LogRhythm v3.0.1

About the connector

LogRhythm delivers in-depth endpoint visibility, automated threat hunting, and breach response across the entire enterprise. LogRhythm enhances investigator productivity with extensive rules and user behavior analytics that brings the skills and best practices of the most experienced security analysts to any organization, resulting in significantly lower costs.

This document provides information about the LogRhythm connector, which facilitates automated interactions, with a LogRhythm server using FortiSOAR™ playbooks. Add the LogRhythm connector as a step in FortiSOAR™ playbooks and perform automated investigative operations, such as retrieving alarm details and alarm events associated with a specific alarm from the LogRhythm server.

LogRhythm Connector v2.0.0 and later is built to support REST APIs. The 1.0.0 version was built to support SOAP APIs. Therefore, all the actions for version 2.0.0 and later are based on REST APIs. FortiSOAR™ also contains the Smart Response Plugin (SRP) which invokes playbooks in FortiSOAR™ whenever an alarm is triggered in LogRhythm. For more information on SRP and how to configure and use SRP, see the FSR-LogRhythm Smart Response Plugin section.

Use the Data Ingestion Wizard to easily ingest data into FortiSOAR™ by pulling alarms from LogRhythm. Currently, the "alarms" ingested from LogRhythm are mapped to "alerts" in FortiSOAR™. For more information, see the Data Ingestion Support section.

Important: Version 3.0.0 and later of the LogRhythm connector uses LogRhythm Rest API version 7.8.0.

Version information

Connector Version: 3.0.1

Authored By: Community

Certified: No

Release Notes for version 3.0.1

Following enhancements have been made to the LogRhythm Connector in version 3.0.1:

• Fixed the DateTime issue in the 'Search Alarm' action due to which this action was unable to fetch alarms from LogRhythm.
• Fixed an issue with the 'Update Alarm' action due to which this action was unable to update the alarm information the alarm status, etc. of a specific alarm on the LogRhythm server,.

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.
You can also use the following yum command as a root user to install connectors from an SSH session:
yum install cyops-connector-logrhythm

Prerequisites to configuring the connector

• You must have the URL of the LogRhythm server to which you will connect and perform automated operations.
• You must have the API token that you will use to access LogRhythm's REST API to perform the operations.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the LogRhythm server.

Minimum Permissions Required

• Not Applicable

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Content Hub (or Connector Store) page, click the Manage tab, and then click the LogRhythm connector card. On the connector popup, click the Configurations tab to enter the required configuration details:

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations:

operation: Get Hosts

Input parameters

Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.

Output

The output contains the following populated JSON schema:
{
"HostZone": "",
"UseEventlogCredentials": "",
"ThreatLevelComments": "",
"ID": "",
"Name": "",
"OS": "",
"RiskLevel": "",
"EntityName": "",
"ThreatLevel": "",
"DateUpdated": "",
"Location": "",
"OSType": "",
"EntityId": "",
"Status": ""
}

operation: Get Hosts by Entities

Input parameters

Output

The output contains the following populated JSON schema:
{
"HostZone": "",
"UseEventlogCredentials": "",
"ThreatLevelComments": "",
"ID": "",
"Name": "",
"OS": "",
"RiskLevel": "",
"EntityName": "",
"ThreatLevel": "",
"DateUpdated": "",
"Location": "",
"OSType": "",
"EntityId": "",
"Status": ""
}

operation: DrillDown - Get Alarm Details

Input parameters

Note: This operation uses LogRhythm's AI Engine Cache Drilldown API to retrieve details of the alarm.

Output

The output contains the following populated JSON schema:
{
"DrillDownResults": {
"RetryCount": "",
"NotificationSent": "",
"Priority": "",
"RuleBlocks": [
{
"RuleBlockID": "",
"RuleBlockTypeID": "",
"DrillDownLogs": "",
"NormalMessageDateUpper": "",
"AIECount": "",
"DXCount": "",
"DDSummaries": [
{
"DrillDownSummaryLogs": "",
"DefaultValue": "",
"PIFType": ""
}
],
"NormalMessageDate": "",
"NormalMessageDateLower": ""
}
],
"WebConsoleIds": [],
"EventID": "",
"AIERuleName": "",
"AlarmID": "",
"DateInserted": "",
"AlarmGuid": "",
"AIERuleID": "",
"NormalMessageDate": "",
"LastDxTimeStamp": "",
"AIEMsgXml": "",
"Status": ""
},
"DrillDownSummary": ""
}

operation: DrillDown - Get Alarm Events

Input parameters

Note: This operation uses LogRhythm's AI Engine Cache Drilldown API to retrieve events of the alarm.

