": 200,

"comments": "Changed status to: Escalated",

"dateInserted": "2021-08-19T15:01:04.353",

"dateUpdated": "2021-08-19T15:01:04.353",

"personId": 1

},

{

"alarmId": 200,

"comments": "Changed status to: Working",

"dateInserted": "2021-08-19T15:00:38.097",

"dateUpdated": "2021-08-19T15:00:38.097",

"personId": 1

},

{

"alarmId": 200,

"comments": "Changed status to: Opened",

"dateInserted": "2021-08-19T15:00:00.247",

"dateUpdated": "2021-08-19T15:00:00.247",

"personId": 1

},

{

"alarmId": 200,

"comments": "Changed status to: New",

"dateInserted": "2021-08-19T14:59:27.707",

"dateUpdated": "2021-08-19T14:59:27.707",

"personId": 1

},

{

"alarmId": 200,

"comments": "Changed status to: Closed: Monitor",

"dateInserted": "2021-08-19T14:58:06.113",

"dateUpdated": "2021-08-19T14:58:06.113",

"personId": 1

},

{

"alarmId": 200,

"comments": "Changed status to: Closed: False Alarm",

"dateInserted": "2021-08-19T14:57:35.607",

"dateUpdated": "2021-08-19T14:57:35.607",

"personId": 1

},

{

"alarmId": 200,

"comments": "Changed status to: Closed",

"dateInserted": "2021-08-19T14:56:36.82",

"dateUpdated": "2021-08-19T14:56:36.82",

"personId": 1

}

]

}

}

Human Readable Output

History for alarm 200

Alarm Id	Comments	Date Inserted	Date Updated	Person Id
200	Changed status to: Closed	2021-10-30T20:16:33.673	2021-10-30T20:16:33.673	1
200	Changed status to: Closed	2021-08-31T15:02:00.127	2021-08-31T15:02:00.127	1
200	Changed status to: Working	2021-08-26T05:17:38.19	2021-08-26T05:17:38.19	1
200	Changed status to: Working	2021-08-26T05:15:57.89	2021-08-26T05:15:57.89	1
200	Changed status to: Closed	2021-08-19T15:31:32.68	2021-08-19T15:31:32.68	1
200	Changed status to: Closed: Unresolved	2021-08-19T15:02:08.6	2021-08-19T15:02:08.6	1
200	Changed status to: Closed: Resolved	2021-08-19T15:01:34.403	2021-08-19T15:01:34.403	1
200	Changed status to: Escalated	2021-08-19T15:01:04.353	2021-08-19T15:01:04.353	1
200	Changed status to: Working	2021-08-19T15:00:38.097	2021-08-19T15:00:38.097	1
200	Changed status to: Opened	2021-08-19T15:00:00.247	2021-08-19T15:00:00.247	1
200	Changed status to: New	2021-08-19T14:59:27.707	2021-08-19T14:59:27.707	1
200	Changed status to: Closed: Monitor	2021-08-19T14:58:06.113	2021-08-19T14:58:06.113	1
200	Changed status to: Closed: False Alarm	2021-08-19T14:57:35.607	2021-08-19T14:57:35.607	1
200	Changed status to: Closed	2021-08-19T14:56:36.82	2021-08-19T14:56:36.82	1

lr-alarm-events-list

---

Gets a list of events for the specified alarm ID. Note: Currently, this command does not work as expected on LogRhythm's side. It always returns a list of one item, even if the given alarm ID is associated with more than one event.

Base Command

lr-alarm-events-list

Input

Argument Name	Description	Required
alarm_id	The alarm ID.	Required

Context Output

Path	Type	Description
LogRhythm.AlarmEvents.alarmId	Number	The alarm ID.
LogRhythm.AlarmEvents.account	String	The alarm event account.
LogRhythm.AlarmEvents.action	String	The alarm event action.
LogRhythm.AlarmEvents.amount	Unknown	The number of events related to the alarm.
LogRhythm.AlarmEvents.bytesIn	Number	The number of bytes received or input from a device, system, or process.
LogRhythm.AlarmEvents.bytesOut	Unknown	The number of bytes sent from a device, system, or process.
LogRhythm.AlarmEvents.classificationId	Number	The alarm event classification ID.
LogRhythm.AlarmEvents.classificationName	String	The alarm event classification name.
LogRhythm.AlarmEvents.classificationTypeName	String	The alarm event classification type.
LogRhythm.AlarmEvents.command	String	The specific command executed that was recorded in the log message.
LogRhythm.AlarmEvents.commonEventId	Number	The common event name.
LogRhythm.AlarmEvents.cve	String	The alarm event CVE.
LogRhythm.AlarmEvents.commonEventName	String	The alarm event name.
LogRhythm.AlarmEvents.count	Number	The number of alarm events.
LogRhythm.AlarmEvents.directionId	Number	The direction by ID of the activity between a log’s origin and impacted zones.
LogRhythm.AlarmEvents.directionName	String	The direction by name of the activity between a log’s origin and impacted zones. Values can be Internal, External, Outbound, Local, or Unknown.
LogRhythm.AlarmEvents.domain	String	The alarm event domain.
LogRhythm.AlarmEvents.duration	Number	The alarm event duration.
LogRhythm.AlarmEvents.entityId	Number	The alarm event entity ID.
LogRhythm.AlarmEvents.entityName	String	The alarm event entity name.
LogRhythm.AlarmEvents.group	String	The alarm event group.
LogRhythm.AlarmEvents.impactedEntityId	Number	The ID of the entity that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedEntityName	String	The name of the entity that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedHostId	Number	The ID of the host that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedHostName	String	The name of the host that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedInterface	String	The interface that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedIP	Unknown	The IP address that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedLocation.countryCode	String	The country code of the location that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedLocation.name	String	The country name of the location that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedLocation.latitude	Number	The latitude of the location that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedLocation.locationId	Number	The ID of the location that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedLocation.locationKey	String	The key of the location that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedLocation.longitude	Number	The longitude of the location that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedLocation.parentLocationId	Number	The parent location ID of the location that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedLocation.recordStatus	String	The record status of the location that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedLocation.regionCode	String	The region code of the location that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedLocation.type	String	The type of the location that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedLocation.dateUpdated	Date	The date the impacted location was last updated.
LogRhythm.AlarmEvents.impactedMAC	String	The MAC that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedName	String	The name of the event that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedNATIP	String	The NAT IP address that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedNATPort	Unknown	The NAT port that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedNetwork.beginIPRange.value	String	The beginning of the IP range for the network that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedNetwork.dateUpdated	Date	The date the impacted network was last updated.
LogRhythm.AlarmEvents.impactedNetwork.riskThreshold	String	The risk threshold of the network impacted by the alarm.
LogRhythm.AlarmEvents.impactedNetwork.endIPRange.value	String	The end of the IP range for the network that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedNetwork.entityId	Number	The ID of the entity for the network that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedNetwork.hostZone	String	The host zone for the network that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedNetwork.locationId	Number	The location ID of the network that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedNetwork.longDesc	String	The long description of the network that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedNetwork.name	String	The name of the network that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedNetwork.networkId	Number	The ID of the network that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedNetwork.recordStatus	String	The status of the record of the network that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedNetwork.shortDesc	String	The short description of the network that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedPort	Number	The port that was impacted by the alarm.
LogRhythm.AlarmEvents.impactedZone	String	The zone that was impacted by the alarm.
LogRhythm.AlarmEvents.itemsPacketsIn	Number	Items such as packets received or input from a device, system, or process.
LogRhythm.AlarmEvents.itemsPacketsOut	Number	Items such as packets sent from a device, system, or process.
LogRhythm.AlarmEvents.logDate	Date	The event log date.
LogRhythm.AlarmEvents.login	String	The user associated with the log activity.
LogRhythm.AlarmEvents.logMessage	String	The event log message.
LogRhythm.AlarmEvents.logSourceHostId	Unknown	The host ID of the log source of the event.
LogRhythm.AlarmEvents.logSourceHostName	String	The log source host name.
LogRhythm.AlarmEvents.logSourceName	String	The log source name.
LogRhythm.AlarmEvents.logSourceTypeName	String	The log source type.
LogRhythm.AlarmEvents.messageId	Number	The event message ID.
LogRhythm.AlarmEvents.mpeRuleId	Number	The event MPE rule ID,
LogRhythm.AlarmEvents.mpeRuleName	String	The event MPE rule name.
LogRhythm.AlarmEvents.normalDateMax	Date	If the message is aggregated, the maximum creation date contained in the group of logs. It can be in UTC or user-selected time zone.
LogRhythm.AlarmEvents.objectName	String	The object name of the event.
LogRhythm.AlarmEvents.objectType	String	The object type of the event.
LogRhythm.AlarmEvents.originEntityId	Number	The origin entity ID of the event.
LogRhythm.AlarmEvents.originEntityName	String	The origin entity name of the event.
LogRhythm.AlarmEvents.originHostId	Number	The host ID of where the event originated.
LogRhythm.AlarmEvents.originHostName	String	The host name of where the event originated.
LogRhythm.AlarmEvents.originInterface	String	The interface of where the event originated.
LogRhythm.AlarmEvents.originIP	Unknown	The IP address of where the event originated.
LogRhythm.AlarmEvents.originLocation.countryCode	String	The country code of the location of where the event originated.
LogRhythm.AlarmEvents.originLocation.name	String	The name of the location of where the event originated.
LogRhythm.AlarmEvents.originLocation.latitude	Number	The latitude of the location of where the event originated.
LogRhythm.AlarmEvents.originLocation.locationId	Number	The location ID of the location of where the event originated.
LogRhythm.AlarmEvents.originLocation.locationKey	String	The location key of where the event originated.
LogRhythm.AlarmEvents.originLocation.longitude	Number	The longitude of the location of where the event originated.
LogRhythm.AlarmEvents.originLocation.parentLocationId	Number	The parent location ID of where the event originated.
LogRhythm.AlarmEvents.originLocation.recordStatus	String	The record status of the location of where the event originated.
LogRhythm.AlarmEvents.originLocation.regionCode	String	The region code of the location of where the event originated.
LogRhythm.AlarmEvents.originLocation.type	String	The type of location of where the event originated.
LogRhythm.AlarmEvents.originLocation.dateUpdated	Date	The date the location of where the event originated was last updated.
LogRhythm.AlarmEvents.originMAC	String	The MAC address of where the event originated.
LogRhythm.AlarmEvents.originName	String	The name of where the event originated.
LogRhythm.AlarmEvents.originNATIP	String	The NAT IP address of where the event originated.
LogRhythm.AlarmEvents.originNATPort	Unknown	The NAT port of where the event originated.
LogRhythm.AlarmEvents.originNetwork.beginIPRange.value	String	The beginning address of the IP range of the network where the event originated.
LogRhythm.AlarmEvents.originNetwork.dateUpdated	Date	The date of the network when the event originate was last updated.
LogRhythm.AlarmEvents.originNetwork.riskThreshold	String	The risk threshold of the network where the event originated.
LogRhythm.AlarmEvents.originNetwork.endIPRange.value	String	The end of the IP range for the network where the event originated.
LogRhythm.AlarmEvents.originNetwork.entityId	Number	The entity ID of the network where the event originated.
LogRhythm.AlarmEvents.originNetwork.hostZone	String	The host zone of the network where the event originated.
LogRhythm.AlarmEvents.originNetwork.locationId	Number	The ID of the location of the network where the event originated.
LogRhythm.AlarmEvents.originNetwork.longDesc	String	The long description of the network where the event originated.
LogRhythm.AlarmEvents.originNetwork.name	String	The name of the network where the event originated.
LogRhythm.AlarmEvents.originNetwork.networkId	Number	The ID of the network where the event originated.
LogRhythm.AlarmEvents.originNetwork.recordStatus	String	The record status of the network where the event originated.
LogRhythm.AlarmEvents.originNetwork.shortDesc	String	The short description of the network where the event originated.
LogRhythm.AlarmEvents.originPort	Number	The port where the event originated.
LogRhythm.AlarmEvents.originZone	String	The zone where the event originated.
LogRhythm.AlarmEvents.parentProcessId	String	The parent process ID of the event.
LogRhythm.AlarmEvents.parentProcessName	String	The parent process name of the event.
LogRhythm.AlarmEvents.parentProcessPath	String	The parent process path of the event.
LogRhythm.AlarmEvents.policy	String	The event policy.
LogRhythm.AlarmEvents.priority	Number	The event priority.
LogRhythm.AlarmEvents.process	String	The event process.
LogRhythm.AlarmEvents.processId	Number	The event process ID.
LogRhythm.AlarmEvents.protocolId	Number	The event protocol ID.
LogRhythm.AlarmEvents.protocolName	String	The event protocol name.
LogRhythm.AlarmEvents.quantity	Number	The event quantity.
LogRhythm.AlarmEvents.rate	Number	The event rate.
LogRhythm.AlarmEvents.reason	String	The event reason.
LogRhythm.AlarmEvents.recipient	String	The event recipient.
LogRhythm.AlarmEvents.result	String	The event result.
LogRhythm.AlarmEvents.responseCode	String	The event response code.
LogRhythm.AlarmEvents.sender	String	The event sender.
LogRhythm.AlarmEvents.session	String	The event session.
LogRhythm.AlarmEvents.sessionType	String	The event session type.
LogRhythm.AlarmEvents.serialNumber	String	The event serial number.
LogRhythm.AlarmEvents.serviceId	Number	The event service ID.
LogRhythm.AlarmEvents.serviceName	String	The event service name.
LogRhythm.AlarmEvents.severity	String	The event severity.
LogRhythm.AlarmEvents.status	String	The event status.
LogRhythm.AlarmEvents.size	Number	The event size.
LogRhythm.AlarmEvents.subject	String	The event subject.
LogRhythm.AlarmEvents.threatId	String	The event threat ID.
LogRhythm.AlarmEvents.threatName	String	The event threat name.
LogRhythm.AlarmEvents.url	String	The event URL.
LogRhythm.AlarmEvents.userAgent	String	The event user agent.
LogRhythm.AlarmEvents.vendorInfo	String	The event vendor info.
LogRhythm.AlarmEvents.vendorMsgId	String	The event vendor message ID.
LogRhythm.AlarmEvents.version	String	The alarm event version
LogRhythm.AlarmEvents.originUserIdentityName	String	The event origin user identity.
LogRhythm.AlarmEvents.impactedUserIdentityName	String	The event impacted user identity.
LogRhythm.AlarmEvents.originUserIdentityId	Unknown	The event origin user identity ID.
LogRhythm.AlarmEvents.impactedUserIdentityId	Unknown	The event impacted user identity ID.
LogRhythm.AlarmEvents.senderIdentityId	Unknown	The event sender identity ID.
LogRhythm.AlarmEvents.senderIdentityName	String	The event sender identity name.
LogRhythm.AlarmEvents.recipientIdentityId	Unknown	The event recipient identity ID.
LogRhythm.AlarmEvents.recipientIdentityName	String	The event recipient identity.

