7.12.0 GA Release Notes - 3 April 2023

Introducing LogRhythm SIEM 7.12! In this version, we improved the process for collecting and monitoring new security data sources. We streamlined these administrative tasks to give users more time to respond to and investigate detected threats. Brief explanations of the updates are grouped into the following sections:

• Analyst Experience
• Automation
• Data Collection
• Automatic Restored Archive Maintenance
• SecondLook Role-based Access Controls (RBAC)

Key highlights include:

• Enhanced Log Collection with LogRhythm OC Admin
• Log Source Virtualization Management with the Admin API
• Log Source Visibility in the Web Console

Sections on maintenance and upgrades:

• Upgrade Considerations
• Resolved Issues
• Known Issues

Analyst Experience

In the last release, LR SIEM 7.11, LogRhythm introduced SecondLook in the Web Console for LogRhythm Cloud customers who purchased archive storage. This new SecondLook UI lets LogRhythm Cloud customers configure and run SecondLook restores directly from the Web Console. In 7.12, we added a quick search function that allows users to retrieve completed SecondLook restore results with the click of a button.

An inactive search icon is now displayed in the actions column of each restore. When the restore status moves from In Progress to Completed, the icon activates.

Select the icon to quickly run a search for the logs restored by SecondLook.

Each search is pre-populated with the filter criteria used in the corresponding saved SecondLook restore settings, and it works like all other searches. The history of past searches is updated whenever you click the SecondLook quick search icon, giving you easy access to modify pre-populated filters.

Automation

Over the past several SIEM versions, LogRhythm has released additional endpoints for the Admin API that enable integration and automation workflows for log source and agent onboarding. Version 7.12 further extends these capabilities by adding endpoints that allow you to programmatically:

• Retrieve additional log source details, including:
  • Last Log Message
  • Silent Log Source configurations
  • System Monitor name
  • System Monitor ID
• Create and update virtual log sources from a template
• Update existing log source virtualization templates
• Manage log processing policies
• Manage log source types

For more details on all the available endpoints, refer to the API Documentation. New to the API and wondering how to get started? Learn more on the Community!

Data Collection

Version 7.12 improves log source onboarding workflows with log source visibility in the Web Console and enhancements to the Open Collector's OC Admin.

Added Beats Support in OC Admin

Collecting data from API log sources is faster and easier with OC Admin. In 7.12, we added support to the following LogRhythm Beats:

• Prisma
• Symantec Web Secure Service (WSS)
• Microsoft Graph API
• Carbon Black Cloud
• Cisco AMP
• DUO
• Proofpoint

Open Collector Administration

Monitoring collectors across the enterprise just became easier. LogRhythm SIEM 7.12 introduces light administration capabilities within OC Admin.

Live statistics (CPU, memory, network, storage, and processes consumption) are available for the containers running on a given Open Collector host.

On the Open Collector Manage page, customers can perform a series of actions on the Beats and Open Collector components, including: starting and stopping, importing and exporting configurations, exporting logs as files, and viewing high-level configurations or real time logs in the UI.

Finally, we added support for exporting and tracking Open Collector and Beats internal logs in real time.

Log Sources Page in the Web Console

In the Web Console, global and restricted administrators now have a Log Sources option in the Administration menu.

On the Log Sources page, administrators can quickly check the status and health of log sources in the Web Console. They can easily see if a log source is active or retired, along with the timestamp of the last log received. 

The Log Source Grid shows a dynamic display of log sources based on the access granted to the user.

Restricted administrators can only view the effective log sources defined in their user profile.

The Log Source Grid helps administrators immediately identify problematic log sources with Silent Log Source highlighting. In environments that contain thousands of log sources, admins can filter down to view just the log sources that matter. Filters include:

• • Name
  • Entity
  • Log Source Type
  • Log Source Host
  • Collection Agent
  • Silent Log Source status
  • Last Log Message

Automatic Restored Archive Maintenance

Administrators can now configure Automatic Maintenance of restored archives in LogRhythm SIEM 7.12. In the Configuration Manager, they can toggle automatic maintenance on or off. They can also set time to live (TTL) and maximum disk utilization parameters. When enabled, restored archive indices on the Data Indexer (indices labeled "logsar-") will be deleted based on whichever condition is met first - the specified TTL or the maximum disk utilization. When the maximum disk utilization condition is triggered, the oldest restored index is deleted first.

SecondLook Role-based Access Controls (RBAC)

For LogRhythm Cloud customers, role-based access controls now provide more granular options for allowing access to SecondLook. Within a user profile, administrators can grant a user access to the SecondLook tool in the Client Console, in the Web Console, or in both consoles.

Upgrade Considerations

Upgrade considerations for all 7.12.x releases are available on the LogRhythm Release Notes main page.

LogRhythm 7.9.0 introduced support for Microsoft SQL Server 2019 and Windows Server 2019 on standard deployments. If your deployment is running SQL Server 2016 Standard or Windows Server 2016, there is no need to upgrade to 2019.

For more information on the optional upgrades, see:

• Upgrade SQL Server 2016 to SQL Server 2019
• Upgrade Windows Server 2016 to Windows Server 2019

Resolved Issues

Resolved Issues - Security

Security-related issues resolved with this release are available for customers to view on the Community.

Known Issues

The following issues have each been found and reported by multiple users.