LogRhythm SIEM

Connection Requirements

1 - IP

IP address or hostname of the LogRhythm Platform Manager server.

2 - Port

Port number for the LogRhythm Admin API (optional, default: 8501).

3 - API Key

Bearer token used to authenticate with the LogRhythm Admin API. To generate the token:

Only Global Admins or Restricted Admins with elevated View and Manage privileges can take this action.

1. Log in to the Client Console as a Global Administrator.

2. On the main toolbar, click Deployment Manager.

3. Click the Third Party Applications tab.

4. Right-click the blank area of the grid, and then click New.

5. Type an Application Name and Description, then click OK.

6. Right-click the newly created application, and then click Properties.

7. (Optional) Change the number of days you want the token to be valid.

8. Click Generate Token, enter the password for the user, and then click OK.

9. Copy the generated token and use it as the API Key value.

Note: The token appears only once and is not stored. If you do not copy it, you will have to regenerate it.

For more details, see the LogRhythm API documentation.

4 - Enrich Data

When enabled, the adapter will also fetch agent details from the /lr-admin-api/agents endpoint and enrich host data with agent version, status, last heartbeat, and active log source count.

(optional, default: Disabled)

Warning: Enabling this option may cause a slight increase in discovery time due to the additional API requests.

5 - SSL

Use SSL for connection (optional, default: Encrypted).

6 - Timeout

The amount of time (in seconds) to wait for API responses. (default: 30)

Attention

Please perform a connection test to ensure there is a valid connection to the LogRhythm SIEM host. When the discovery operation is finalized you will be able to see the details on Assets page.