Output

The output contains the following populated JSON schema:
{
"Events": [
{
"logMessage": "",
"messageTypeEnum": "",
"session": "",
"impactedHost": "",
"impactedZoneName": "",
"classificationTypeName": "",
"threatId": "",
"mpeRuleId": "",
"threatName": "",
"messageId": "",
"entityId": "",
"count": "",
"normalDateMin": "",
"originZone": "",
"originEntityName": "",
"rootEntityId": "",
"ruleBlockNumber": "",
"vendorMessageId": "",
"keyField": "",
"rootEntityName": "",
"protocolName": "",
"mpeRuleName": "",
"originHost": "",
"entityName": "",
"normalDate": "",
"originIp": "",
"impactedEntityId": "",
"originHostName": "",
"commonEventId": "",
"impactedEntityName": "",
"subject": "",
"portProtocol": "",
"impactedHostName": "",
"impactedIp": "",
"logDate": "",
"commonEventName": "",
"sequenceNumber": "",
"protocolId": "",
"classificationName": "",
"action": "",
"normalMsgDateMax": "",
"originZoneName": "",
"severity": "",
"directionName": "",
"priority": "",
"originEntityId": "",
"classificationId": "",
"direction": "",
"originHostId": ""
}
],
"ID": ""
}

operation: Create Case

Input parameters

Output

The output contains the following populated JSON schema:
{
"id": "",
"number": "",
"externalId": "",
"dateCreated": "",
"dateUpdated": "",
"dateClosed": "",
"owner": {
"number": "",
"name": "",
"disabled": ""
},
"lastUpdatedBy": {
"number": "",
"name": "",
"disabled": ""
},
"name": "",
"status": {
"name": "",
"number": ""
},
"priority": "",
"dueDate": "",
"resolution": "",
"resolutionDateUpdated": "",
"resolutionLastUpdatedBy": {
"number": "",
"name": "",
"disabled": ""
},
"summary": "",
"entity": {
"number": "",
"name": "",
"fullName": ""
},
"collaborators": [
{
"number": "",
"name": ""
}
],
"tags": [
{
"number": "",
"text": ""
}
]
}

operation: Update Case

Input parameters

Output

The output contains the following populated JSON schema:
{
"id": "",
"number": "",
"externalId": "",
"dateCreated": "",
"dateUpdated": "",
"dateClosed": "",
"owner": {
"number": "",
"name": "",
"disabled": ""
},
"lastUpdatedBy": {
"number": "",
"name": "",
"disabled": ""
},
"name": " ",
"status": {
"name": "",
"number": ""
},
"priority": "",
"dueDate": "",
"resolution": "",
"resolutionDateUpdated": "",
"resolutionLastUpdatedBy": {
"number": "",
"name": "",
"disabled": ""
},
"summary": "",
"entity": {
"number": "",
"name": "",
"fullName": ""
},
"collaborators": [
{
"number": "",
"name": ""
}
],
"tags": [
{
"number": "",
"text": ""
}
]
}

operation: Get Case List

Input parameters

Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.

Output

The output contains a non-dictionary value.

operation: Get Case

Input parameters

Output

The output contains a non-dictionary value.

operation: Get Case Collaborators

Input parameters

Output

The output contains a non-dictionary value.

operation: Get Associated Cases List

Input parameters

Output

The output contains a non-dictionary value.

operation: Get Case Metrics

Input parameters

Output

The output contains a non-dictionary value.

operation: Add Alarm Evidence

Input parameters

Output

The output contains the following populated JSON schema:
{
"number": "",
"dateCreated": "",
"dateUpdated": "",
"createdBy": {
"number": "",
"name": ""
},
"lastUpdatedBy": {
"number": "",
"name": ""
},
"type": "",
"status": "",
"pinned": "",
"datePinned": "",
"alarm": {
"alarmId": "",
"alarmDate": "",
"alarmRuleId": "",
"alarmRuleName": "",
"dateInserted": "",
"entityId": "",
"entityName": "",
"riskBasedPriorityMax": ""
}
}

operation: Add Note Evidence

Input parameters

Output

The output contains the following populated JSON schema:
{
"number": "",
"dateCreated": "",
"dateUpdated": "",
"createdBy": {
"number": "",
"name": ""
},
"lastUpdatedBy": {
"number": "",
"name": ""
},
"type": "",
"status": "",
"text": "",
"pinned": "",
"datePinned": ""
}

operation: Get Evidence list

Input parameters

Output

The output contains a non-dictionary value.

operation: Get Evidence

Input parameters

Output

The output contains a non-dictionary value.

operation: Get Evidence Progress

Input parameters

Output

The output contains a non-dictionary value.

operation: Get User Event List

Input parameters

Output

The output contains a non-dictionary value.

operation: Search Alarm

Input parameters

Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.

