Configure Database Access

Each service to be run under Integrated Security requires database access. To create database logins and users:

Security best practice is to use a unique domain account for each LogRhythm SQL account described in the table below to reduce the impact in the event of an account compromise. However, you can use a single domain service account for all LogRhythm SQL accounts.

1. Log in to SQL Server Management Studio on the LogRhythm Platform Manager under an account that is either a member of the sysadmin fixed server role or is a member of the LogRhythmGlobalAdmin security role.
2. Expand the Security node and then the Logins node to view the SQL logins.
3. Right-click the Logins node, and then click New Login.
4. On the General settings page, select Windows authentication.
5. The Active Directory or local Windows account name created for the LogRhythm Job Manager Service should be in the Login box. To browse for local or Active Directory accounts, click Search.
6. Set the default database to LogRhythmEMDB.
7. Click Server Roles on the left and ensure only public is selected.
8. Click User Mapping on the left.
9. Select the Map check box for each of the Platform Manager databases. In the lower window, assign the following role memberships for each of the mapped databases for the LogRhythm SQL accounts you want to run under Integrated Security.
   1. LogRhythm_Alarms
      • LogRhythmGlobalAdmin
      • LogRhythmGlobalAIE
      • LogRhythmGlobalAIEDrillDownCache
      • LogRhythmGlobalCaseAPI
      • LogRhythmGlobalJobMgr
      • LogRhythmGlobalNotification
      • LogRhythmGlobalWebUI
      • public
   2. LogRhythm_CMDB
      • LogRhythmGlobalAdmin
      • LogRhythmGlobalCaseAPI
      • LogRhythmGlobalCaseAPIAdmin
      • LogRhythmGlobalCaseAPIMaintenance
      • LogRhythmGlobalJobMgr
      • LogRhythmGlobalWebUI
      • public
   3. LogRhythm_Events
      1. LogRhythmGlobalAdmin
      2. LogRhythmGlobalAIE
      3. LogRhythmGlobalCaseAPI
      4. LogRhythmGlobalJobMgr
      5. LogRhythmGlobalWebUI
      6. public
   4. LogRhythm_LogMart
      • LogRhythmGlobalAdmin
      • LogRhythmGlobalAIE
      • LogRhythmGlobalJobMgr
      • LogRhythmGlobalWebUI
      • public
   5. LogRhythmEMDB
      • LogRhythmGlobalAdmin
      • LogRhythmGlobalAIE
      • LogRhythmGlobalARM
      • LogRhythmGlobalCaseAPI
      • LogRhythmGlobalMPE
      • LogRhythmGlobalNGLM
      • LogRhythmGlobalNotification
      • LogRhythmGlobalThreatAPI
      • LogRhythmGlobalWebServiceAdmin
      • public
   

   The LogRhythm System Monitor does not access the LogRhythm databases; therefore, database access does not need to be granted for this service.

10. Click OK to save the new login and database users.