Healthcare Security Deployment Guide – Import and Synchronize the Module
Gather Information Before Deploying the Module
The following information should be gathered before implementing the Healthcare Security Compliance Automation Suite. This information is required when populating Lists and configuring individual AI Engine Rules:
- Log Sources
- Users
- General Values
Threat Intelligence Service
LogRhythm’s Threat Intelligence Service is compatible with the Healthcare Security Compliance Automation Suite. Module components that dictate “Threat IP,” within the object title, are configured with the threat lists from the Threat Intelligence Service by default. The Healthcare Security Compliance Automation Suite host list titled “HSS: Threat IPs” is where a collection of the threat lists from the service can be found and modified.
More information on the Threat Intelligence Service, including but not limited to service installation, can be found on the LogRhythm Support Portal.
Import the Module
The Healthcare Security Compliance Automation Suite is part of the LogRhythm Knowledge Base (KB). Updating the KB automatically creates the proper Lists and AI Engine Rules.
- Download the newest Knowledge Base from the LogRhythm Community.
- Open the LogRhythm Console.
In the Client Console on the Tools menu, click Knowledge, and then click Knowledge Base Manager.
To open the Knowledge Base Manager, the Deployment Manager must be closed.
- On the File menu, click Import Knowledge Base File.
- Select the newly downloaded Knowledge Base file, and then click Next to unpack and validate it.
This step takes a few minutes as the system unpacks the new Knowledge Base. - When the import is complete, you may have the option to preview common event changes.
You should now be on step 4 in the Knowledge Base Import Wizard, “Import Knowledge Base." - Scroll down, select Compliance Automation Suite: Healthcare Security, and then click OK.
- To import the Knowledge Base, click Next.
You will receive confirmation that the import was successful. - Click Next to review common event changes, or close the Knowledge Base import dialog box.