Output

The output contains the following populated JSON schema:
{
"alarmsSearchDetails": [
{
"alarmId": "",
"alarmRuleName": "",
"alarmStatus": "",
"alarmDataCached": "",
"associatedCases": [],
"entityName": "",
"dateInserted": ""
}
]
}

operation: Get Alarm Details

Input parameters

Note: This operation uses LogRhythm's Alarm API to retrieve details of the alarm.

Output

The output contains the following populated JSON schema:
{
"alarmDetails": {
"alarmRuleID": "",
"alarmId": "",
"personId": "",
"alarmDate": "",
"alarmStatus": "",
"alarmStatusName": "",
"entityId": "",
"entityName": "",
"alarmRuleName": "",
"lastUpdatedID": "",
"lastUpdatedName": "",
"dateInserted": "",
"dateUpdated": "",
"associatedCases": [],
"lastPersonID": "",
"eventCount": "",
"eventDateFirst": "",
"eventDateLast": "",
"rbpMax": "",
"rbpAvg": "",
"smartResponseActions": "",
"alarmDataCached": ""
},
"statusCode": "",
"statusMessage": "",
"responseMessage": ""
}

operation: Get Alarm Events

Input parameters

Note: This operation uses LogRhythm's Alarm API to retrieve events of the alarm.

Output

The output contains the following populated JSON schema:
{
"alarmEventsDetails": [
{
"account": "",
"action": "",
"amount": "",
"bytesIn": "",
"bytesOut": "",
"classificationId": "",
"classificationName": "",
"classificationTypeName": "",
"command": "",
"commonEventId": "",
"cve": "",
"commonEventName": "",
"count": "",
"directionId": "",
"directionName": "",
"domain": "",
"duration": "",
"entityId": "",
"entityName": "",
"group": "",
"impactedEntityId": "",
"impactedEntityName": "",
"impactedHostId": "",
"impactedHostName": "",
"impactedInterface": "",
"impactedIP": "",
"impactedLocation": {
"countryCode": "",
"name": "",
"latitude": "",
"locationId": "",
"locationKey": "",
"longitude": "",
"parentLocationId": "",
"recordStatus": "",
"regionCode": "",
"type": "",
"dateUpdated": ""
},
"impactedMAC": "",
"impactedName": "",
"impactedNATIP": "",
"impactedNATPort": "",
"impactedNetwork": {
"beginIPRange": {
"value": ""
},
"dateUpdated": "",
"riskThreshold": "",
"endIPRange": {
"value": ""
},
"entityId": "",
"hostZone": "",
"locationId": "",
"longDesc": "",
"name": "",
"networkId": "",
"recordStatus": "",
"shortDesc": ""
},
"impactedPort": "",
"impactedZone": "",
"itemsPacketsIn": "",
"itemsPacketsOut": "",
"logDate": "",
"login": "",
"logMessage": "",
"logSourceHostId": "",
"logSourceHostName": "",
"logSourceName": "",
"logSourceTypeName": "",
"messageId": "",
"mpeRuleId": "",
"mpeRuleName": "",
"normalDateMax": "",
"objectName": "",
"objectType": "",
"originEntityId": "",
"originEntityName": "",
"originHostId": "",
"originHostName": "",
"originInterface": "",
"originIP": "",
"originLocation": {
"countryCode": "",
"name": "",
"latitude": "",
"locationId": "",
"locationKey": "",
"longitude": "",
"parentLocationId": "",
"recordStatus": "",
"regionCode": "",
"type": "",
"dateUpdated": ""
},
"originMAC": "",
"originName": "",
"originNATIP": "",
"originNATPort": "",
"originNetwork": {
"beginIPRange": {
"value": ""
},
"dateUpdated": "",
"riskThreshold": "",
"endIPRange": {
"value": ""
},
"entityId": "",
"hostZone": "",
"locationId": "",
"longDesc": "",
"name": "",
"networkId": "",
"recordStatus": "",
"shortDesc": ""
},
"originPort": "",
"originZone": "",
"parentProcessId": "",
"parentProcessName": "",
"parentProcessPath": "",
"policy": "",
"priority": "",
"process": "",
"processId": "",
"protocolId": "",
"protocolName": "",
"quantity": "",
"rate": "",
"reason": "",
"recipient": "",
"result": "",
"responseCode": "",
"sender": "",
"session": "",
"sessionType": "",
"serialNumber": "",
"serviceId": "",
"serviceName": "",
"severity": "",
"status": "",
"size": "",
"subject": "",
"threatId": "",
"threatName": "",
"url": "",
"userAgent": "",
"vendorInfo": "",
"vendorMsgId": "",
"version": "",
"originUserIdentityName": "",
"impactedUserIdentityName": "",
"originUserIdentityId": "",
"impactedUserIdentityId": "",
"senderIdentityId": "",
"senderIdentityName": "",
"recipientIdentityId": "",
"recipientIdentityName": ""
}
],
"statusCode": "",
"statusMessage": "",
"responseMessage": ""
}