Command Example

!lr-alarm-events-list alarm_id=200

Context Example

{

"LogRhythm": {

"AlarmEvents": {

"account": "",

"action": "",

"alarmId": 200,

"amount": null,

"bytesIn": null,

"bytesOut": null,

"classificationId": 3200,

"classificationName": "Error",

"classificationTypeName": "Operations",

"command": "",

"commonEventId": -1100003,

"commonEventName": "LogRhythm Agent Heartbeat Missed",

"count": 1,

"cve": "",

"directionId": 1,

"directionName": "Local",

"domain": "",

"duration": 0,

"entityId": 2,

"entityName": "EchoTestEntity",

"group": "",

"impactedEntityId": 2,

"impactedEntityName": "EchoTestEntity",

"impactedHostId": 3,

"impactedHostName": "",

"impactedIP": null,

"impactedInterface": "",

"impactedLocation": {

"countryCode": "",

"dateUpdated": "0001-01-01T00:00:00",

"latitude": 0,

"locationId": 0,

"locationKey": "",

"longitude": 0,

"name": "",

"parentLocationId": 0,

"recordStatus": "Deleted",

"regionCode": "",

"type": "NULL"

},

"impactedMAC": "",

"impactedNATIP": "",

"impactedNATPort": null,

"impactedName": "",

"impactedNetwork": {

"beginIPRange": {

"value": ""

},

"dateUpdated": "0001-01-01T00:00:00",

"endIPRange": {

"value": ""

},

"entityId": 0,

"hostZone": "Unknown",

"locationId": 0,

"longDesc": "",

"name": "",

"networkId": 0,

"recordStatus": "Deleted",

"riskThreshold": "",

"shortDesc": ""

},

"impactedPort": -1,

"impactedUserIdentityId": null,

"impactedUserIdentityName": "",

"impactedZone": "Internal",

"itemsPacketsIn": 0,

"itemsPacketsOut": 0,

"logDate": "2021-08-18T13:05:59.477",

"logMessage": "A heartbeat message from the LogRhythm System Monitor Agent service was not received in the allotted time.",

"logSourceHostId": null,

"logSourceHostName": "",

"logSourceName": "",

"logSourceTypeName": "",

"login": "",

"messageId": 32077,

"mpeRuleId": -1,

"mpeRuleName": "",

"normalDateMax": "0001-01-01T00:00:00",

"objectName": "",

"objectType": "",

"originEntityId": 2,

"originEntityName": "EchoTestEntity",

"originHostId": 3,

"originHostName": "",

"originIP": null,

"originInterface": "",

"originLocation": {

"countryCode": "",

"dateUpdated": "0001-01-01T00:00:00",

"latitude": 0,

"locationId": 0,

"locationKey": "",

"longitude": 0,

"name": "",

"parentLocationId": 0,

"recordStatus": "Deleted",

"regionCode": "",

"type": "NULL"

},

"originMAC": "",

"originNATIP": "",

"originNATPort": null,

"originName": "",

"originNetwork": {

"beginIPRange": {

"value": ""

},

"dateUpdated": "0001-01-01T00:00:00",

"endIPRange": {

"value": ""

},

"entityId": 0,

"hostZone": "Unknown",

"locationId": 0,

"longDesc": "",

"name": "",

"networkId": 0,

"recordStatus": "Deleted",

"riskThreshold": "",

"shortDesc": ""

},

"originPort": -1,

"originUserIdentityId": null,

"originUserIdentityName": "",

"originZone": "Internal",

"parentProcessId": "",

"parentProcessName": "",

"parentProcessPath": "",

"policy": "",

"priority": 100,

"process": "",

"processId": -1,

"protocolId": -1,

"protocolName": "",

"quantity": 0,

"rate": 0,

"reason": "",

"recipient": "",

"recipientIdentityId": null,

"recipientIdentityName": "",

"responseCode": "",

"result": "",

"sender": "",

"senderIdentityId": null,

"senderIdentityName": "",

"serialNumber": "",

"serviceId": -1000004,

"serviceName": "LogRhythm Agent",

"session": "",

"sessionType": "",

"severity": "",

"size": 0,

"status": "",

"subject": "",

"threatId": "",

"threatName": "",

"url": "",

"userAgent": "",

"vendorInfo": "",

"vendorMsgId": "",

"version": ""

}

}

}

Human Readable Output

Events for alarm 200

Common Event Name	Log Message	Priority	Log Date	Impacted Host Id	Impacted Zone	Service Name		Entity Name	Classification Name	Classification Type Name
LogRhythm Agent Heartbeat Missed	A heartbeat message from the LogRhythm System Monitor Agent service was not received in the allotted time.	100	2021-08-18T13:05:59.477	3	Internal	LogRhythm Agent		EchoTestEntity	Error	Operations

lr-alarm-summary

---

Get the alarm summary by the specified alarm ID.

Base Command

lr-alarm-summary

Input

Argument Name	Description	Required
alarm_id	Numeric ID of the alarm to get.	Required

Context Output

Path	Type	Description
LogRhythm.AlarmSummary.dateInserted	Date	The date the alarm was inserted.
LogRhythm.AlarmSummary.rbpMax	Number	The alarm rbp max.
LogRhythm.AlarmSummary.rbpAvg	Number	The alarm rbp average.
LogRhythm.AlarmSummary.alarmRuleId	Number	The alarm rule ID.
LogRhythm.AlarmSummary.alarmRuleGroup	String	The alarm rule group.
LogRhythm.AlarmSummary.briefDescription	String	The alarm brief description.
LogRhythm.AlarmSummary.additionalDetails	String	The alarm additional details.
LogRhythm.AlarmSummary.alarmId	Number	The alarm ID.
LogRhythm.AlarmSummary.alarmEventSummary.msgClassId	Number	The alarm summary message class ID.
LogRhythm.AlarmSummary.alarmEventSummary.msgClassName	String	The alarm summary message class name.
LogRhythm.AlarmSummary.alarmEventSummary.commonEventId	Number	The alarm summary common event ID.
LogRhythm.AlarmSummary.alarmEventSummary.commonEventName	String	The alarm summary common event name.
LogRhythm.AlarmSummary.alarmEventSummary.originHostId	Number	The alarm summary origin host ID.
LogRhythm.AlarmSummary.alarmEventSummary.impactedHostId	Number	The alarm summary impacted host ID
LogRhythm.AlarmSummary.alarmEventSummary.originUser	String	The alarm summary origin user.
LogRhythm.AlarmSummary.alarmEventSummary.impactedUser	String	The alarm summary impacted user.
LogRhythm.AlarmSummary.alarmEventSummary.originUserIdentityId	Unknown	The alarm summary origin user identity ID.
LogRhythm.AlarmSummary.alarmEventSummary.impactedUserIdentityId	Unknown	The alarm summary impacted user identity ID.
LogRhythm.AlarmSummary.alarmEventSummary.originUserIdentityName	String	The alarm summary origin user identity name.
LogRhythm.AlarmSummary.alarmEventSummary.impactedUserIdentityName	String	The alarm summary impacted user identity name.
LogRhythm.AlarmSummary.alarmEventSummary.originEntityName	String	The alarm summary origin entity name.
LogRhythm.AlarmSummary.alarmEventSummary.impactedEntityName	String	The alarm summary impacted entity name.

Command Example

!lr-alarm-summary alarm_id=200

Context Example

{

"LogRhythm": {

"AlarmSummary": {

"additionalDetails": "Action:\r\n1. Use LogRhythm to analyze and collect all information regarding the alarm, related events/logs, and surrounding logs from affected sources. \r\n2. Check System Monitor service health (try restarting). \r\n3. Check network connectivity between Agent and Mediator. \r\n4. Check scsm.log for errors. \r\n5. If the steps above do not provide a solution or if you require assistance, please contact LogRhythm Support.",

"alarmEventSummary": [

{

"commonEventId": -1100003,

"commonEventName": "LogRhythm Agent Heartbeat Missed",

"impactedEntityName": "EchoTestEntity",

"impactedHostId": 3,

"impactedUser": "",

"impactedUserIdentityId": null,

"impactedUserIdentityName": "",

"msgClassId": 3200,

"msgClassName": "Error",

"originEntityName": "EchoTestEntity",

"originHostId": 3,

"originUser": "",

"originUserIdentityId": null,

"originUserIdentityName": ""

}

],

"alarmId": 200,

"alarmRuleGroup": "LogRhythm Diagnostics",

"alarmRuleId": 98,

"briefDescription": "Alarms on the occurrence of a LogRhythm Agent Heartbeat Missed event which could indicate a LogRhythm Agent going down.",

"dateInserted": "2021-08-18T13:05:59.683",

"rbpAvg": 100,

"rbpMax": 100

}

}

}

Human Readable Output

Alarm summary

Additional Details	Alarm Id	Alarm Rule Group	Alarm Rule Id	Brief Description	Date Inserted	Rbp Avg	Rbp Max
Action: 1. Use LogRhythm to analyze and collect all information regarding the alarm, related events/logs, and surrounding logs from affected sources. 2. Check System Monitor service health (try restarting). 3. Check network connectivity between Agent and Mediator. 4. Check scsm.log for errors. 5. If the steps above do not provide a solution or if you require assistance, please contact LogRhythm Support.	200	LogRhythm Diagnostics	98	Alarms on the occurrence of a LogRhythm Agent Heartbeat Missed event which could indicate a LogRhythm Agent going down.	2021-08-18T13:05:59.683	100	100

Alarm event summary

Common Event Id	Common Event Name	Impacted Entity Name	Impacted Host Id	Impacted User	Impacted User Identity Id	Impacted User Identity Name	Msg Class Id	Msg Class Name	Origin Entity Name	Origin Host Id	Origin User	Origin User Identity Id	Origin User Identity Name
-1100003	LogRhythm Agent Heartbeat Missed	EchoTestEntity	3				3200	Error	EchoTestEntity	3

lr-alarm-drilldown

---

Gets the drill-down logs per rule block for a specific alarm Id that fired associated with an AIE alarm.

Base Command

lr-alarm-drilldown

Input

Argument Name	Description	Required
alarm_id	Numeric ID of the alarm to get.	Required

Context Output

Path	Type	Description
LogRhythm.AlarmDrilldown.AlarmID	Number	The alarm ID.
LogRhythm.AlarmDrilldown.AIERuleID	Number	The alarm AIE rule ID.
LogRhythm.AlarmDrilldown.Status.value	Number	The value of the drilldown request.
LogRhythm.AlarmDrilldown.Status.name	String	The name of the drilldown request.
LogRhythm.AlarmDrilldown.Status.description	String	The description of the drilldown request.
LogRhythm.AlarmDrilldown.RetryCount	Number	The number of times the Data Indexer is queried for the drill-down results.
LogRhythm.AlarmDrilldown.LastDxTimestamp	Date	The timestamp, in UTC, at which the Data Indexer was queried to obtain the drill-down results.
LogRhythm.AlarmDrilldown.DateInserted	Date	The timestamp, in UTC, when the Alarm was added to the cache.
LogRhythm.AlarmDrilldown.AlarmGuid	String	The unique identification of the Alarm GUID.
LogRhythm.AlarmDrilldown.WebConsoleId	String	The unique identification of the Web Console ID.
LogRhythm.AlarmDrilldown.NotificationSent	Boolean	The unique identification of the Alarm GUID.
LogRhythm.AlarmDrilldown.AIEMsgXml	String	The message XML associated with the event that triggered by the AI Engine.
LogRhythm.AlarmDrilldown.EventID	Number	The event ID associated with the AI Engine alarm.
LogRhythm.AlarmDrilldown.NormalMessageDate	Date	The date, in UTC, that specifies the time of occurrence of the log.
LogRhythm.AlarmDrilldown.RuleBlocks.RuleBlockID	Number	The Rule Block Id associated with the AI Engine rule that triggered the alarm.
LogRhythm.AlarmDrilldown.RuleBlocks.RuleBlockTypeID	Number	The type of rule block as specified in the Events Msg XML.
LogRhythm.AlarmDrilldown.RuleBlocks.DrillDownLogs	String	Logs that triggered the AI Engine rule associated with the rule block.
LogRhythm.AlarmDrilldown.RuleBlocks.AIECount	Number	The number of logs identified by the AI Engine that triggered the alarm.
LogRhythm.AlarmDrilldown.RuleBlocks.DXCount	Number	The number of logs stored in the Data Indexer that matched the drill-down criteria.
LogRhythm.AlarmDrilldown.RuleBlocks.NormalMessageDate	Date	The date, in UTC, that specifies the time of occurence of the log.
LogRhythm.AlarmDrilldown.RuleBlocks.NormalMessageDateUpper	Date	The date, in UTC, that specifies the upper bound for the rule block triggered.
LogRhythm.AlarmDrilldown.RuleBlocks.NormalMessageDateLower	Date	The date, in UTC, that specifies the lower bound for the rule block triggered.
LogRhythm.AlarmDrilldown.RuleBlocks.DDSummaries.SummaryFieldType	Number	The Summary Field type selected for the rule block.
LogRhythm.AlarmDrilldown.RuleBlocks.DDSummaries.DrillDownSummaries	String	The aggregate of the Summary Field type as found in the drill-down logs associated with the alarm.
LogRhythm.AlarmDrilldown.RuleBlocks.DDSummaries.DefaultValue	String	The value populated from the ARM when an alarm is added to the cache.

lr-get-alarm-details

---

Get the details of an alarm by the specified alarm ID.

Base Command

lr-get-alarm-details

Input

Argument Name	Description	Required
alarm_id	Numeric ID of the alarm to get.	Required

Context Output

Path	Type	Description
LogRhythm.AlarmDetails.alarmId	Number	The alarm ID.
LogRhythm.AlarmDetails.personId	Number	The person ID.
LogRhythm.AlarmDetails.entityId	Number	The entity ID.
LogRhythm.AlarmDetails.entityName	String	The name of the entity.
LogRhythm.AlarmDetails.alarmDate	String	The date in UTC of the alarm.
LogRhythm.AlarmDetails.alarmRuleID	Number	The Rule ID of the rule which triggered the alarm
LogRhythm.AlarmDetails.alarmRuleName	String	The name of the rule which triggered the alarm
LogRhythm.AlarmDetails.alarmStatus	String	The status of the alarm.
LogRhythm.AlarmDetails.alarmStatusName	String	The name for the status of the alarm.
LogRhythm.AlarmDetails.lastUpdatedID	Number	The ID of the last person to update the alarm.
LogRhythm.AlarmDetails.lastUpdatedName	String	The name of the last person to update the alarm.
LogRhythm.AlarmDetails.dateInserted	String	The date in UTC, that the alarm was inserted.
LogRhythm.AlarmDetails.dateUpdated	String	The date in UTC, that the alarm was updated.
LogRhythm.AlarmDetails.associatedCases	String	The cases associated with this alarm.
LogRhythm.AlarmDetails.lastPersonID	Number	The ID of the last person to edit this alarm.
LogRhythm.AlarmDetails.eventCount	Number	The amount of events that triggered this alarm.
LogRhythm.AlarmDetails.eventDateFirst	String	The date in UTC of the first event to trigger this alarm.
LogRhythm.AlarmDetails.eventDateLast	String	The date in UTC of the last event to trigger this alarm.
LogRhythm.AlarmDetails.rBPMax	Number	The maximum Risk Based Priority for this alarm.
LogRhythm.AlarmDetails.rBPAvg	Number	The average Risk Based Priority for this alarm.
LogRhythm.AlarmDetails.executionTarget	Number	The target which the alarm was executed against.
LogRhythm.AlarmDetails.alarmDataCached	String	The cached alarm data.

lr-cases-list

---

Get cases details using filter criteria.

Base Command

lr-cases-list

Input

Argument Name	Description	Required
case_id	The case ID by which to filter the results.	Optional
timestamp_filter_type	The type by which to filter case results combined with the argument timestamp. Possible values: "updatedAfter", "updatedBefore", "createdAfter", and "createdBefore". Possible values are: updatedAfter, updatedBefore, createdAfter, createdBefore.	Optional
timestamp	The timestamp by which to filter case results combined with the argument timestamp_filter_type.	Optional
priority	The priority by which to filter the results. Possible values: "1", "2", "3", "4", and "5", where 1 is the highest priority. Possible values are: 1, 2, 3, 4, 5.	Optional
status	The status by which to filter the results. Possible values are "1", (created), "2" (completed), "3" (incident), "4" (mitigated), and "5" (resolved). Possible values are: 1, 2, 3, 4, 5.	Optional
owners	A comma-separated list of owner numbers.	Optional
tags	A comma-separated list of tag numbers.	Optional
text	Filter results that have a case number or name that contains the specified value.	Optional
evidence_type	Filter results that have evidence of the specified type. Possible values: "alarm", "userEvents", "log", no"te, and "file". Possible values are: alarm, userEvents, log, note, file.	Optional
reference_id	Filter results that have evidence with the given reference identifier. For example, an alarm ID.	Optional
external_id	Filter results that have the specified, unique, external identifier.	Optional
offset	The number of cases to skip before starting to collect the result set. Default is 0.	Optional
count	The number of cases to return. Default is 50.	Optional

Context Output

Path	Type	Description
LogRhythm.Case.id	String	The case ID.
LogRhythm.Case.number	Number	The case number.
LogRhythm.Case.externalId	String	The case external ID.
LogRhythm.Case.dateCreated	Date	The date the case was created.
LogRhythm.Case.dateUpdated	Date	The date the case was updated.
LogRhythm.Case.dateClosed	Unknown	The date the case was closed.
LogRhythm.Case.owner.number	Number	The ID of the case owner.
LogRhythm.Case.owner.name	String	The name of the case owner.
LogRhythm.Case.owner.disabled	Boolean	Whether the case owner is disabled.
LogRhythm.Case.lastUpdatedBy.number	Number	The ID of the user who last updated the case.
LogRhythm.Case.lastUpdatedBy.name	String	The name of the user who last updated the case.
LogRhythm.Case.lastUpdatedBy.disabled	Boolean	Whether the user who last updated the case is disabled.
LogRhythm.Case.name	String	The case name.
LogRhythm.Case.status.name	String	The case status.
LogRhythm.Case.status.number	Number	The case status number.
LogRhythm.Case.priority	Number	The case priority.
LogRhythm.Case.dueDate	Date	The datetime the case is due.
LogRhythm.Case.resolution	Unknown	The case resolution.
LogRhythm.Case.resolutionDateUpdated	Unknown	The date the case resolution was last updated.
LogRhythm.Case.resolutionLastUpdatedBy	Unknown	The user who last updated the case resolution.
LogRhythm.Case.summary	String	The case summary.
LogRhythm.Case.entity.number	Number	The case entity number.
LogRhythm.Case.entity.name	String	The case entity name.
LogRhythm.Case.entity.fullName	String	The case entity full name.
LogRhythm.Case.collaborators.number	Number	The case collaborator number.
LogRhythm.Case.collaborators.name	String	The case collaborator name.
LogRhythm.Case.collaborators.disabled	Boolean	Whether the case collaborator is disabled.
LogRhythm.Case.tags.text	String	The case tag name.
LogRhythm.Case.tags.number	Number	The case tag number.

