SOX User Guide – AI Engine Rules

AI Engine Rules leverage LogRhythm technology to correlate events across your environment, helping to identify events of interest and potential compliance issues.

Malware Alert Rule

A cornerstone of SOX is the ability to continuously monitor the environment from all layers. Alert (#944) is configured to work with anti-virus and malware detection systems to detect malicious activity within the environment. This AIE Rule creates an event and notification alert for malware detection on devices that have been designated as log sources or on devices that support network monitoring.

Privilege Account Usage Rule

This set of AIE Rules monitors privileged account usage according to established user lists within LogRhythm. LogRhythm user lists align with existing user account management and provisioning processes, which are easily implemented along with periodic access reviews to ensure access listings are up to date.

LogRhythm Silent Log Source Rule

In SOX, continuous monitoring of in-scope systems is critical to the ongoing success and health of the compliance program. This AIE rule creates an event and alerts when any log source fails to send log data.

Log Requirements

These AIE Rules cover all log sources in your environment but specifically require logs from anti-malware systems, firewalls, servers, workstations, security enforcing devices, access management systems, and vulnerability detection systems. When configured correctly, LogRhythm’s advanced correlation and AIE Rules provide near real-time alerts for malicious activities and/or attacks.

Knowledge Base Content