operation: Get Alarm Summary

Input parameters

Output

The output contains the following populated JSON schema:
{
"alarmSummaryDetails": {
"dateInserted": "",
"rbpMax": "",
"rbpAvg": "",
"alarmRuleId": "",
"alarmRuleGroup": "",
"briefDescription": "",
"additionalDetails": "",
"alarmEventSummary": [
{
"msgClassId": "",
"msgClassName": "",
"commonEventId": "",
"commonEventName": "",
"originHostId": "",
"impactedHostId": "",
"originUser": "",
"impactedUser": "",
"originUserIdentityId": "",
"impactedUserIdentityId": "",
"originUserIdentityName": "",
"impactedUserIdentityName": "",
"originEntityName": "",
"impactedEntityName": ""
}
]
},
"statusCode": "",
"statusMessage": "",
"responseMessage": ""
}

operation: Get Alarm History

Input parameters

Output

The output contains the following populated JSON schema:
{
"AlarmHistoryDetails": [
{
"alarmId": "",
"personId": "",
"comments": "",
"dateUpdated": "",
"dateInserted": ""
}
],
"statusCode": "",
"statusMessage": "",
"responseMessage": ""
}

operation: Update Alarm

Input parameters

Output

The output contains the following populated JSON schema:
{
"statusCode": "",
"statusMessage": "",
"responseMessage": ""
}

operation: Add Alarm Comment

Input parameters

Output

The output contains the following populated JSON schema:
{
"statusCode": "",
"statusMessage": "",
"responseMessage": ""
}

operation: Add File Evidence

Input parameters

Output

The output contains the following populated JSON schema:
{
"number": "",
"dateCreated": "",
"dateUpdated": "",
"createdBy": {
"number": "",
"name": ""
},
"lastUpdatedBy": {
"number": "",
"name": ""
},
"type": "",
"status": "",
"text": "",
"pinned": "",
"datePinned": ""
}

operation: Download File Evidence

Input parameters

Output

The output contains a non-dictionary value.

operation: Delete Case Evidence

Input parameters

Output

The output contains the following populated JSON schema:
{
"number": "",
"dateCreated": "",
"dateUpdated": "",
"createdBy": {
"number": "",
"name": ""
},
"lastUpdatedBy": {
"number": "",
"name": ""
},
"type": "",
"status": "",
"text": "",
"pinned": "",
"datePinned": ""
}

operation: List Case Tags

Input parameters

Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.

Output

The output contains a non-dictionary value.

operation: Add Case Tags

Input parameters

Output

The output contains a non-dictionary value.

operation: Remove Case Tags

Input parameters

Output

The output contains a non-dictionary value.

operation: Get List Details

Input parameters

Output

The output contains the following populated JSON schema:
{
"number": "",
"text": "",
"dateCreated": "",
"createdBy": {
"number": "",
"name": "",
"disabled": ""
}
}

operation: Get Network List

Input parameters

Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.

Output

The output contains the following populated JSON schema:
{
"id": "",
"entity": {
"id": "",
"name": ""
},
"name": "",
"shortDesc": "",
"longDesc": "",
"riskLevel": "",
"threatLevel": "",
"threatLevelComment": "",
"recordStatusName": "",
"hostZone": "",
"location": {
"id": "",
"name": ""
},
"bip": "",
"eip": "",
"dateUpdated": ""
}

operation: Get User List

Input parameters

Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.