Command Example

!lr-cases-list priority=5

Context Example

{

"LogRhythm": {

"Case": [

{

"collaborators": [

{

"disabled": false,

"name": "LR Soap API",

"number": 1

}

],

"dateClosed": null,

"dateCreated": "2021-08-11T14:10:08.617291Z",

"dateUpdated": "2021-08-31T15:18:26.8118901Z",

"dueDate": "2021-08-12T14:10:08.617291Z",

"entity": {

"fullName": "Global Entity",

"name": "Global Entity",

"number": -100

},

"externalId": "",

"id": "B055F3D5-6F49-4D94-AEF1-FAEDC4A25251",

"lastUpdatedBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"name": "test case",

"number": 4,

"owner": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"priority": 5,

"resolution": null,

"resolutionDateUpdated": null,

"resolutionLastUpdatedBy": null,

"status": {

"name": "Incident",

"number": 3

},

"summary": "",

"tags": []

},

{

"collaborators": [

{

"disabled": false,

"name": "LR Soap API",

"number": 1

}

],

"dateClosed": null,

"dateCreated": "2021-08-11T14:19:48.7669718Z",

"dateUpdated": "2021-08-11T14:19:48.7669718Z",

"dueDate": "2021-08-12T14:19:48.7669718Z",

"entity": {

"fullName": "Global Entity",

"name": "Global Entity",

"number": -100

},

"externalId": "",

"id": "75081347-EB56-4AEA-A6F9-A6EB6662F48E",

"lastUpdatedBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"name": "test case from API",

"number": 5,

"owner": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"priority": 5,

"resolution": null,

"resolutionDateUpdated": null,

"resolutionLastUpdatedBy": null,

"status": {

"name": "Created",

"number": 1

},

"summary": "",

"tags": []

},

{

"collaborators": [

{

"disabled": false,

"name": "LR Soap API",

"number": 1

}

],

"dateClosed": null,

"dateCreated": "2021-10-05T10:53:07.0405063Z",

"dateUpdated": "2021-10-05T10:53:07.0405063Z",

"dueDate": "2021-10-06T10:53:07.0405063Z",

"entity": {

"fullName": "Global Entity",

"name": "Global Entity",

"number": -100

},

"externalId": "",

"id": "BB8EB00A-F4A7-4710-BB1C-E89DA7BF866B",

"lastUpdatedBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"name": "test",

"number": 35,

"owner": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"priority": 5,

"resolution": null,

"resolutionDateUpdated": null,

"resolutionLastUpdatedBy": null,

"status": {

"name": "Created",

"number": 1

},

"summary": "",

"tags": []

},

{

"collaborators": [

{

"disabled": false,

"name": "LR Soap API",

"number": 1

}

],

"dateClosed": null,

"dateCreated": "2021-10-06T06:13:06.6792318Z",

"dateUpdated": "2021-10-06T06:13:06.6792318Z",

"dueDate": "2021-10-07T06:13:06.6792318Z",

"entity": {

"fullName": "Global Entity",

"name": "Global Entity",

"number": -100

},

"externalId": "",

"id": "5091AD33-E29E-41A4-A975-E792EFCFF8E1",

"lastUpdatedBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"name": "test",

"number": 38,

"owner": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"priority": 5,

"resolution": null,

"resolutionDateUpdated": null,

"resolutionLastUpdatedBy": null,

"status": {

"name": "Created",

"number": 1

},

"summary": "",

"tags": []

},

{

"collaborators": [

{

"disabled": false,

"name": "LR Soap API",

"number": 1

}

],

"dateClosed": null,

"dateCreated": "2021-10-06T07:57:30.7682964Z",

"dateUpdated": "2021-10-06T07:57:30.7682964Z",

"dueDate": "2021-10-07T07:57:30.7682964Z",

"entity": {

"fullName": "Global Entity",

"name": "Global Entity",

"number": -100

},

"externalId": "",

"id": "B9F8031A-7420-4080-96A7-4FF9AB6B6ECF",

"lastUpdatedBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"name": "test",

"number": 39,

"owner": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"priority": 5,

"resolution": null,

"resolutionDateUpdated": null,

"resolutionLastUpdatedBy": null,

"status": {

"name": "Created",

"number": 1

},

"summary": "",

"tags": []

},

{

"collaborators": [

{

"disabled": false,

"name": "LR Soap API",

"number": 1

}

],

"dateClosed": null,

"dateCreated": "2021-10-06T09:30:58.6568951Z",

"dateUpdated": "2021-10-06T09:30:58.6568951Z",

"dueDate": "2021-10-07T09:30:58.6568951Z",

"entity": {

"fullName": "Global Entity",

"name": "Global Entity",

"number": -100

},

"externalId": "",

"id": "9D7AEA2E-F9D4-4787-9A9B-F8F0E9CE817E",

"lastUpdatedBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"name": "test1111",

"number": 40,

"owner": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"priority": 5,

"resolution": null,

"resolutionDateUpdated": null,

"resolutionLastUpdatedBy": null,

"status": {

"name": "Created",

"number": 1

},

"summary": "",

"tags": []

},

{

"collaborators": [

{

"disabled": false,

"name": "LR Soap API",

"number": 1

}

],

"dateClosed": null,

"dateCreated": "2021-10-06T09:37:39.7847983Z",

"dateUpdated": "2021-10-06T09:37:39.7847983Z",

"dueDate": "2021-10-07T09:37:39.7847983Z",

"entity": {

"fullName": "Global Entity",

"name": "Global Entity",

"number": -100

},

"externalId": "",

"id": "805BCD50-D301-4F20-9757-A96AC3B1E52C",

"lastUpdatedBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"name": "test1111",

"number": 41,

"owner": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"priority": 5,

"resolution": null,

"resolutionDateUpdated": null,

"resolutionLastUpdatedBy": null,

"status": {

"name": "Created",

"number": 1

},

"summary": "",

"tags": []

},

{

"collaborators": [

{

"disabled": false,

"name": "LR Soap API",

"number": 1

}

],

"dateClosed": null,

"dateCreated": "2021-10-06T09:44:06.4646762Z",

"dateUpdated": "2021-10-06T09:44:06.4646762Z",

"dueDate": "2021-10-07T09:44:06.4646762Z",

"entity": {

"fullName": "Global Entity",

"name": "Global Entity",

"number": -100

},

"externalId": "",

"id": "FE8A7A3F-2D33-449F-83A5-09D3351E67DC",

"lastUpdatedBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"name": "test1111",

"number": 42,

"owner": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"priority": 5,

"resolution": null,

"resolutionDateUpdated": null,

"resolutionLastUpdatedBy": null,

"status": {

"name": "Created",

"number": 1

},

"summary": "",

"tags": []

},

{

"collaborators": [

{

"disabled": false,

"name": "LR Soap API",

"number": 1

}

],

"dateClosed": null,

"dateCreated": "2021-10-18T11:45:02.190818Z",

"dateUpdated": "2021-10-18T11:45:02.190818Z",

"dueDate": "2021-10-19T11:45:02.190818Z",

"entity": {

"fullName": "Global Entity",

"name": "Global Entity",

"number": -100

},

"externalId": "",

"id": "01825095-3D3E-4082-9F3D-29BC68EBCE9F",

"lastUpdatedBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"name": "test123123",

"number": 58,

"owner": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"priority": 5,

"resolution": null,

"resolutionDateUpdated": null,

"resolutionLastUpdatedBy": null,

"status": {

"name": "Created",

"number": 1

},

"summary": "",

"tags": []

},

{

"collaborators": [

{

"disabled": false,

"name": "LR Soap API",

"number": 1

}

],

"dateClosed": null,

"dateCreated": "2021-10-19T05:44:36.6091003Z",

"dateUpdated": "2021-10-19T05:44:36.6091003Z",

"dueDate": "2021-10-20T05:44:36.6091003Z",

"entity": {

"fullName": "Global Entity",

"name": "Global Entity",

"number": -100

},

"externalId": "",

"id": "97F336B2-D18E-438A-8FB1-7F49DCB0A867",

"lastUpdatedBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"name": "test777777",

"number": 59,

"owner": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"priority": 5,

"resolution": null,

"resolutionDateUpdated": null,

"resolutionLastUpdatedBy": null,

"status": {

"name": "Created",

"number": 1

},

"summary": "",

"tags": []

},

{

"collaborators": [

{

"disabled": false,

"name": "LR Soap API",

"number": 1

}

],

"dateClosed": null,

"dateCreated": "2021-10-19T05:51:51.6372007Z",

"dateUpdated": "2021-10-19T05:51:51.6372007Z",

"dueDate": "2021-10-20T05:51:51.6372007Z",

"entity": {

"fullName": "Global Entity",

"name": "Global Entity",

"number": -100

},

"externalId": "",

"id": "064C632E-E7E8-4913-A123-EB6153FE4BE4",

"lastUpdatedBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"name": "test777777",

"number": 60,

"owner": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"priority": 5,

"resolution": null,

"resolutionDateUpdated": null,

"resolutionLastUpdatedBy": null,

"status": {

"name": "Created",

"number": 1

},

"summary": "",

"tags": []

}

]

}

}

Human Readable Output

Cases

Collaborators	Date Closed	Date Created	Date Updated	Due Date	Entity	External Id	Id	Last Updated By	Name	Number	Owner	Priority	Resolution	Resolution Date Updated	Resolution Last Updated By	Status	Summary	Tags
{'number': 1, 'name': 'LR Soap API', 'disabled': False}		2021-08-11T14:10:08.617291Z	2021-08-31T15:18:26.8118901Z	2021-08-12T14:10:08.617291Z	number: -100 name: Global Entity fullName: Global Entity		B055F3D5-6F49-4D94-AEF1-FAEDC4A25251	number: 1 name: LR Soap API disabled: false	test case	4	number: 1 name: LR Soap API disabled: false	5				name: Incident number: 3
{'number': 1, 'name': 'LR Soap API', 'disabled': False}		2021-08-11T14:19:48.7669718Z	2021-08-11T14:19:48.7669718Z	2021-08-12T14:19:48.7669718Z	number: -100 name: Global Entity fullName: Global Entity		75081347-EB56-4AEA-A6F9-A6EB6662F48E	number: 1 name: LR Soap API disabled: false	test case from API	5	number: 1 name: LR Soap API disabled: false	5				name: Created number: 1
{'number': 1, 'name': 'LR Soap API', 'disabled': False}		2021-10-05T10:53:07.0405063Z	2021-10-05T10:53:07.0405063Z	2021-10-06T10:53:07.0405063Z	number: -100 name: Global Entity fullName: Global Entity		BB8EB00A-F4A7-4710-BB1C-E89DA7BF866B	number: 1 name: LR Soap API disabled: false	test	35	number: 1 name: LR Soap API disabled: false	5				name: Created number: 1
{'number': 1, 'name': 'LR Soap API', 'disabled': False}		2021-10-06T06:13:06.6792318Z	2021-10-06T06:13:06.6792318Z	2021-10-07T06:13:06.6792318Z	number: -100 name: Global Entity fullName: Global Entity		5091AD33-E29E-41A4-A975-E792EFCFF8E1	number: 1 name: LR Soap API disabled: false	test	38	number: 1 name: LR Soap API disabled: false	5				name: Created number: 1
{'number': 1, 'name': 'LR Soap API', 'disabled': False}		2021-10-06T07:57:30.7682964Z	2021-10-06T07:57:30.7682964Z	2021-10-07T07:57:30.7682964Z	number: -100 name: Global Entity fullName: Global Entity		B9F8031A-7420-4080-96A7-4FF9AB6B6ECF	number: 1 name: LR Soap API disabled: false	test	39	number: 1 name: LR Soap API disabled: false	5				name: Created number: 1
{'number': 1, 'name': 'LR Soap API', 'disabled': False}		2021-10-06T09:30:58.6568951Z	2021-10-06T09:30:58.6568951Z	2021-10-07T09:30:58.6568951Z	number: -100 name: Global Entity fullName: Global Entity		9D7AEA2E-F9D4-4787-9A9B-F8F0E9CE817E	number: 1 name: LR Soap API disabled: false	test1111	40	number: 1 name: LR Soap API disabled: false	5				name: Created number: 1
{'number': 1, 'name': 'LR Soap API', 'disabled': False}		2021-10-06T09:37:39.7847983Z	2021-10-06T09:37:39.7847983Z	2021-10-07T09:37:39.7847983Z	number: -100 name: Global Entity fullName: Global Entity		805BCD50-D301-4F20-9757-A96AC3B1E52C	number: 1 name: LR Soap API disabled: false	test1111	41	number: 1 name: LR Soap API disabled: false	5				name: Created number: 1
{'number': 1, 'name': 'LR Soap API', 'disabled': False}		2021-10-06T09:44:06.4646762Z	2021-10-06T09:44:06.4646762Z	2021-10-07T09:44:06.4646762Z	number: -100 name: Global Entity fullName: Global Entity		FE8A7A3F-2D33-449F-83A5-09D3351E67DC	number: 1 name: LR Soap API disabled: false	test1111	42	number: 1 name: LR Soap API disabled: false	5				name: Created number: 1
{'number': 1, 'name': 'LR Soap API', 'disabled': False}		2021-10-18T11:45:02.190818Z	2021-10-18T11:45:02.190818Z	2021-10-19T11:45:02.190818Z	number: -100 name: Global Entity fullName: Global Entity		01825095-3D3E-4082-9F3D-29BC68EBCE9F	number: 1 name: LR Soap API disabled: false	test123123	58	number: 1 name: LR Soap API disabled: false	5				name: Created number: 1
{'number': 1, 'name': 'LR Soap API', 'disabled': False}		2021-10-19T05:44:36.6091003Z	2021-10-19T05:44:36.6091003Z	2021-10-20T05:44:36.6091003Z	number: -100 name: Global Entity fullName: Global Entity		97F336B2-D18E-438A-8FB1-7F49DCB0A867	number: 1 name: LR Soap API disabled: false	test777777	59	number: 1 name: LR Soap API disabled: false	5				name: Created number: 1
{'number': 1, 'name': 'LR Soap API', 'disabled': False}		2021-10-19T05:51:51.6372007Z	2021-10-19T05:51:51.6372007Z	2021-10-20T05:51:51.6372007Z	number: -100 name: Global Entity fullName: Global Entity		064C632E-E7E8-4913-A123-EB6153FE4BE4	number: 1 name: LR Soap API disabled: false	test777777	60	number: 1 name: LR Soap API disabled: false	5				name: Created number: 1

lr-case-create

---

Create a new case.

