Skip to main content
Skip table of contents

MAS-TRMG User Guide – AI Engine Rules

AI Engine Rules leverage LogRhythm technology to correlate events across your environment, helping to identify events of interest and potential compliance issues. As the FI matures its compliance program, it may also utilize other LogRhythm advanced security modules and other AIE components of SIEM, as described below in the Maturity Model section.

Malware Alarm Rule

A cornerstone of MAS-TRMG is the ability to continuously monitor the environment from all layers. Alert (#1036) is configured to work with anti-virus and malware detection systems to detect malicious activity within the environment. This AIE Rule creates an event and notification alert for malware detection on devices that have been designated as log sources or devices that support network monitoring.

Privilege Account Usage Rules

This set of AIE rules looks to monitor privileged account usage per established user lists within LogRhythm. LogRhythm user lists align with existing user account management and provisioning processes, easily implemented along with periodic access reviews to ensure access listings are up to date.

Silent Log Source and Audit Logging Rules

In MAS-TRMG, continuous monitoring of in-scope systems is critical to the ongoing success and health of the compliance program. This set of AIE rules creates an event and alerts when any log source fails to send logs to a LogRhythm Agent or when modifications to an audit log occur.

Log Requirements

These AIE rules cover all log sources in your environment but specifically require logs from anti-malware systems, firewalls, servers, workstations, security enforcing devices, access management systems and vulnerability detection systems. When configured correctly, LogRhythm’s advanced correlation and AIE rules provide near real-time alerts for malicious activities and/or attacks.

KB Content

Object Type



AIE Rule & Alert

MAS: Malware Alert


AIE Rule & Alert

MAS: Priv Acct Auth Failure Alert


AIE Rule & Alert

MAS: Priv Acct Access Failure Alert


AIE Rule

MAS: Priv Acct Auth Success Rule


AIE Rule

MAS: Priv Acct UAM Rule


AIE Rule

MAS: Priv Acct Access Success Rule


AIE Rule

MAS: Priv Acct Disabled/Enabled Rule


AIE Rule & Alert

MAS: LogRhythm Silent Log Source Error Alert


AIE Rule & Alert

MAS: Audit Log Cleared Alert


AIE Rule & Alert

MAS: Audit Log Write Failure Alert


JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.