Output

The output contains the following populated JSON schema:
{
"id": "",
"recordStatusName": "",
"dateUpdated": "",
"objectPermissions": {
"readAccess": "",
"writeAccess": "",
"entity": {
"id": "",
"name": ""
}
},
"firstName": "",
"middleName": "",
"lastName": "",
"abbreviation": "",
"userType": "",
"shortDesc": "",
"longDesc": "",
"adGroup": "",
"adDomain": "",
"userPrincipalName": "",
"fullName": ""
}

Included playbooks

The Sample - LogRhythm - 3.0.1 playbook collection comes bundled with the LogRhythm connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the LogRhythm connector.

• > LogRhythm > Fetch and Create
• > LogRhythm > Fetch the Alarm Summary
• Add Alarm Comment
• Add Alarm Evidence
• Add Case Tags
• Add File Evidence
• Add Note Evidence
• Create Case
• Delete Case Evidence
• Download File Evidence
• DrillDown - Get Alarm Details
• DrillDown - Get Alarm Events
• Get Alarm Details
• Get Alarm Events
• Get Alarm History
• Get Alarm Summary
• Get Associated Cases List
• Get Case
• Get Case Collaborators
• Get Case List
• Get Case Metrics
• Get Evidence
• Get Evidence Progress
• Get Evidence list
• Get Hosts
• Get Hosts by Entities
• Get List Details
• Get Network List
• Get User Event List
• Get User List
• List Case Tags
• LogRhythm > Ingest
• Remove Case Tags
• Search Alarm
• Update Alarm
• Update Case

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.

FSR-LogRhythm Smart Response Plugin

Use the Smart Response Plugin (SRP) to invoke the playbooks in FortiSOAR™ whenever an alarm is triggered in LogRhythm. The "FSR_SmartResponse_Automation_Plugin" is attached to this article, you can download this SRP and then follow the steps mentioned in this article to import and configure the SRP.

Following is the procedure on how to import and configure the SRP:

1. Ensure that the LogRhythm server can connect to the FortiSOAR™ HTTPS server using port 443. You can check the connectivity by browsing the FortiSOAR™ UI using the LogRhythm server’s browser.
2. Import the LPI file of the SRP to the LogRhythm Client console by opening the Smart Response Plugin Manager located at Client Console > Deployment Manager > Tools > Administration > Smart Response Plugin Manager. On the Smart Response Plugin Manager screen click Actions > Import > Choose LPI and then choose SRP's LPI file.
   Now, the SRP is ready to trigger all required playbooks in FortiSOAR™:
   
3. LogRhythm uses the following two methods:
   1. Using an AIE Alarm:
      When an alarm is triggered in LogRhythm, for example, Malware, Dos Attack, Port Scan, etc, and if the team needs to invoke a playbook to complete some actions automatically, then open the Client Console and configure the rule to trigger the playbook as follows:

      Client Console > Deployment Manager > AI Engine > Rule to trigger playbook > Action
      On the "Action" screen, configure the necessary fields as is defined in Step 4.
      

   2. Using the LogRhythm Web UI:
      Analysts can trigger a playbook as per their requirements from the LogRhythm Web UI.
      Open Web Console > Select the corresponding log to action > Inspector Tab > Smart Response Plugin.
4. Configure the following parameters in SRP:
   • crhost – URL of the FortiSOAR™ server.
     Should be with an https, and with no ‘/ ‘at the end. For example, https://fortisoarhost.
   • authapi – FortiSOAR™ URI defined for authentication.
     Example of the value of this parameter: /auth/authenticate
   • playbookapi – FortiSOAR™ URI defined for playbooks.
     You can define the API when you create a playbook as follows:
     Click Custom API Endpoint as the "Trigger Step"
     
     In the Route field enter lrcreatealert:
     
     The URI in the above sample is: /api/triggers/1/lrcreatealert
   • Ignoressl – TRUE/FALSE parameter to ignore the SSL certificate. By default, FortiSOAR™ is installed using a self-signed certificate; therefore, if you want LogRhythm to accept it, set this parameter as TRUE
   • Username – Username used to log on to the FortiSOAR™ platform with the necessary privileges.
   • Password – Password used to log on to the FortiSOAR™ platform with the necessary privileges.
   • alarm id – The unique identifier of an alarm in LogRhythm.
     Always choose "Alarm field – Alarm ID" in LogRhythm when invoking the FortiSOAR™ API.
     