Base Command

lr-case-create

Input

Argument Name	Description	Required
name	Name of the case.	Required
priority	The priority by which to filter the results. Possible values: "1", "2", "3", "4", and "5", where 1 is the highest priority. Possible values are: 1, 2, 3, 4, 5.	Required
external_id	Externally defined identifier for the case.	Optional
due_date	The timedate of when the case is due, as an RFC 3339 formatted string. E.g., 2020-04-20T14:15:22Z.	Optional
summary	Note summarizing the case.	Optional

Context Output

Path	Type	Description
LogRhythm.Case.id	String	The case ID.
LogRhythm.Case.number	Number	The case number.
LogRhythm.Case.externalId	String	The case external ID.
LogRhythm.Case.dateCreated	Date	The date the case was created.
LogRhythm.Case.dateUpdated	Date	The date the case was updated.
LogRhythm.Case.dateClosed	Unknown	The date the case was closed.
LogRhythm.Case.owner.number	Number	The ID of the case owner.
LogRhythm.Case.owner.name	String	The name of the case owner.
LogRhythm.Case.owner.disabled	Boolean	Whether the owner is disabled.
LogRhythm.Case.lastUpdatedBy.number	Number	The ID of the user who last updated the case.
LogRhythm.Case.lastUpdatedBy.name	String	The name of the user who last updated the case.
LogRhythm.Case.lastUpdatedBy.disabled	Boolean	Whether the last user who updated the case is disabled.
LogRhythm.Case.name	String	The case name.
LogRhythm.Case.status.name	String	The case status.
LogRhythm.Case.status.number	Number	The case status number.
LogRhythm.Case.priority	Number	The case priority.
LogRhythm.Case.dueDate	Date	The datetime the case is due.
LogRhythm.Case.resolution	Unknown	The case resolution.
LogRhythm.Case.resolutionDateUpdated	Unknown	The date the case resolution was last updated.
LogRhythm.Case.resolutionLastUpdatedBy	Unknown	The user who last updated the case resolution.
LogRhythm.Case.summary	String	The case summary.
LogRhythm.Case.entity.number	Number	The case entity number.
LogRhythm.Case.entity.name	String	The case entity name.
LogRhythm.Case.entity.fullName	String	The case entity full name.
LogRhythm.Case.collaborators.number	Number	The case collaborator number.
LogRhythm.Case.collaborators.name	String	The case collaborator name.
LogRhythm.Case.collaborators.disabled	Boolean	Whether the case collaborator is disabled.
LogRhythm.Case.tags.text	String	The case tag name.
LogRhythm.Case.tags.number	Number	The case tag number.

Command Example

``!lr-case-create name=test priority=1 external_id=8200 summary=test case````

Context Example

{

"LogRhythm": {

"Case": {

"collaborators": [

{

"disabled": false,

"name": "LR Soap API",

"number": 1

}

],

"dateClosed": null,

"dateCreated": "2021-10-30T20:33:44.6636405Z",

"dateUpdated": "2021-10-30T20:33:44.6636405Z",

"dueDate": "2021-10-31T20:33:44.6636405Z",

"entity": {

"fullName": "Global Entity",

"name": "Global Entity",

"number": -100

},

"externalId": "8200",

"id": "83E66AB6-5F9A-441E-BF96-52CA53E20BEA",

"lastUpdatedBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"name": "test",

"number": 98,

"owner": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"priority": 1,

"resolution": null,

"resolutionDateUpdated": null,

"resolutionLastUpdatedBy": null,

"status": {

"name": "Created",

"number": 1

},

"summary": "test case",

"tags": []

}

}

}

Human Readable Output

Case created successfully

Collaborators	Date Closed	Date Created	Date Updated	Due Date	Entity	External Id	Id	Last Updated By	Name	Number	Owner	Priority	Resolution	Resolution Date Updated	Resolution Last Updated By	Status	Summary	Tags
{'number': 1, 'name': 'LR Soap API', 'disabled': False}		2021-10-30T20:33:44.6636405Z	2021-10-30T20:33:44.6636405Z	2021-10-31T20:33:44.6636405Z	number: -100 name: Global Entity fullName: Global Entity	8200	83E66AB6-5F9A-441E-BF96-52CA53E20BEA	number: 1 name: LR Soap API disabled: false	test	98	number: 1 name: LR Soap API disabled: false	1				name: Created number: 1	test case

lr-case-update

---

Update case information. For example, the case name, priority, and due date.

Base Command

lr-case-update

Input

Argument Name	Description	Required
case_id	Unique identifier for the case.	Required
name	Name of the case.	Optional
priority	The priority of the case. Possible values: "1", "2", "3", "4", and "5", where 1 is the highest priority. Possible values are: 1, 2, 3, 4, 5.	Optional
external_id	Externally defined identifier for the case.	Optional
due_date	The timedate of when the case is due, as an RFC 3339 formatted string. E.g., 2020-04-20T14:15:22Z.	Optional
summary	Note summarizing the case.	Optional
entity_id	Entity to assign to the case.	Optional
resolution	Description of how the case was resolved.	Optional

Context Output

Path	Type	Description
LogRhythm.Case.id	String	The case ID.
LogRhythm.Case.number	Number	The case number.
LogRhythm.Case.externalId	String	The case external ID.
LogRhythm.Case.dateCreated	Date	The date the case was created.
LogRhythm.Case.dateUpdated	Date	The date the case was updated.
LogRhythm.Case.dateClosed	Unknown	The date the case was closed.
LogRhythm.Case.owner.number	Number	The ID of the case owner.
LogRhythm.Case.owner.name	String	The name of the case owner.
LogRhythm.Case.owner.disabled	Boolean	Whether the owner is disabled.
LogRhythm.Case.lastUpdatedBy.number	Number	The ID of the user who last updated the case.
LogRhythm.Case.lastUpdatedBy.name	String	The name of the user who last updated the case.
LogRhythm.Case.lastUpdatedBy.disabled	Boolean	Whether the last user who updated the case is disabled.
LogRhythm.Case.name	String	The case name.
LogRhythm.Case.status.name	String	The case status.
LogRhythm.Case.status.number	Number	The case status number.
LogRhythm.Case.priority	Number	The case priority.
LogRhythm.Case.dueDate	Date	The datetime the case is due.
LogRhythm.Case.resolution	Unknown	The case resolution.
LogRhythm.Case.resolutionDateUpdated	Unknown	The date the case resolution was last updated.
LogRhythm.Case.resolutionLastUpdatedBy	Unknown	The user who last updated the case resolution.
LogRhythm.Case.summary	String	The case summary.
LogRhythm.Case.entity.number	Number	The case entity number.
LogRhythm.Case.entity.name	String	The case entity name.
LogRhythm.Case.entity.fullName	String	The case entity full name.
LogRhythm.Case.collaborators.number	Number	The case collaborator number.
LogRhythm.Case.collaborators.name	String	The case collaborator name.
LogRhythm.Case.collaborators.disabled	Boolean	Whether the case collaborator is disabled.
LogRhythm.Case.tags.text	String	The case tag name.
LogRhythm.Case.tags.number	Number	The case tag number.

Command Example

!lr-case-update case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE priority=3

Context Example

{

"LogRhythm": {

"Case": {

"collaborators": [

{

"disabled": false,

"name": "LR Soap API",

"number": 1

}

],

"dateClosed": null,

"dateCreated": "2021-08-19T15:38:07.8995494Z",

"dateUpdated": "2021-08-31T15:31:24.9870972Z",

"dueDate": "2021-08-20T15:38:07.8995494Z",

"entity": {

"fullName": "Global Entity",

"name": "Global Entity",

"number": -100

},

"externalId": "9930",

"id": "2E7FA20D-191E-4733-B7DC-A18BBFE762CE",

"lastUpdatedBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"name": "test",

"number": 17,

"owner": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"priority": 3,

"resolution": null,

"resolutionDateUpdated": null,

"resolutionLastUpdatedBy": null,

"status": {

"name": "Incident",

"number": 3

},

"summary": "test case",

"tags": []

}

}

}

Human Readable Output

Case 2E7FA20D-191E-4733-B7DC-A18BBFE762CE updated successfully

Collaborators	Date Closed	Date Created	Date Updated	Due Date	Entity	External Id	Id	Last Updated By	Name	Number	Owner	Priority	Resolution	Resolution Date Updated	Resolution Last Updated By	Status	Summary	Tags
{'number': 1, 'name': 'LR Soap API', 'disabled': False}		2021-08-19T15:38:07.8995494Z	2021-08-31T15:31:24.9870972Z	2021-08-20T15:38:07.8995494Z	number: -100 name: Global Entity fullName: Global Entity	9930	2E7FA20D-191E-4733-B7DC-A18BBFE762CE	number: 1 name: LR Soap API disabled: false	test	17	number: 1 name: LR Soap API disabled: false	3				name: Incident number: 3	test case

lr-case-status-change

---

Update the status of a case.

Base Command

lr-case-status-change

Input

Argument Name	Description	Required
case_id	Unique identifier for the case.	Required
status	The case status. Possible values: "Created", "Completed", "Incident", "Mitigated", and "Resolved". Possible values are: Created, Completed, Incident, Mitigated, Resolved.	Required

Context Output

Path	Type	Description
LogRhythm.Case.id	String	The case ID.
LogRhythm.Case.number	Number	The case number.
LogRhythm.Case.externalId	String	The case external ID.
LogRhythm.Case.dateCreated	Date	The date the case was created.
LogRhythm.Case.dateUpdated	Date	The date the case was updated.
LogRhythm.Case.dateClosed	Unknown	The date the case was closed.
LogRhythm.Case.owner.number	Number	The ID of the case owner.
LogRhythm.Case.owner.name	String	The name of the case owner.
LogRhythm.Case.owner.disabled	Boolean	Whether the owner is disabled.
LogRhythm.Case.lastUpdatedBy.number	Number	The ID of the user who last updated the case.
LogRhythm.Case.lastUpdatedBy.name	String	The name of the user who last updated the case.
LogRhythm.Case.lastUpdatedBy.disabled	Boolean	Whether the last user who updated the case is disabled.
LogRhythm.Case.name	String	The case name.
LogRhythm.Case.status.name	String	The case status.
LogRhythm.Case.status.number	Number	The case status number.
LogRhythm.Case.priority	Number	The case priority.
LogRhythm.Case.dueDate	Date	The datetime the case is due.
LogRhythm.Case.resolution	Unknown	The case resolution.
LogRhythm.Case.resolutionDateUpdated	Unknown	The date the case resolution was last updated.
LogRhythm.Case.resolutionLastUpdatedBy	Unknown	The user who last updated the case resolution.
LogRhythm.Case.summary	String	The case summary.
LogRhythm.Case.entity.number	Number	The case entity number.
LogRhythm.Case.entity.name	String	The case entity name.
LogRhythm.Case.entity.fullName	String	The case entity full name.
LogRhythm.Case.collaborators.number	Number	The case collaborator number.
LogRhythm.Case.collaborators.name	String	The case collaborator name.
LogRhythm.Case.collaborators.disabled	Boolean	Whether the case collaborator is disabled.
LogRhythm.Case.tags.text	String	The case tag name.
LogRhythm.Case.tags.number	Number	The case tag number.

Command Example

!lr-case-status-change case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE status=Incident

Context Example

{

"LogRhythm": {

"Case": {

"collaborators": [

{

"disabled": false,

"name": "LR Soap API",

"number": 1

}

],

"dateClosed": null,

"dateCreated": "2021-08-19T15:38:07.8995494Z",

"dateUpdated": "2021-08-31T15:31:24.9870972Z",

"dueDate": "2021-08-20T15:38:07.8995494Z",

"entity": {

"fullName": "Global Entity",

"name": "Global Entity",

"number": -100

},

"externalId": "9930",

"id": "2E7FA20D-191E-4733-B7DC-A18BBFE762CE",

"lastUpdatedBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"name": "test",

"number": 17,

"owner": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"priority": 3,

"resolution": null,

"resolutionDateUpdated": null,

"resolutionLastUpdatedBy": null,

"status": {

"name": "Incident",

"number": 3

},

"summary": "test case",

"tags": []

}

}

}

Human Readable Output

Case status updated successfully

Collaborators	Date Closed	Date Created	Date Updated	Due Date	Entity	External Id	Id	Last Updated By	Name	Number	Owner	Priority	Resolution	Resolution Date Updated	Resolution Last Updated By	Status	Summary	Tags
{'number': 1, 'name': 'LR Soap API', 'disabled': False}		2021-08-19T15:38:07.8995494Z	2021-08-31T15:31:24.9870972Z	2021-08-20T15:38:07.8995494Z	number: -100 name: Global Entity fullName: Global Entity	9930	2E7FA20D-191E-4733-B7DC-A18BBFE762CE	number: 1 name: LR Soap API disabled: false	test	17	number: 1 name: LR Soap API disabled: false	3				name: Incident number: 3	test case

lr-case-evidence-list

---

Return a list of evidence summaries for a case.

Base Command

lr-case-evidence-list

Input

Argument Name	Description	Required
case_id	Unique identifier for the case.	Required
evidence_type	Filter results that have evidence of the specified type. Possible values are: "alarm", "userEvents", "log", "note", and "file". Possible values are: alarm, userEvents, log, note, file.	Optional
status	Filter results that have a specific evidence status. Possible values: "pending", "completed", and "failed". Possible values are: pending, completed, failed.	Optional
evidence_number	Filter results by evidence number.	Optional

Context Output

Path	Type	Description
LogRhythm.CaseEvidence.CaseID	String	The case ID.
LogRhythm.CaseEvidence.Evidences.number	Number	The evidence number.
LogRhythm.CaseEvidence.Evidences.dateCreated	Date	The date the evidence was created.
LogRhythm.CaseEvidence.Evidences.dateUpdated	Date	The date the evidence was updated.
LogRhythm.CaseEvidence.Evidences.createdBy.number	Number	The ID of the user who created the evidence.
LogRhythm.CaseEvidence.Evidences.createdBy.name	String	The name of the user who created the evidence.
LogRhythm.CaseEvidence.Evidences.createdBy.disabled	Boolean	Whether the user is disabled.
LogRhythm.CaseEvidence.Evidences.lastUpdatedBy.number	Number	The ID of the user who last updated the case evidence.
LogRhythm.CaseEvidence.Evidences.lastUpdatedBy.name	String	The name of the user who last updated the case evidence.
LogRhythm.CaseEvidence.Evidences.lastUpdatedBy.disabled	Boolean	Whether the last user who updated the case evidence is disabled.
LogRhythm.CaseEvidence.Evidences.type	String	The evidence type.
LogRhythm.CaseEvidence.Evidences.status	String	The evidence status
LogRhythm.CaseEvidence.Evidences.statusMessage	Unknown	The evidence status message.
LogRhythm.CaseEvidence.Evidences.text	String	The evidence text.
LogRhythm.CaseEvidence.Evidences.pinned	Boolean	Whether the evidence is pinned.
LogRhythm.CaseEvidence.Evidences.datePinned	Unknown	The date the evidence was pinned.

Command Example

!lr-case-evidence-list case_id=583A7DAA-872A-4ECE-80B8-0DECB6FC3061

Context Example

{

"LogRhythm": {

"CaseEvidence": {

"CaseID": "583A7DAA-872A-4ECE-80B8-0DECB6FC3061",

"Evidences": [

{

"alarm": {

"alarmDate": "2021-08-19T13:08:08.713Z",

"alarmId": 212,

"alarmRuleId": 98,

"alarmRuleName": "LogRhythm Agent Heartbeat Missed",

"dateInserted": "2021-08-19T13:08:08.727Z",

"entityId": 2,

"entityName": "EchoTestEntity",

"riskBasedPriorityMax": 39

},

"createdBy": {

"disabled": false,

"name": "LogRhythm Administrator",

"number": -100

},

"dateCreated": "2021-08-19T14:21:01.7066667Z",

"datePinned": null,

"dateUpdated": "2021-08-19T14:21:01.7066667Z",

"lastUpdatedBy": {

"disabled": false,

"name": "LogRhythm Administrator",

"number": -100

},

"number": 58,

"pinned": false,

"status": "completed",

"statusMessage": null,

"text": "",

"type": "alarm"

},

{

"alarm": {

"alarmDate": "2021-08-19T11:07:56.86Z",

"alarmId": 211,

"alarmRuleId": 98,

"alarmRuleName": "LogRhythm Agent Heartbeat Missed",

"dateInserted": "2021-08-19T11:07:56.877Z",

"entityId": 2,

"entityName": "EchoTestEntity",

"riskBasedPriorityMax": 39

},

"createdBy": {

"disabled": false,

"name": "LogRhythm Administrator",

"number": -100

},

"dateCreated": "2021-08-19T14:21:11.7766667Z",

"datePinned": null,

"dateUpdated": "2021-08-19T14:21:11.7766667Z",

"lastUpdatedBy": {

"disabled": false,

"name": "LogRhythm Administrator",

"number": -100

},

"number": 59,

"pinned": false,

"status": "completed",

"statusMessage": null,

"text": "",

"type": "alarm"

},

{

"createdBy": {

"disabled": false,

"name": "LogRhythm Administrator",

"number": -100

},

"dateCreated": "2021-08-19T14:25:33.5976206Z",

"datePinned": null,

"dateUpdated": "2021-08-19T14:25:33.5976206Z",

"lastUpdatedBy": {

"disabled": false,

"name": "LogRhythm Administrator",

"number": -100

},

"number": 61,

"pinned": false,

"status": "completed",

"statusMessage": null,

"text": "test note",

"type": "note"

}

]

}

}

}

Human Readable Output

Evidences for case 583A7DAA-872A-4ECE-80B8-0DECB6FC3061

Number	Type	Status	Date Created	Created By	Text	Alarm	File
58	alarm	completed	2021-08-19T14:21:01.7066667Z	number: -100 name: LogRhythm Administrator disabled: false		alarmId: 212 alarmDate: 2021-08-19T13:08:08.713Z alarmRuleId: 98 alarmRuleName: LogRhythm Agent Heartbeat Missed dateInserted: 2021-08-19T13:08:08.727Z entityId: 2 entityName: EchoTestEntity riskBasedPriorityMax: 39
59	alarm	completed	2021-08-19T14:21:11.7766667Z	number: -100 name: LogRhythm Administrator disabled: false		alarmId: 211 alarmDate: 2021-08-19T11:07:56.86Z alarmRuleId: 98 alarmRuleName: LogRhythm Agent Heartbeat Missed dateInserted: 2021-08-19T11:07:56.877Z entityId: 2 entityName: EchoTestEntity riskBasedPriorityMax: 39
61	note	completed	2021-08-19T14:25:33.5976206Z	number: -100 name: LogRhythm Administrator disabled: false	test note

lr-case-alarm-evidence-add

---

Add multiple alarms as evidence on a case.

