> For the complete documentation index, see [llms.txt](https://docs.octoxlabs.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.octoxlabs.com/adapters/adapters/logrhythm-siem.md).

# LogRhythm SIEM

## Connection Requirements

### 1 - IP

IP address or hostname of the LogRhythm Platform Manager server.

### 2 - Port

Port number for the LogRhythm Admin API (optional, default: **8501**).

### 3 - API Key

Bearer token used to authenticate with the LogRhythm Admin API. To generate the token:

Only Global Admins or Restricted Admins with elevated View and Manage privileges can take this action.

1. Log in to the Client Console as a Global Administrator.
2. On the main toolbar, click **Deployment Manager**.
3. Click the **Third Party Applications** tab.
4. Right-click the blank area of the grid, and then click **New**.
5. Type an **Application Name** and **Description**, then click **OK**.
6. Right-click the newly created application, and then click **Properties**.
7. (Optional) Change the number of days you want the token to be valid.
8. Click **Generate Token**, enter the password for the user, and then click **OK**.
9. Copy the generated token and use it as the API Key value.

**Note:** The token appears only once and is not stored. If you do not copy it, you will have to regenerate it.

For more details, see the [LogRhythm API documentation](https://developers.exabeam.com/logrhythm-siem/docs/register-third-party-applications-for-the-api).

### 4 - Enrich Data

When enabled, the adapter will also fetch agent details from the **/lr-admin-api/agents** endpoint and enrich host data with agent version, status, last heartbeat, and active log source count.

(optional, default: **Disabled**)

**Warning:** Enabling this option may cause a slight increase in discovery time due to the additional API requests.

### 5 - SSL

Use SSL for connection (optional, default: **Encrypted**).

### 6 - Timeout

The amount of time (in seconds) to wait for API responses. (default: 30)

{% hint style="danger" %}
**Attention**

Please perform a connection test to ensure there is a valid connection to the LogRhythm SIEM host. When the discovery operation is finalized you will be able to see the details on Assets page.
{% endhint %}