   • Optional parameters ( 1-5 ) – These are the optional parameters that you want to share from LogRhythm to FortiSOAR™ when an alarm is triggered on LogRhythm. SRP supports up to 5 Parameters to be passed to FortiSOAR™ for running playbooks for an alarm.
     For example, when LogRhythm alerts a “DoS '' alarm, it contains the origin of the "Host" that should be passed to FortiSOAR™ for further investigation and/or blocking the IP in the network firewall. Therefore, in LogRhythm, pass the following values to FortiSOAR™.
     
5. Once you complete configuring the values in SRP, now you can start receiving the values from LogRhythm:
   1. In the Custom API Endpoint Trigger step, add a variable named alert_input whose value is set as {{vars.input.params['api_body']}}. You can add the value of the variable using "Dynamic Values":
      
      For more information on "Dynamic Values", see the FortiSOAR™ product documentation.
   2. For easy usage, it is recommended that you add "Set Variable" as the next step and save the playbook.
      

Now, all parameters that are passed from LogRhythm will be accessible using:

{{vars.alert_input.alarm_id}}
{{vars.alert_input.p1}}
{{vars.alert_input.p2}}
{{vars.alert_input.p3}}
{{vars.alert_input.p4}}
{{vars.alert_input.p5}}

The LogRhythm connector contains the "Create LogRhythm Alert" playbook that creates an alert in FortiSOAR™ when an alarm is triggered in LogRhythm.

Following is a snapshot of the Executed Playbook Log for the playbook that creates an alert in FortiSOAR™ when an alarm is triggered in LogRhythm:

Following is a sample image of the alert created in FortiSOAR™:

FSR_SmartResponse_Automation_Plugin.tgz

Data Ingestion Support

Use the Data Ingestion Wizard to easily ingest data into FortiSOAR™ by pulling alarms from LogRhythm. Currently, alarms ingested from LogRhythm are mapped to "alerts" in FortiSOAR™. For more information on the Data Ingestion Wizard, see the "Connectors Guide" in the FortiSOAR™ product documentation.

Configure Data Ingestion

You can configure data ingestion using the “Data Ingestion Wizard” to seamlessly map the incoming LogRhythm alarms to FortiSOAR™ "Alerts".

The Data Ingestion Wizard enables you to configure the scheduled pulling of data from LogRhythm into FortiSOAR™. It also lets you pull some sample data from LogRhythm using which you can define the mapping of data between LogRhythm and FortiSOAR™. The mapping of common fields is generally already done by the Data Ingestion Wizard; users are mostly required to only map any custom fields that are added to alarms from LogRhythm.

1. To begin configuring data ingestion, click Configure Data Ingestion on the LogRhythm connector’s "Configurations" page.
   Click Let’s Start by fetching some data, to open the “Fetch Sample Data” screen.
   
   Sample data is required to create a field mapping between the LogRhythm alarm data and FortiSOAR™. The sample data is pulled from connector actions or ingestion playbooks.
2. On the Fetch Data screen, provide the configurations required to fetch alarm data from LogRhythm.
   Specify the time in minutes in the Pull Alarms Created in Last X Mins field to specify the time from when you want to pull alarms from LogRhythm. You can also filter the alarms fetched from LogRhythm based on the alarm status, alarm rule name, entity name, and case association:
   
   The fetched data is used to create a mapping between the alarms retrieved from LogRhythm and FortiSOAR™ alerts.
   Once you have completed specifying the configurations, click Fetch Data.

3. On the Field Mapping screen, map the fields of an alarm ingested from LogRhythm to the fields of an alert present in FortiSOAR™.
   To map a field, click the key in the sample data to add the “jinja” value of the field. For example, to map the associatedCases parameter of an alarm ingested from LogRhythm to the Description parameter of a FortiSOAR™ alert, click the Description field and then click the associatedCases field to populate its keys:
   
   For more information on field mapping, see the Data Ingestion chapter in the "Connectors Guide" in the FortiSOAR™ product documentation. Once you have completed the mapping of fields, click Save Mapping & Continue.

4. Use the Scheduling screen to configure schedule-based ingestion, i.e., specify the polling frequency to LogRhythm, so that the content gets pulled from the LogRhythm integration into FortiSOAR™.
   On the Scheduling screen, from the Do you want to schedule the ingestion? drop-down list, select Yes.
   In the “Configure Schedule Settings” section, specify the Cron expression For example, if you want to pull data from LogRhythm every morning at 5 am, click Daily, and in the hour box enter 5, and in the minute box enter 0:
   
   Once you have completed scheduling, click Save Settings & Continue.

5. The Summary screen displays a summary of the mapping done, and it also contains links to the Ingestion playbooks. Click Done to complete the data ingestion and exit the Data Ingestion Wizard.