Base Command

lr-case-alarm-evidence-add

Input

Argument Name	Description	Required
case_id	Unique identifier for the case.	Required
alarm_numbers	A comma-separated list of alarm IDs.	Required

Context Output

Path	Type	Description
LogRhythm.AlarmEvidence.CaseID	String	The case ID.
LogRhythm.AlarmEvidence.Evidences.number	Number	The evidence number.
LogRhythm.AlarmEvidence.Evidences.dateCreated	Date	The date the evidence was created.
LogRhythm.AlarmEvidence.Evidences.dateUpdated	Date	The date the evidence was updated.
LogRhythm.AlarmEvidence.Evidences.createdBy.number	Number	The ID of the user who created the evidence.
LogRhythm.AlarmEvidence.Evidences.createdBy.name	String	The name of the user who created the evidence.
LogRhythm.AlarmEvidence.Evidences.createdBy.disabled	Boolean	Whether the user is disabled.
LogRhythm.AlarmEvidence.Evidences.lastUpdatedBy.number	Number	The ID of the user who last updated the alarm evidence.
LogRhythm.AlarmEvidence.Evidences.lastUpdatedBy.name	String	The name of the user who last updated the alarm evidence.
LogRhythm.AlarmEvidence.Evidences.lastUpdatedBy.disabled	Boolean	Whether the last user who updated the alarm evidence is disabled.
LogRhythm.AlarmEvidence.Evidences.type	String	The evidence type.
LogRhythm.AlarmEvidence.Evidences.status	String	The evidence status
LogRhythm.AlarmEvidence.Evidences.statusMessage	Unknown	The evidence status message.
LogRhythm.AlarmEvidence.Evidences.text	String	The evidence text.
LogRhythm.AlarmEvidence.Evidences.pinned	Boolean	Whether the evidence is pinned.
LogRhythm.AlarmEvidence.Evidences.datePinned	Unknown	The date the evidence was pinned.
LogRhythm.AlarmEvidence.Evidences.alarm.alarmId	Number	The alarm ID.
LogRhythm.AlarmEvidence.Evidences.alarm.alarmDate	Date	The alarm date.
LogRhythm.AlarmEvidence.Evidences.alarm.alarmRuleId	Number	The alarm rule ID.
LogRhythm.AlarmEvidence.Evidences.alarm.alarmRuleName	String	The alarm rule name.
LogRhythm.AlarmEvidence.Evidences.alarm.dateInserted	Date	The date the alarm was inserted.
LogRhythm.AlarmEvidence.Evidences.alarm.entityId	Number	The alarm entity ID.
LogRhythm.AlarmEvidence.Evidences.alarm.entityName	String	The alarm entity name.
LogRhythm.AlarmEvidence.Evidences.alarm.riskBasedPriorityMax	Number	The maximum Risk Based Priority (RBP) threshold of events to monitor.

Command Example

!lr-case-alarm-evidence-add case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE alarm_numbers=200,201

Context Example

{

"LogRhythm": {

"AlarmEvidence": {

"CaseID": "2E7FA20D-191E-4733-B7DC-A18BBFE762CE",

"Evidences": [

{

"alarm": {

"alarmDate": "2021-08-18T13:05:59.663Z",

"alarmId": 200,

"alarmRuleId": 98,

"alarmRuleName": "LogRhythm Agent Heartbeat Missed",

"dateInserted": "2021-08-18T13:05:59.683Z",

"entityId": 2,

"entityName": "EchoTestEntity",

"riskBasedPriorityMax": 100

},

"createdBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"dateCreated": "2021-08-19T15:41:35.54Z",

"datePinned": null,

"dateUpdated": "2021-08-19T15:41:35.54Z",

"lastUpdatedBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"number": 62,

"pinned": false,

"status": "completed",

"statusMessage": null,

"text": "",

"type": "alarm"

},

{

"alarm": {

"alarmDate": "2021-08-18T15:06:10.623Z",

"alarmId": 201,

"alarmRuleId": 98,

"alarmRuleName": "LogRhythm Agent Heartbeat Missed",

"dateInserted": "2021-08-18T15:06:10.637Z",

"entityId": 2,

"entityName": "EchoTestEntity",

"riskBasedPriorityMax": 39

},

"createdBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"dateCreated": "2021-08-19T15:41:35.54Z",

"datePinned": null,

"dateUpdated": "2021-08-19T15:41:35.54Z",

"lastUpdatedBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"number": 63,

"pinned": false,

"status": "completed",

"statusMessage": null,

"text": "",

"type": "alarm"

}

]

}

}

}

Human Readable Output

Alarms added as evidence to case 2E7FA20D-191E-4733-B7DC-A18BBFE762CE successfully

Number	Type	Status	Date Created	Created By	Text	Alarm	File
62	alarm	completed	2021-08-19T15:41:35.54Z	number: 1 name: LR Soap API disabled: false		alarmId: 200 alarmDate: 2021-08-18T13:05:59.663Z alarmRuleId: 98 alarmRuleName: LogRhythm Agent Heartbeat Missed dateInserted: 2021-08-18T13:05:59.683Z entityId: 2 entityName: EchoTestEntity riskBasedPriorityMax: 100
63	alarm	completed	2021-08-19T15:41:35.54Z	number: 1 name: LR Soap API disabled: false		alarmId: 201 alarmDate: 2021-08-18T15:06:10.623Z alarmRuleId: 98 alarmRuleName: LogRhythm Agent Heartbeat Missed dateInserted: 2021-08-18T15:06:10.637Z entityId: 2 entityName: EchoTestEntity riskBasedPriorityMax: 39

lr-case-note-evidence-add

---

Add a note as evidence on a case.

Base Command

lr-case-note-evidence-add

Input

Argument Name	Description	Required
case_id	Unique identifier for the case.	Required
note	Note text.	Required

Context Output

Path	Type	Description
LogRhythm.NoteEvidence.CaseID	String	The case ID.
LogRhythm.NoteEvidence.Evidences.number	Number	The evidence number.
LogRhythm.NoteEvidence.Evidences.dateCreated	Date	The date the evidence was created.
LogRhythm.NoteEvidence.Evidences.dateUpdated	Date	The date the evidence was updated.
LogRhythm.NoteEvidence.Evidences.createdBy.number	Number	The ID of the user who created the evidence.
LogRhythm.NoteEvidence.Evidences.createdBy.name	String	The name of the user who created the evidence.
LogRhythm.NoteEvidence.Evidences.createdBy.disabled	Boolean	Whether the user is disabled.
LogRhythm.NoteEvidence.Evidences.lastUpdatedBy.number	Number	The ID of the user who last updated the evidence.
LogRhythm.NoteEvidence.Evidences.lastUpdatedBy.name	String	The name of the user who last updated the evidence.
LogRhythm.NoteEvidence.Evidences.lastUpdatedBy.disabled	Boolean	Whether the last user who updated the evidence is disabled.
LogRhythm.NoteEvidence.Evidences.type	String	The evidence type.
LogRhythm.NoteEvidence.Evidences.status	String	The evidence status,
LogRhythm.NoteEvidence.Evidences.statusMessage	Unknown	The evidence status message.
LogRhythm.NoteEvidence.Evidences.text	String	The evidence text.
LogRhythm.NoteEvidence.Evidences.pinned	Boolean	Whether the evidence is pinned.
LogRhythm.NoteEvidence.Evidences.datePinned	Unknown	The date the evidence was pinned.

Command Example

!lr-case-note-evidence-add case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE note=test

Context Example

{

"LogRhythm": {

"NoteEvidence": [

{

"CaseID": "2E7FA20D-191E-4733-B7DC-A18BBFE762CE",

"Evidences": {

"createdBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"dateCreated": "2021-10-30T20:17:09.2251906Z",

"datePinned": null,

"dateUpdated": "2021-10-30T20:17:09.2251906Z",

"lastUpdatedBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"number": 243,

"pinned": false,

"status": "completed",

"statusMessage": null,

"text": "test",

"type": "note"

}

}

]

}

}

Human Readable Output

Note added as evidence to case 2E7FA20D-191E-4733-B7DC-A18BBFE762CE successfully

Number	Type	Status	Date Created	Created By	Text	Alarm	File
243	note	completed	2021-10-30T20:17:09.2251906Z	number: 1 name: LR Soap API disabled: false	test

lr-case-file-evidence-add

---

Upload a file as evidence on a case.

Base Command

lr-case-file-evidence-add

Input

Argument Name	Description	Required
case_id	Unique identifier for the case,.	Required
entryId	The entry ID of the file to attach.	Required

Context Output

Path	Type	Description
LogRhythm.FileEvidence.CaseID	String	The case ID.
LogRhythm.FileEvidence.Evidences.number	Number	The evidence number.
LogRhythm.FileEvidence.Evidences.dateCreated	Date	The date the evidence was created.
LogRhythm.FileEvidence.Evidences.dateUpdated	Date	The date the evidence was updated.
LogRhythm.FileEvidence.Evidences.createdBy.number	Number	The ID of the user who created the evidence.
LogRhythm.FileEvidence.Evidences.createdBy.name	String	The name of the user who created the evidence.
LogRhythm.FileEvidence.Evidences.createdBy.disabled	Boolean	Whether the user is disabled.
LogRhythm.FileEvidence.Evidences.lastUpdatedBy.number	Number	The ID of the user who last updated the evidence.
LogRhythm.FileEvidence.Evidences.lastUpdatedBy.name	String	The name of the user who last updated the evidence.
LogRhythm.FileEvidence.Evidences.lastUpdatedBy.disabled	Boolean	Whether the last user who updated the evidence is disabled.
LogRhythm.FileEvidence.Evidences.type	String	The evidence type.
LogRhythm.FileEvidence.Evidences.status	String	The evidence status
LogRhythm.FileEvidence.Evidences.statusMessage	Unknown	The evidence status message.
LogRhythm.FileEvidence.Evidences.text	String	The evidence text.
LogRhythm.FileEvidence.Evidences.pinned	Boolean	Whether the evidence is pinned.
LogRhythm.FileEvidence.Evidences.datePinned	Unknown	The date the evidence was pinned.

Command Example

!lr-case-file-evidence-add case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE entryId=8502@383ed6ae-1fd7-431a-858d-a11f2620c73b

Context Example

{

"LogRhythm": {

"FileEvidence": [

{

"CaseID": "2E7FA20D-191E-4733-B7DC-A18BBFE762CE",

"Evidences": {

"createdBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"dateCreated": "2021-10-30T20:33:46.8Z",

"datePinned": null,

"dateUpdated": "2021-10-30T20:33:46.8Z",

"file": {

"name": "File.jpeg",

"size": 170781

},

"lastUpdatedBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"number": 244,

"pinned": false,

"status": "pending",

"statusMessage": null,

"text": "",

"type": "file"

}

}

]

}

}

Human Readable Output

File added as evidence to case 2E7FA20D-191E-4733-B7DC-A18BBFE762CE successfully

Number	Type	Status	Date Created	Created By	Text	Alarm	File
244	file	pending	2021-10-30T20:33:46.8Z	number: 1 name: LR Soap API disabled: false			name: File.jpeg size: 170781

lr-case-evidence-delete

---

Remove evidence from a case.

Base Command

lr-case-evidence-delete

Input

Argument Name	Description	Required
case_id	Unique identifier for the case.	Required
evidence_number	Unique, numeric identifier for the evidence to remove.	Required

Context Output

There is no context output for this command.

Command Example

!lr-case-evidence-delete case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE evidence_number=65

Human Readable Output

Evidence deleted successfully from case 2E7FA20D-191E-4733-B7DC-A18BBFE762CE.

lr-case-file-evidence-download

---

Download an item of file evidence from a case.

Base Command

lr-case-file-evidence-download

Input

Argument Name	Description	Required
case_id	Unique identifier for the case.	Required
evidence_number	Unique, numeric identifier for the evidence.	Required

Context Output

There is no context output for this command.

Command Example

!lr-case-file-evidence-download case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE evidence_number=66

Context Example

{

"File": {

"EntryID": "8420@383ed6ae-1fd7-431a-858d-a11f2620c73b",

"Extension": "jpg",

"Info": "image/jpeg",

"MD5": "0f9e8a7d9e49fee24f6a34424ad45662",

"Name": "IMG_20210723_165057.jpg",

"SHA1": "SHA1",

"SHA256": "SHA256",

"SHA512": "SHA512",

"SSDeep": "SSDeep",

"Size": 3021461,

"Type": "JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=2112, manufacturer=OnePlus, model=ONEPLUS A6013, orientation=upper-left, xresolution=180, yresolution=188, resolutionunit=2, datetime=2021:07:23 16:50:59, GPS-Data, width=4608], baseline, precision 8, 4608x2112, frames 3"

}

}

Human Readable Output

lr-case-tags-add

---

Add tags to a case.

Base Command

lr-case-tags-add

Input

Argument Name	Description	Required
case_id	Unique identifier for the case.	Required
tag_numbers	A comma-separated list of tag numbers to add.	Required

Context Output

Path	Type	Description
LogRhythm.Case.id	String	The case ID.
LogRhythm.Case.number	Number	The case number.
LogRhythm.Case.externalId	String	The case external ID.
LogRhythm.Case.dateCreated	Date	The date the case was created.
LogRhythm.Case.dateUpdated	Date	The date the case was updated.
LogRhythm.Case.dateClosed	Unknown	The date the case was closed.
LogRhythm.Case.owner.number	Number	The ID of the case owner.
LogRhythm.Case.owner.name	String	The name of the case owner.
LogRhythm.Case.owner.disabled	Boolean	Whether the owner is disabled or not
LogRhythm.Case.lastUpdatedBy.number	Number	The ID of the user who last updated the case.
LogRhythm.Case.lastUpdatedBy.name	String	The name of the user who last updated the case.
LogRhythm.Case.lastUpdatedBy.disabled	Boolean	Whether the last user who updated the case is disabled.
LogRhythm.Case.name	String	The case name.
LogRhythm.Case.status.name	String	The case status.
LogRhythm.Case.status.number	Number	The case status number.
LogRhythm.Case.priority	Number	The case priority.
LogRhythm.Case.dueDate	Date	The datetime the case is due.
LogRhythm.Case.resolution	Unknown	The case resolution.
LogRhythm.Case.resolutionDateUpdated	Unknown	The date the case resolution was last updated.
LogRhythm.Case.resolutionLastUpdatedBy	Unknown	The user who last updated the case resolution.
LogRhythm.Case.summary	String	The case summary.
LogRhythm.Case.entity.number	Number	The case entity number.
LogRhythm.Case.entity.name	String	The case entity name.
LogRhythm.Case.entity.fullName	String	The case entity full name.
LogRhythm.Case.collaborators.number	Number	The case collaborator number.
LogRhythm.Case.collaborators.name	String	The case collaborator name.
LogRhythm.Case.collaborators.disabled	Boolean	Whether the case collaborator is disabled.
LogRhythm.Case.tags.text	String	The case tag name.
LogRhythm.Case.tags.number	Number	The case tag number.

Command Example

!lr-case-tags-add case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE tag_numbers=2,3

Context Example

{

"LogRhythm": {

"Case": {

"collaborators": [

{

"disabled": false,

"name": "LR Soap API",

"number": 1

}

],

"dateClosed": null,

"dateCreated": "2021-08-19T15:38:07.8995494Z",

"dateUpdated": "2021-10-30T20:17:15.9861818Z",

"dueDate": "2021-08-20T15:38:07.8995494Z",

"entity": {

"fullName": "Global Entity",

"name": "Global Entity",

"number": -100

},

"externalId": "9930",

"id": "2E7FA20D-191E-4733-B7DC-A18BBFE762CE",

"lastUpdatedBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"name": "test",

"number": 17,

"owner": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"priority": 3,

"resolution": null,

"resolutionDateUpdated": null,

"resolutionLastUpdatedBy": null,

"status": {

"name": "Incident",

"number": 3

},

"summary": "test case",

"tags": [

{

"number": 2,

"text": "tag #2"

},

{

"number": 3,

"text": "tag #3"

}

]

}

}

}

Human Readable Output

Tags added successfully to case 2E7FA20D-191E-4733-B7DC-A18BBFE762CE

Collaborators	Date Closed	Date Created	Date Updated	Due Date	Entity	External Id	Id	Last Updated By	Name	Number	Owner	Priority	Resolution	Resolution Date Updated	Resolution Last Updated By	Status	Summary	Tags
{'number': 1, 'name': 'LR Soap API', 'disabled': False}		2021-08-19T15:38:07.8995494Z	2021-10-30T20:17:15.9861818Z	2021-08-20T15:38:07.8995494Z	number: -100 name: Global Entity fullName: Global Entity	9930	2E7FA20D-191E-4733-B7DC-A18BBFE762CE	number: 1 name: LR Soap API disabled: false	test	17	number: 1 name: LR Soap API disabled: false	3				name: Incident number: 3	test case	{'number': 2, 'text': 'tag #2'}, {'number': 3, 'text': 'tag #3'}

lr-case-tags-remove

---

Remove tags from a case.

Base Command

lr-case-tags-remove

Input

Argument Name	Description	Required
case_id	Unique identifier for the case.	Required
tag_numbers	A comma-separated list of tag numbers to remove.	Required

Context Output

Path	Type	Description
LogRhythm.Case.id	String	The case ID.
LogRhythm.Case.number	Number	The case number.
LogRhythm.Case.externalId	String	The case external ID.
LogRhythm.Case.dateCreated	Date	The date the case was created.
LogRhythm.Case.dateUpdated	Date	The date the case was updated.
LogRhythm.Case.dateClosed	Unknown	The date the case was closed.
LogRhythm.Case.owner.number	Number	The ID of the case owner.
LogRhythm.Case.owner.name	String	The name of the case owner.
LogRhythm.Case.owner.disabled	Boolean	Whether the owner is disabled or not
LogRhythm.Case.lastUpdatedBy.number	Number	The ID of the user who last updated the case.
LogRhythm.Case.lastUpdatedBy.name	String	The name of the user who last updated the case.
LogRhythm.Case.lastUpdatedBy.disabled	Boolean	Whether the last user who updated the case is disabled.
LogRhythm.Case.name	String	The case name.
LogRhythm.Case.status.name	String	The case status.
LogRhythm.Case.status.number	Number	The case status number.
LogRhythm.Case.priority	Number	The case priority.
LogRhythm.Case.dueDate	Date	The datetime the case is due.
LogRhythm.Case.resolution	Unknown	The case resolution.
LogRhythm.Case.resolutionDateUpdated	Unknown	The date the case resolution was last updated.
LogRhythm.Case.resolutionLastUpdatedBy	Unknown	The user who last updated the case resolution.
LogRhythm.Case.summary	String	The case summary.
LogRhythm.Case.entity.number	Number	The case entity number.
LogRhythm.Case.entity.name	String	The case entity name.
LogRhythm.Case.entity.fullName	String	The case entity full name.
LogRhythm.Case.collaborators.number	Number	The case collaborator number.
LogRhythm.Case.collaborators.name	String	The case collaborator name.
LogRhythm.Case.collaborators.disabled	Boolean	Whether the case collaborator is disabled.
LogRhythm.Case.tags.text	String	The case tag name.
LogRhythm.Case.tags.number	Number	The case tag number.

Command Example

!lr-case-tags-remove case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE tag_numbers=1,2

Context Example

{

"LogRhythm": {

"Case": {

"collaborators": [

{

"disabled": false,

"name": "LR Soap API",

"number": 1

}

],

"dateClosed": null,

"dateCreated": "2021-08-19T15:38:07.8995494Z",

"dateUpdated": "2021-10-30T20:17:17.3901952Z",

"dueDate": "2021-08-20T15:38:07.8995494Z",

"entity": {

"fullName": "Global Entity",

"name": "Global Entity",

"number": -100

},

"externalId": "9930",

"id": "2E7FA20D-191E-4733-B7DC-A18BBFE762CE",

"lastUpdatedBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"name": "test",

"number": 17,

"owner": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"priority": 3,

"resolution": null,

"resolutionDateUpdated": null,

"resolutionLastUpdatedBy": null,

"status": {

"name": "Incident",

"number": 3

},

"summary": "test case",

"tags": [

{

"number": 3,

"text": "tag #3"

}

]

}

}

}

Human Readable Output

Tags removed successfully from case 2E7FA20D-191E-4733-B7DC-A18BBFE762CE

Collaborators	Date Closed	Date Created	Date Updated	Due Date	Entity	External Id	Id	Last Updated By	Name	Number	Owner	Priority	Resolution	Resolution Date Updated	Resolution Last Updated By	Status	Summary	Tags
{'number': 1, 'name': 'LR Soap API', 'disabled': False}		2021-08-19T15:38:07.8995494Z	2021-10-30T20:17:17.3901952Z	2021-08-20T15:38:07.8995494Z	number: -100 name: Global Entity fullName: Global Entity	9930	2E7FA20D-191E-4733-B7DC-A18BBFE762CE	number: 1 name: LR Soap API disabled: false	test	17	number: 1 name: LR Soap API disabled: false	3				name: Incident number: 3	test case	{'number': 3, 'text': 'tag #3'}

lr-tags-list

---

Return a list of tags using filter criteria.

Base Command

lr-tags-list

Input

Argument Name	Description	Required
tag_name	Filter results that have a tag name that contains the specified value.	Optional
offset	The number of tags to skip before starting to collect the result set. Default is 0.	Optional
count	The numbers of tags to return. Default is 50.	Optional

Context Output

Path	Type	Description
LogRhythm.Tag.number	Number	The tag number.
LogRhythm.Tag.text	String	The tag text.
LogRhythm.Tag.dateCreated	Date	The date the tag was created.
LogRhythm.Tag.createdBy.number	Number	The ID of the user who created the tag.
LogRhythm.Tag.createdBy.name	String	The name of the user who created the tag.
LogRhythm.Tag.createdBy.disabled	Boolean	Whether the user is disabled.

Command Example

!lr-tags-list count=2

Context Example

{

"LogRhythm": {

"Tag": [

{

"createdBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"dateCreated": "2021-08-11T13:44:00.4433333Z",

"number": 2,

"text": "tag #2"

},

{

"createdBy": {

"disabled": false,

"name": "LR Soap API",

"number": 1

},

"dateCreated": "2021-08-11T13:44:05.7433333Z",

"number": 3,

"text": "tag #3"

}

]

}

}

Human Readable Output

Tags

Number	Text	Date Created	Created By
2	tag #2	2021-08-11T13:44:00.4433333Z	number: 1 name: LR Soap API disabled: false
3	tag #3	2021-08-11T13:44:05.7433333Z	number: 1 name: LR Soap API disabled: false

lr-case-collaborators-list

---

Returns the owner and a list of collaborators associated with a specific case.

Base Command

lr-case-collaborators-list

Input

Argument Name	Description	Required
case_id	Unique identifier for the case.	Required

Context Output

Path	Type	Description
LogRhythm.CaseCollaborator.CaseID	String	The case ID.
LogRhythm.CaseCollaborator.owner.number	Number	The ID of the case owner.
LogRhythm.CaseCollaborator.owner.name	String	The name of the case owner.
LogRhythm.CaseCollaborator.owner.disabled	Boolean	Whether the owner is disabled.
LogRhythm.CaseCollaborator.collaborators.number	Number	The case collaborator number.
LogRhythm.CaseCollaborator.collaborators.name	String	The case collaborator name.
LogRhythm.CaseCollaborator.collaborators.disabled	Boolean	Whether the case collaborator is disabled.

Command Example

!lr-case-collaborators-list case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE

Context Example

{

"LogRhythm": {

"CaseCollaborator": {

"CaseID": "2E7FA20D-191E-4733-B7DC-A18BBFE762CE",

"collaborators": [

{

"disabled": false,

"name": "LR Soap API",

"number": 1

}

],

"owner": {

"disabled": false,

"name": "LR Soap API",

"number": 1

}

}

}

}

Human Readable Output

Case owner

Disabled	Name	Number
false	LR Soap API	1

Case collaborators

Disabled	Name	Number
false	LR Soap API	1

lr-case-collaborators-update

---

Updates the owner and collaborators associated with a specific case.

Base Command

lr-case-collaborators-update

Input

Argument Name	Description	Required
case_id	Unique identifier for the case.	Required
owner	Unique, numeric identifier for the person.	Required
collaborators	A comma-separated list of user IDs.	Required

Context Output

Path	Type	Description
LogRhythm.CaseCollaborator.CaseID	String	The case ID.
LogRhythm.CaseCollaborator.owner.number	Number	The ID of the case owner.
LogRhythm.CaseCollaborator.owner.name	String	The name of the case owner.
LogRhythm.CaseCollaborator.owner.disabled	Boolean	Whether the owner is disabled.
LogRhythm.CaseCollaborator.collaborators.number	Number	The case collaborator ID.
LogRhythm.CaseCollaborator.collaborators.name	String	The case collaborator name.
LogRhythm.CaseCollaborator.collaborators.disabled	Boolean	Whether the case collaborator is disabled.

Command Example

!lr-case-collaborators-update case_id=2E7FA20D-191E-4733-B7DC-A18BBFE762CE collaborators=1 owner=1

Context Example

{

"LogRhythm": {

"CaseCollaborator": {

"CaseID": "2E7FA20D-191E-4733-B7DC-A18BBFE762CE",

"collaborators": [

{

"disabled": false,

"name": "LR Soap API",

"number": 1

}

],

"owner": {

"disabled": false,

"name": "LR Soap API",

"number": 1

}

}

}

}

Human Readable Output

Case 2E7FA20D-191E-4733-B7DC-A18BBFE762CE updated successfully

Case owner

Disabled	Name	Number
false	LR Soap API	1

Case collaborators

Disabled	Name	Number
false	LR Soap API	1

lr-entities-list

---

Returns all Entities that match the specified criteria.

Base Command

lr-entities-list

Input

Argument Name	Description	Required
parent_entity_id	Filter by the object parent entity ID.	Optional
entity_id	Filter by the entity ID.	Optional
offset	The number of entities to skip before starting to collect the result set. Default is 0.	Optional
count	The number of entities to return. Default is 50.	Optional

Context Output

Path	Type	Description
LogRhythm.Entity.id	Number	The entity ID.
LogRhythm.Entity.name	String	The entity name.
LogRhythm.Entity.fullName	String	The entity full name.
LogRhythm.Entity.recordStatusName	String	The entity record status.
LogRhythm.Entity.shortDesc	String	The entity short description.
LogRhythm.Entity.dateUpdated	Date	The date the entity was updated.

Command Example

!lr-entities-list count=2

Context Example

{

"LogRhythm": {

"Entity": [

{

"dateUpdated": "2021-10-12T14:01:21.54Z",

"fullName": "EchoTestEntity",

"id": 2,

"name": "EchoTestEntity",

"recordStatusName": "Active",

"shortDesc": "LogRhythm ECHO"

},

{

"dateUpdated": "2021-10-27T16:27:14.363Z",

"fullName": "Global Entity",

"id": -100,

"name": "Global Entity",

"recordStatusName": "Active",

"shortDesc": "Global entity containing shared network and host records"

}

]

}

}

Human Readable Output

Entities

Id	Name	Full Name	Record Status Name	Short Desc	Date Updated
2	EchoTestEntity	EchoTestEntity	Active	LogRhythm ECHO	2021-10-12T14:01:21.54Z
-100	Global Entity	Global Entity	Active	Global entity containing shared network and host records	2021-10-27T16:27:14.363Z

lr-hosts-list

---

Returns all hosts that match the specified criteria.

Base Command

lr-hosts-list

Input

Argument Name	Description	Required
host_id	Filter by host ID.	Optional
host_name	Filter by host name.	Optional
entity_name	Filter by entity name.	Optional
record_status	Filter by record status. Possible values: "all", "active", "retired". Possible values are: all, active, retired.	Optional
offset	The number of hosts to skip before starting to collect the result set. Default is 0.	Optional
count	The number of hosts to return. Default is 50.	Optional

Context Output

Path	Type	Description
LogRhythm.Host.id	Number	The host ID.
LogRhythm.Host.entity.id	Number	The host entity ID.
LogRhythm.Host.entity.name	String	The host entity name.
LogRhythm.Host.name	String	The host name.
LogRhythm.Host.riskLevel	String	The host risk level.
LogRhythm.Host.threatLevel	String	The host threat level.
LogRhythm.Host.threatLevelComments	String	The threat level comments
LogRhythm.Host.recordStatusName	String	The host record status name.
LogRhythm.Host.hostZone	String	The host zone.
LogRhythm.Host.location.id	Number	The host location ID.
LogRhythm.Host.os	String	The operating system type supported by LogRhythm.
LogRhythm.Host.useEventlogCredentials	Boolean	Whether to use the event log credentials.
LogRhythm.Host.osType	String	The agent server type on which the operating system is installed.
LogRhythm.Host.dateUpdated	Date	The date the host was updated.
LogRhythm.Host.shortDesc	String	The host short description.
LogRhythm.Host.osVersion	String	The host operation system version.
LogRhythm.Host.hostIdentifiers.type	String	The host identifier type.
LogRhythm.Host.hostIdentifiers.value	String	The host identifier value.
LogRhythm.Host.hostIdentifiers.dateAssigned	Date	The date the host identifier was assigned.
LogRhythm.Host.eventlogPassword	String	The event log password.

Command Example

!lr-hosts-list count=2

Context Example

{

"LogRhythm": {

"Host": [

{

"dateUpdated": "2021-07-27T15:56:14.34Z",

"entity": {

"id": -100,

"name": "Global Entity"

},

"hostIdentifiers": [],

"hostRoles": [],

"hostZone": "Internal",

"id": -1000001,

"location": {

"id": -1

},

"name": "AI Engine Server",

"os": "Unknown",

"osType": "Server",

"recordStatusName": "Active",

"riskLevel": "None",

"threatLevel": "None",

"threatLevelComments": "",

"useEventlogCredentials": false

},

{

"dateUpdated": "2021-07-27T15:56:14.343Z",

"entity": {

"id": 1,

"name": "Primary Site"

},

"hostIdentifiers": [],

"hostRoles": [],

"hostZone": "Internal",

"id": -1000002,

"location": {

"id": -1

},

"name": "AI Engine Server",

"os": "Unknown",

"osType": "Server",

"recordStatusName": "Active",

"riskLevel": "None",

"threatLevel": "None",

"threatLevelComments": "",

"useEventlogCredentials": false

}

]

}

}

Human Readable Output

Hosts

Date Updated	Entity	Host Identifiers	Host Roles	Host Zone	Id	Location	Name	Os	Os Type	Record Status Name	Risk Level	Threat Level	Threat Level Comments	Use Eventlog Credentials
2021-07-27T15:56:14.34Z	id: -100 name: Global Entity			Internal	-1000001	id: -1	AI Engine Server	Unknown	Server	Active	None	None		false
2021-07-27T15:56:14.343Z	id: 1 name: Primary Site			Internal	-1000002	id: -1	AI Engine Server	Unknown	Server	Active	None	None		false

lr-users-list

---

Returns user records based on the permissions of the currently logged in user and the specified criteria.

Base Command

lr-users-list

Input

Argument Name	Description	Required
user_ids	A comma-separated list of user IDs.	Optional
entity_ids	A comma-separated list of entity IDs.	Optional
user_status	Filter by user status. Possible values: "Active" and "Retired". Possible values are: Active, Retired.	Optional
offset	The ID of users to skip before starting to collect the result set. Default is 0.	Optional
count	The IDs of the users to return. Default is 50.	Optional

Context Output

Path	Type	Description
LogRhythm.User.firstName	String	The user first name.
LogRhythm.User.lastName	String	The user last name.
LogRhythm.User.userType	String	The user type
LogRhythm.User.fullName	String	The user full name.
LogRhythm.User.objectPermissions.readAccess	String	The user read access permissions.
LogRhythm.User.objectPermissions.writeAccess	String	The user write access permissions.
LogRhythm.User.objectPermissions.entity.id	Number	The user permissions entity ID.
LogRhythm.User.objectPermissions.entity.name	String	The user permissions entity name.
LogRhythm.User.objectPermissions.owner.id	Number	The user permissions owner ID.
LogRhythm.User.objectPermissions.owner.name	String	The user permissions owner.
LogRhythm.User.id	Number	The user ID.
LogRhythm.User.recordStatusName	String	The user record status.
LogRhythm.User.dateUpdated	Date	The date the user was updated.

Command Example

!lr-users-list count=2

Context Example

{

"LogRhythm": {

"User": [

{

"dateUpdated": "2021-07-27T20:38:31.443Z",

"firstName": "",

"fullName": "LR Soap API",

"id": 1,

"lastName": "",

"objectPermissions": {

"entity": {

"id": 1,

"name": "Primary Site"

},

"owner": {

"id": -100,

"name": "LogRhythmAdmin"

},

"readAccess": "PublicGlobalAdmin",

"writeAccess": "PublicGlobalAdmin"

},

"recordStatusName": "Active",

"userType": "Role"

},

{

"dateUpdated": "2021-07-27T15:07:47.05Z",

"firstName": "LogRhythm",

"fullName": "LogRhythm Analyst",

"id": -101,

"lastName": "Analyst",

"objectPermissions": {

"entity": {

"id": -100,

"name": "Global Entity"

},

"owner": {

"id": -100,

"name": "LogRhythmAdmin"

},

"readAccess": "PublicAll",

"writeAccess": "PublicGlobalAdmin"

},

"recordStatusName": "Active",

"userType": "Role"

}

]

}

}

Human Readable Output

Users

Id	Full Name	User Type	First Name	Last Name	Record Status Name	Date Updated	Object Permissions
1	LR Soap API	Role			Active	2021-07-27T20:38:31.443Z	readAccess: PublicGlobalAdmin writeAccess: PublicGlobalAdmin entity: {"id": 1, "name": "Primary Site"} owner: {"id": -100, "name": "LogRhythmAdmin"}
-101	LogRhythm Analyst	Role	LogRhythm	Analyst	Active	2021-07-27T15:07:47.05Z	readAccess: PublicAll writeAccess: PublicGlobalAdmin entity: {"id": -100, "name": "Global Entity"} owner: {"id": -100, "name": "LogRhythmAdmin"}

lr-lists-get

---

Returns list details using the filter criteria.

Base Command

lr-lists-get

Input

Argument Name	Description	Required
list_type	The list type. Possible values: "None", "Application", "Classification", "CommonEvent", "Host", "Location", "MsgSource", "MsgSourceType", "MPERule", "Network", "User", "GeneralValue", "Entity", "RootEntity", "IP", "IPRange", and "Identity". Possible values are: None, Application, Classification, CommonEvent, Host, Location, MsgSource, MsgSourceType, MPERule, Network, User, GeneralValue, Entity, RootEntity, IP, IPRange, Identity.	Optional
list_name	The name of the object or regex match.	Optional
can_edit	Specifies if Write Only (true) or Read Only (false) lists are required for a user. Possible values: "true" and "false". Possible values are: true, false.	Optional

Context Output

Path	Type	Description
LogRhythm.List.listType	String	The list type.
LogRhythm.List.status	String	The list status.
LogRhythm.List.name	String	The list name.
LogRhythm.List.shortDescription	String	The list short description.
LogRhythm.List.useContext	String	The use context type.
LogRhythm.List.autoImportOption.enabled	Boolean	Whether the list auto import is enabled.
LogRhythm.List.autoImportOption.usePatterns	Boolean	Whether the auto import use patterns is enabled.
LogRhythm.List.autoImportOption.replaceExisting	Boolean	Whether the auto import replace existing is enabled.
LogRhythm.List.id	Number	The list ID.
LogRhythm.List.guid	String	The list GUID.
LogRhythm.List.dateCreated	Date	The date the list was created.
LogRhythm.List.dateUpdated	Date	The date the list was updated.
LogRhythm.List.readAccess	String	The read permission level.
LogRhythm.List.writeAccess	String	The write permission level.
LogRhythm.List.restrictedRead	Boolean	Whether the list is read restricted.
LogRhythm.List.entityName	String	The list entity name.
LogRhythm.List.entryCount	Number	The list entry count.
LogRhythm.List.needToNotify	Boolean	Whether the list will notify the user when updated.
LogRhythm.List.doesExpire	Boolean	Whether the list expires.
LogRhythm.List.owner	Number	The ID of the list owner.
LogRhythm.List.longDescription	String	The list long description.
LogRhythm.List.timeToLiveSeconds	Number	The list time for the list to live in seconds.
LogRhythm.List.revisitDate	Date	The list revisit date.

Command Example

!lr-lists-get

Context Example

{

"LogRhythm": {

"List": [

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2019-11-05T04:11:38.303Z",

"dateUpdated": "2021-07-27T16:03:30.617Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "B1E34445-2693-411E-8BE2-9B97AFFF20A9",

"id": -1000130,

"listType": "GeneralValue",

"name": "Windows System32 Hashes",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "Hashes of executables in the %systemroot%\\system32 directory. Use Case: Masquerading technique in MITRE ATT&CK",

"status": "Active",

"useContext": [

"Hash"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2021-07-27T15:07:50.893Z",

"dateUpdated": "2021-07-27T15:07:50.893Z",

"doesExpire": true,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "F205DE21-9F73-462E-8F83-DE64CAD2A401",

"id": -1000001,

"listType": "Identity",

"longDescription": "Anomaly scores from CloudAI will not be displayed for the identities in this list. Identities added to this list will automatically expire 24 hours after they are added.",

"name": "CloudAI: Ignore for 24 Hours",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "Anomaly scores from CloudAI will not be displayed for the identities in this list. Identities added to this list will automatically expire 24 hours after they are added.",

"status": "Active",

"timeToLiveSeconds": 86400,

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2021-07-27T15:07:50.893Z",

"dateUpdated": "2021-07-27T15:07:50.893Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "5A2E34FB-3AD1-44CB-8E5F-643CAEDD1EC2",

"id": -1000000,

"listType": "Identity",

"longDescription": "Identities monitored by CloudAI",

"name": "CloudAI: Monitored Identities",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "Identities monitored by CloudAI",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2015-06-06T00:15:20.033Z",

"dateUpdated": "2021-07-27T16:03:30.627Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "6B9A54EF-70C9-49E0-B051-75C363178603",

"id": -2389,

"listType": "MsgSource",

"longDescription": "This list will need to capture all related systems according to their classification as high, medium, or low impacts within the environment. \r\n\r\nThis list is used in the following:\r\n(Reports)\r\nNERC-CIP: Access Failure Summary\r\nNERC-CIP: Default Act Auth/Accs Success Summary\r\nNERC-CIP: Default Act Management Summary\r\nNERC-CIP: Host Authentication Success Summary\r\nNERC-CIP: Non-encrypted protocol\r\nNERC-CIP: Priv Act Auth/Accs Success Summary\r\nNERC-CIP: Priv Act Management Summary\r\nNERC-CIP: Shared Act Auth/Accs Success Summary\r\nNERC-CIP: Shared Act Management Summary\r\nNERC-CIP: Suspicious Activity Summary\r\nNERC-CIP: Term Act Auth/Accs Success Summary\r\nNERC-CIP: Term Act Management Summary\r\nNERC-CIP: Vendor Act Auth/Accs Success Summary\r\nNERC-CIP: Vendor Act Management Summary\r\nNERC-CIP: VPN Node Registration Failure (Auth)\r\nNERC-CIP: VPN Node Registration Failure (un-Auth)\r\n(Investigation)\r\nNERC-CIP: Access Failure Detail\r\nNERC-CIP: Host Authentication Success Detail\r\nNERC-CIP: Priv Group Access Granted Detail\r\nNERC-CIP: Rogue WAP Detected Detail\r\nNERC-CIP: Suspicious Activity Detail\r\nNERC-CIP: VPN Node Registration Failure Detail (Auth)\r\nNERC-CIP: VPN Node Registration Failure Detail (un- Auth)\r\nNERC-CIP: Windows Firewall Change Detail\r\n(AIE Rules)\r\nNERC-CIP: Account Locked or Disabled Rule\r\nNERC-CIP: Attack Detected Rule\r\nNERC-CIP: Compromise Detected Rule\r\nNERC-CIP: Concur VPN From Multiple Country\r\nNERC-CIP: Concur VPN Same User\r\nNERC-CIP: Concurrent VPN From Multiple Cities\r\nNERC-CIP: Concurrent VPN From Multiple Region\r\nNERC-CIP: Config/Policy Change\r\nNERC-CIP: Data Destruction Rule\r\nNERC-CIP: Data Exfiltration Rule\r\nNERC-CIP: Data Loss Prevention Rule\r\nNERC-CIP: ESP Network Allow Egress Rule\r\nNERC-CIP: ESP Network Allow Ingress Rule\r\nNERC-CIP: ESP Network Denied Egress Rule\r\nNERC-CIP: ESP Network Denied Ingress Rule\r\nNERC-CIP: Malware Detected Rule\r\nNERC-CIP: Port Misuse: FTP\r\nNERC-CIP: Port Misuse: HTTP \r\nNERC-CIP: Port Misuse: SSH In\r\nNERC-CIP: Port Misuse: S",

"name": "NERC-CIP: Electronic Security Perimeter",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "This log source list represents various network related systems such as security perimeter enforcing devices (i.e. IPS, firewalls), security perimeter monitoring devices (i.e. IDS), VPNs, wireless access points, remote access devices, anti-malware, etc. ",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2015-06-05T21:31:30.7Z",

"dateUpdated": "2021-07-27T16:03:30.64Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "F7A6369A-33C3-4249-91EF-6710E13F48F6",

"id": -2379,

"listType": "MsgSource",

"longDescription": "This list will need to capture all related systems according to their classification as high, medium, or low impacts within the environment. \r\n\r\nThis list is used in the following:\r\n(Reports)\r\nNERC-CIP: Access Failure Summary\r\nNERC-CIP: Authentication Failure Summary\r\nNERC-CIP: Change in Software Config (Linux)\r\nNERC-CIP: Change in Software Config (Windows)\r\nNERC-CIP: Default Act Auth/Accs Success Summary\r\nNERC-CIP: Default Act Management Summary\r\nNERC-CIP: Failed File Access (Linux)\r\nNERC-CIP: Failed File Access (Windows)\r\nNERC-CIP: Host Authentication Success Summary\r\nNERC-CIP: Object Creation/Disposal Summary\r\nNERC-CIP: Priv Act Auth/Accs Success Summary\r\nNERC-CIP: Priv Act Management Summary\r\nNERC-CIP: Shared Act Auth/Accs Success Summary\r\nNERC-CIP: Shared Act Management Summary\r\nNERC-CIP: Suspicious Activity Summary\r\nNERC-CIP: Term Act Auth/Accs Success Summary\r\nNERC-CIP: Term Act Management Summary\r\nNERC-CIP: Vendor Act Auth/Accs Success Summary\r\nNERC-CIP: Vendor Act Management Summary\r\n (Investigation)\r\nNERC-CIP: Access Failure Detail\r\nNERC-CIP: Host Authentication Success Detail\r\nNERC-CIP: Priv Group Access Granted Detail\r\nNERC-CIP: Suspicious Activity Detail\r\n (AIE Rules)\r\nNERC-CIP: Account Locked or Disabled Rule\r\nNERC-CIP: Attack Detected Rule\r\nNERC-CIP: Compromise Detected Rule\r\nNERC-CIP: Concur VPN From Multiple Country\r\nNERC-CIP: Concur VPN Same User\r\nNERC-CIP: Concurrent VPN From Multiple Cities\r\nNERC-CIP: Concurrent VPN From Multiple Region\r\nNERC-CIP: Config/Policy Change\r\nNERC-CIP: Data Destruction Rule\r\nNERC-CIP: Data Exfiltration Rule\r\nNERC-CIP: Data Loss Prevention Rule\r\nNERC-CIP: ESP Network Allow Egress Rule\r\nNERC-CIP: ESP Network Allow Ingress Rule\r\nNERC-CIP: ESP Network Denied Egress Rule\r\nNERC-CIP: ESP Network Denied Ingress Rule\r\nNERC-CIP: Malware Detected Rule\r\nNERC-CIP: Port Misuse: FTP\r\nNERC-CIP: Port Misuse: HTTP \r\nNERC-CIP: Port Misuse: SSH In\r\nNERC-CIP: Port Misuse: SSH Out\r\nNERC-CIP: Rogue WAP Detected Rule\r\nNERC-CIP: Software Instal",

"name": "NERC-CIP: BES Cyber Systems",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "This log source list represents various BES Cyber Assets related to IT operations that reflect groupings of the BES Cyber System(s)",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2012-06-14T03:39:14.56Z",

"dateUpdated": "2021-07-27T16:03:30.663Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "4E629B5B-7D5D-447B-B672-BBCAF8E32E37",

"id": -2085,

"listType": "Application",

"longDescription": "This list is used in the following package elements: \r\n\nPCI-DSS: Invalid DMZ => Internal Comm AIE Rule\n\r\nPCI-DSS: Invalid DMZ => Internal Comm Details\r\n\nPCI-DSS: Invalid DMZ => Internal Comm Summary\r\n\nPCI-DSS: Invalid DMZ => Internal Comm Detail\n\r\n",

"name": "PCI-DSS: Allowed DMZ => Internal App List",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "This list should be populated with the impacted applications, ports, and protocols which are allowed from the demilitarized zone environment to the internal network.",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2012-06-14T02:43:14.257Z",

"dateUpdated": "2021-07-27T16:03:30.683Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "AFD1ACEB-A5CB-4EE7-BB46-331CE023F750",

"id": -2078,

"listType": "Network",

"longDescription": "This list is used in the following package elements: \r\n\nPCI-DSS: Internal Communication\r\nPCI-DSS: Denied Intrn => Intrn Comm AIE Rule\r\nPCI-DSS: Denied Intrn => Intrn Comm Detail\n\r\nPCI-DSS: Denied Intrn => Intrn Comm Details\r\nPCI-DSS: Denied Intrn => Intrn Comm Summary\r\n\n\nPCI-DSS: Invalid Intrn => Intrn Comm AIE Rule\r\nPCI-DSS: Invalid Intrn => Intrn Comm Detail\n\r\nPCI-DSS: Invalid Intrn => Intrn Comm Details\n\r\nPCI-DSS: Invalid Intrn => Intrn Comm Summary\r\n\nPCI-DSS: Denied Inet => Intrn Comm AIE Rule\r\nPCI-DSS: Denied Inet => Intrn Comm Detail\n\r\nPCI-DSS: Denied Inet => Intrn Comm Details\r\nPCI-DSS: Denied Inet => Intrn Comm Summary\r\n\n\nPCI-DSS: Invalid Inet => Intrn Comm AIE Rule\r\nPCI-DSS: Invalid Inet => Intrn Comm Detail\n\r\nPCI-DSS: Invalid Inet => Intrn Comm Details\n\r\nPCI-DSS: Invalid Inet => Intrn Comm Summary\r\nPCI-DSS: Denied Inet => Intrn Comm AIE Rule\r\nPCI-DSS: Denied Inet => Intrn Comm Detail\n\r\nPCI-DSS: Denied Inet => Intrn Comm Details\r\nPCI-DSS: Denied Inet => Intrn Comm Summary\r\n\n\nPCI-DSS: Invalid Inet => Intrn Comm AIE Rule\r\nPCI-DSS: Invalid Inet => Intrn Comm Detail\n\r\nPCI-DSS: Invalid Inet => Intrn Comm Details\n\r\nPCI-DSS: Invalid Inet => Intrn Comm Summary\r\n\nPCI-DSS: Denied Test => Intrn Comm AIE Rule\r\nPCI-DSS: Denied Test => Intrn Comm Detail\n\r\nPCI-DSS: Denied Test => Intrn Comm Details\r\nPCI-DSS: Denied Test => Intrn Comm Summary\r\n\n\nPCI-DSS: Invalid Test => Intrn Comm AIE Rule\r\nPCI-DSS: Invalid Test => Intrn Comm Detail\n\r\nPCI-DSS: Invalid Test => Intrn Comm Details\n\r\nPCI-DSS: Invalid Test => Intrn Comm Summary\n",

"name": "PCI-DSS: Internal Environment List",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "This list should be populated with internal IP addresses of your entire internal network.\r\n",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2012-06-14T02:29:50.9Z",

"dateUpdated": "2021-07-27T16:03:30.7Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "2A5E5FCE-1FEF-4A7A-A827-93B7676028EA",

"id": -2077,

"listType": "Network",

"longDescription": "This list is used in the following package elements: \r\nPCI-DSS: DMZ Communication\r\nPCI-DSS: DMZ Communication Detail\r\nPCI-DSS: Denied DMZ => Internal Comm AIE Rule\r\nPCI-DSS: Denied DMZ => Internal Comm Details\r\nPCI-DSS: Denied DMZ => Internal Comm Summary\r\nPCI-DSS: Denied DMZ => Internal Comm Detail\r\nPCI-DSS: Denied Internet => DMZ Comm AIE Rule\r\nPCI-DSS: Denied Internet => DMZ Comm Details\r\nPCI-DSS: Denied Internet => DMZ Comm Summary\r\nPCI-DSS: Denied Internet => DMZ Comm Detail\r\nPCI-DSS: Invalid DMZ => Internal Comm AIE Rule\r\nPCI-DSS: Invalid DMZ => Internal Comm Details\r\nPCI-DSS: Invalid DMZ => Internal Comm Summary\r\nPCI-DSS: Invalid DMZ => Internal Comm Detail\r\nPCI-DSS: Invalid Internet => DMZ Comm AIE Rule\r\nPCI-DSS: Invalid Internet => DMZ Comm Details\r\nPCI-DSS: Invalid Internet => DMZ Comm Summary\r\nPCI-DSS: Invalid Internet => DMZ Comm Detail\r\n",

"name": "PCI-DSS: DMZ Environment List",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "This list should be populated with internal IP addresses of your demilitarized zone network.",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2012-06-14T02:22:50.693Z",

"dateUpdated": "2021-07-27T16:03:30.713Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "4CAB138D-9BD4-4ED4-AB4E-FF5F48D4BC3E",

"id": -2076,

"listType": "Network",

"longDescription": "This list is used in the following package elements: \n\r\nPCI-DSS: CDE Communication \r\n\nPCI-DSS: Denied CDE => Internet Comm AIE Rule\n\r\nPCI-DSS: Denied CDE => Internet Comm Detail\n\r\nPCI-DSS: Denied CDE => Internet Comm Details\r\n\nPCI-DSS: Denied CDE => Internet Comm Summary\r\n\nPCI-DSS: Denied Internet => CDE Comm AIE Rule\n\r\nPCI-DSS: Denied Internet => CDE Comm Detail\n\r\nPCI-DSS: Denied Internet => CDE Comm Details\r\n\nPCI-DSS: Denied Internet => CDE Comm Summary\r\n\nPCI-DSS: Denied Wireless => CDE Comm AIE Rule\n\r\nPCI-DSS: Denied Wireless => CDE Comm Detail\n\r\nPCI-DSS: Denied Wireless => CDE Comm Details\r\n\nPCI-DSS: Denied Wireless => CDE Comm Summary\r\n\nPCI-DSS: Invalid CDE => Internet Comm AIE Rule\n\r\nPCI-DSS: Invalid CDE => Internet Comm Detail\n\r\nPCI-DSS: Invalid CDE => Internet Comm Details\n\r\nPCI-DSS: Invalid CDE => Internet Comm Summary\n\r\nPCI-DSS: Invalid Internet => CDE Comm AIE Rule\n\r\nPCI-DSS: Invalid Internet => CDE Comm Detail\n\r\nPCI-DSS: Invalid Internet => CDE Comm Details\r\n\nPCI-DSS: Invalid Internet => CDE Comm Summary\r\n\nPCI-DSS: Invalid Wireless => CDE Comm AIE Rule\r\n\nPCI-DSS: Invalid Wireless => CDE Comm Detail\r\n\nPCI-DSS: Invalid Wireless => CDE Comm Details\r\n\nPCI-DSS: Invalid Wireless => CDE Comm Summary\n\r\n",

"name": "PCI-DSS: Cardholder Data Environment List",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "This list should be populated with internal IP addresses of your cardholder data.\r\n",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2012-06-14T02:10:32.13Z",

"dateUpdated": "2021-07-27T16:03:30.723Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "76B503F9-7F63-4EBC-B06F-0AB083ECDCF1",

"id": -2073,

"listType": "MsgSource",

"longDescription": "This list is used in many of the package elements covering network security system including: \r\nfirewalls, intrusion detection/prevention, malware detection/prevention, network access control, remote access, virtual private network, and vulnerability scanning.",

"name": "PCI-DSS: Network Security Systems",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "This list should be populated with network security systems (firewalls, intrusion detection/prevention, malware detection/prevention, network access control, remote access, virtual private network, vulnerability scanning) on the network.\r\n",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2012-06-14T00:31:39.017Z",

"dateUpdated": "2021-07-27T16:03:30.733Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "EAAC1F68-44F7-477E-BBB5-CFAEF5AEDBF6",

"id": -2063,

"listType": "Application",

"longDescription": "This list is used in the following package elements: \n\r\nPCI-DSS: Invalid Inet => Intrn Comm AIE Rule\r\n\nPCI-DSS: Invalid Inet => Intrn Comm Detail\n\r\nPCI-DSS: Invalid Inet => Intrn Comm Details\n\r\nPCI-DSS: Invalid Inet => Intrn Comm Summary\n\r\n\r\n",

"name": "PCI-DSS: Allowed Internet => Internal App List",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "This list should be populated with the impacted applications, ports, and protocols which are allowed from the external internet environment to the internal environment network.\r\n",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2012-06-14T00:29:15.183Z",

"dateUpdated": "2021-07-27T16:03:30.74Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "3D987185-2C72-4AE0-B453-FB27E8412510",

"id": -2062,

"listType": "Application",

"longDescription": "This list is used in the following package elements: \r\n\nPCI-DSS: Invalid Internet => DMZ Comm AIE Rule\n\r\nPCI-DSS: Invalid Internet => DMZ Comm Details\n\r\nPCI-DSS: Invalid Internet => DMZ Comm Summary\n\r\nPCI-DSS: Invalid Internet => DMZ Comm Detail\n\r\n",

"name": "PCI-DSS: Allowed Internet => DMZ App List",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "This list should be populated with the impacted applications, ports, and protocols which are allowed from the external internet to the demilitarized zone environment network.\r\n",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2012-06-14T00:27:14.477Z",

"dateUpdated": "2021-07-27T16:03:30.757Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "8A030E0F-870C-4F59-A5DD-28F8572723DD",

"id": -2061,

"listType": "Application",

"longDescription": "This list is used in the following package elements: \n\r\nPCI-DSS: Invalid Internet => CDE Comm AIE Rule\n\r\nPCI-DSS: Invalid Internet => CDE Comm Details\n\r\nPCI-DSS: Invalid Internet => CDE Comm Summary\r\n\nPCI-DSS: Invalid Internet => CDE Comm Detail\n\r\n\r\n",

"name": "PCI-DSS: Allowed Internet => CDE App List",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "This list should be populated with the impacted applications, ports, and protocols which are allowed from the external internet to the internal cardholder data environment network.\r\n",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2012-06-14T00:18:04.5Z",

"dateUpdated": "2021-08-09T05:25:25.377Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 1,

"guid": "DBA00254-D606-43D0-B291-EF38DA092DB3",

"id": -2058,

"listType": "Application",

"longDescription": "This list is used in the following package elements: \r\n\nPCI-DSS: Invalid CDE => Internet Comm AIE Rule\r\n\nPCI-DSS: Invalid CDE => Internet Comm Detail\n\r\nPCI-DSS: Invalid CDE => Internet Comm Details\n\r\nPCI-DSS: Invalid CDE => Internet Comm Summary\r\n",

"name": "PCI-DSS: Allowed CDE => Internet App List",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "This list should be populated with the impacted applications, ports, and protocols which are allowed from the cardholder data environment network to the external internet.\r\n",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2011-12-14T06:13:01.05Z",

"dateUpdated": "2021-07-27T16:03:30.78Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "642A7B7B-274E-4A66-9FBD-E4EC1CFC2404",

"id": -2031,

"listType": "MsgSource",

"longDescription": "This list should contain all log sources from workstations that store or process data applicable to compliance regulations. Examples include personal computers, notebooks, netbooks, tablet PCs, and publicly accessible systems such as kiosks. Virtualized application servers may also qualify as a workstation log source.",

"name": "NRC: Workstations",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "Workstations that store or process data applicable to compliance regulations. Examples: personal computers, notebooks, tablet PCs, and publicly accessible systems.",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2011-12-14T06:09:16.99Z",

"dateUpdated": "2021-07-27T16:03:30.79Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "229E1613-221C-4961-90F6-0B19B282B80F",

"id": -2027,

"listType": "MsgSource",

"longDescription": "This list should contain all log sources from production servers that store or process data applicable to compliance regulations. Examples include servers that store/process financial data, customer data, and employee data.",

"name": "NRC: Production Servers",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "Production servers applicable to compliance regulations. Examples: servers that store/process financial data, customer data, and employee data.",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2011-12-14T00:43:04.903Z",

"dateUpdated": "2021-07-27T16:03:30.8Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "F0F6C2E0-5EBD-41D8-B64E-3D67E649B2F1",

"id": -2023,

"listType": "MsgSource",

"longDescription": "This list should contain all log sources from workstations that store or process data applicable to compliance regulations. Examples include personal computers, notebooks, netbooks, tablet PCs, and publicly accessible systems such as kiosks. Virtualized application servers may also qualify as a workstation log source.",

"name": "NEI: Workstations",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "Workstations that store or process data applicable to compliance regulations. Examples: personal computers, notebooks, tablet PCs, and publicly accessible systems.",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2011-12-14T00:39:35.59Z",

"dateUpdated": "2021-07-27T16:03:30.81Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "35EB656F-CEB0-498D-B684-9E97B325B14B",

"id": -2019,

"listType": "MsgSource",

"longDescription": "This list should contain all log sources from production servers that store or process data applicable to compliance regulations. Examples include servers that store/process financial data, customer data, and employee data.",

"name": "NEI: Production Servers",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "Production servers applicable to compliance regulations. Examples: servers that store/process financial data, customer data, and employee data.",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2010-08-16T20:21:23.91Z",

"dateUpdated": "2021-07-27T16:03:30.817Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "48555D7B-0BEB-43F0-B758-29D7838B0907",

"id": -1049,

"listType": "MsgSource",

"longDescription": "Populate with all production data loss prevention devices, including LogRhythm Data Loss Defender.",

"name": "QsEMP: Data Loss Prevention",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "Production data loss prevention devices, including LogRhythm Data Loss Defender.",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2010-08-16T20:20:56.847Z",

"dateUpdated": "2021-07-27T16:03:30.827Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "280E2A9C-EB0C-4CCC-9776-FE1C164B8C5D",

"id": -1048,

"listType": "MsgSource",

"longDescription": "Populate with the system and audit logs of all production UNIX and Linux servers, as well as LogRhythm User Activity Monitor and Network Connection Monitor for production agents.",

"name": "QsEMP: Production *NIX Servers",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "System and audit logs of production UNIX and Linux servers. LogRhythm User Activity Monitor and Network Connection Monitor for production agents.",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2010-08-16T20:20:34.41Z",

"dateUpdated": "2021-07-27T16:03:30.84Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "60390FB9-0419-4A01-A517-611098B9171E",

"id": -1047,

"listType": "MsgSource",

"longDescription": "Populate with the System, Application, and Security Event Logs of all production Windows Servers, as well as LogRhythm User Activity Monitor, Process Monitor and Network Connection Monitor for production agents.",

"name": "QsEMP: Production Windows Servers",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "System, Application, and Security Event Logs of production Windows Servers. LogRhythm User Activity Monitor, Process Monitor and Network Connection Monitor for production agents.",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2010-08-16T20:20:10.877Z",

"dateUpdated": "2021-07-27T16:03:30.85Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "A55CE990-D057-4760-9845-2E9CD173FE5B",

"id": -1046,

"listType": "MsgSource",

"longDescription": "Populate with the system logs of all production routers and switches.",

"name": "QsEMP: Production Routers and Switches",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "System logs of all production routers and switches.",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2010-08-16T20:19:46.61Z",

"dateUpdated": "2021-07-27T16:03:30.86Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "AE1EDD58-9DE0-4E72-BC87-A4939D9CA0B7",

"id": -1045,

"listType": "MsgSource",

"longDescription": "Populate with the system logs of all production firewalls.",

"name": "QsEMP: Production Firewalls",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "System logs of all production firewalls.",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2010-08-16T20:19:25.033Z",

"dateUpdated": "2021-07-27T16:03:30.867Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "6658537A-358C-435F-8451-B02440B6C50B",

"id": -1044,

"listType": "MsgSource",

"longDescription": "Populate with the system or application logs of all devices providing malware detection capabilities. This includes anti-virus, spyware, and general malware detection software and central servers.",

"name": "QsEMP: Production Malware Detection Devices",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "System or application logs of devices providing malware detection capabilities. Examples: anti-virus, spyware, general malware detection software and central servers.",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2010-08-16T20:18:57.753Z",

"dateUpdated": "2021-07-27T16:03:30.877Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "DE466E5C-19D6-46B5-936C-7A7E5ADFB03E",

"id": -1043,

"listType": "MsgSource",

"longDescription": "Populate with the system logs of all devices with intrusion detection or prevention capabilities. This typically includes IDS/IPS devices, but may also include firewalls and UTM devices that include these capabilities.",

"name": "QsEMP: Production IDS/IPS Devices",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "System logs of devices with intrusion detection or prevention capabilities. Examples: firewalls and UTM devices that include these capabilities.",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2010-02-25T00:42:26.083Z",

"dateUpdated": "2021-07-27T16:03:30.887Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "41BCC625-7E73-4603-8B39-AE1E6DEEDC18",

"id": -1038,

"listType": "MsgSource",

"longDescription": "This list should contain all log sources from workstations that store or process data applicable to compliance regulations. Examples include personal computers, notebooks, netbooks, tablet PCs, and publicly accessible systems such as kiosks. Virtualized application servers may also qualify as a workstation log source.",

"name": "FISMA: Workstations",

"needToNotify": false,

"owner": -1000000,

"readAccess": "PublicAll",

"restrictedRead": false,

"shortDescription": "Workstations that store or process data applicable to compliance regulations. Examples: personal computers, notebooks, tablet PCs, and publicly accessible systems.",

"status": "Active",

"useContext": [

"None"

],

"writeAccess": "PublicGlobalAdmin"

},

{

"autoImportOption": {

"enabled": false,

"replaceExisting": false,

"usePatterns": false

},

"dateCreated": "2010-02-25T00:41:57.283Z",

"dateUpdated": "2021-07-27T16:03:30.9Z",

"doesExpire": false,

"entityName": "Global Entity",

"entryCount": 0,

"guid": "BF568BD1-E69E-4377-BB7F-2BD5FEE593A0",

"id": -1037,

"listType": "MsgSource",

"longDescription": "This list should contain all log sources from production servers that store or process data applicable to compliance regulations. Examples include servers that store/process financial data, customer data, and employee data.",

"name": "FISMA: Production Servers",

"needToNotify": false,

"owner": -1000000,