Glossary of LogRhythm Products and Components

Grids access from the Knowledge tools menu that display active directory user or group information for the domains that were previously synchronized via the manager.

A tool used to setup, manage, and synchronize active directory domains. It is found within the Platform Manager tab of the Deployment Manager. Synchronization can be triggered from the manager or the domains can be left enabled for the Job Manager to pick it up on its schedule synchronization process.

The LogRhythm component that performs high-level, real-time analysis of log messages forwarded by the Data Processor. The AI Engine can elevate logs using a complex pattern matching rule-set, which correlates and detects sophisticated intrusions, insider threats, operational issues, and audit or compliance issues.

A Knowledge Base object that contains specific configuration to analyze if logs meet specific criteria. The Rule contains settings for Common Events, Event Suppression, Alarm/Notification settings, Expiration, and other rule properties. A rule can have up to 3 rule blocks.

A sub component of an AI Engine Rule that defines configuration parameters for logs to meet in order for the log to be considered satisfied by the rule block. A rule can have up to 3 rule blocks. There are 9 distinct variations of rule blocks.

A tool that allows users to manage AI Engine rules and rule blocks. It is accessed via the administration tools menu within Deployment Manager.

LogRhythm Agents, also called System Monitors, collect and forward log data to Data Processors. Agents can be installed on both Windows and UNIX platforms. They are also integrated into Site Log Forwarder (SLF) appliances and can perform file integrity monitoring.

A software component that receives data from the appliance and then sends it to LogRhythm SIEM for further processing.

A record indicating that an alarm rule has been triggered by an event.

A setting to restrict similar events from incurring alarms unless a specified number of them occur within a specified time span. The user can define what makes them similar by indicating which fields must have matching values.

An Alarm record that shows Alarm details.

A notification of an alarm via a notification policy: SMTP (email), SNMP, or Text Files. The person, role, or group to notify is set on the Alarm Rule Properties Notify tab. The Alarm Notification Policies are set via the Notification Policy Manager which is a distribution tool option within Deployment Manager.

A setting to suppress identical alarms based on the events triggering the alarm within a given time span.

Alarming and Response Manager. A Windows service installed in the Event Manager, which is responsible for processing Alarm rules and taking the appropriate response.

An event requiring immediate notification and response. Can be a single event or a combination of events (correlated events).

User or entity behavior that deviates from an established behavioral baseline for that user or entity and could indicate a security risk to your network.

See LogRhythm Appliance

A record that defines an application and its ports and protocols so that the MPE rules can identify a log origin. Applications are managed via the Application Manager accessed from the Knowledge Tools menu within Deployment Manager.

Network protocols or web applications that NetMon identified using pattern matching and heuristic modeling, as well as signatures.

A log that has been archived and therefore no longer available online via the Data Processor database.

The predictive processing or strategic analysis of personal data to anticipate subject behavior (profiling).

A function that identifies devices on the network using SNMP (v1, v2c, and v3). It identifies virtual sources for Syslog, Netflow, sFlow, and SNMP Trap. It is configured from the Data Processor Properties within Deployment Manager.

A feature that provides the ability to perform remediation actions (such as killing a process) based on information received from an alarm and its first event. Remediation actions can be performed automatically or require approval at the Alarm record. It uses a plug-in architecture that executes scripts on a windows system in a scripting language such as power shell.

Part of the MPE Rule that contains a tagged regular expression—the regex—used to identify the pattern of a log and isolate interesting pieces of metadata. Using a tagging system, these metadata strings can be directed to special fields used by LogRhythm to better interpret a log or specifically identify it. In general, base-rules identify log messages by matching the fields to a specific log format or pattern.

The period of time used to measure user or entity behavior in order to build Behavior Models in CloudAI. The maximum length of the Baseline Period is 29 days, but shorter lengths are used in cases of limited data.

One of many network or host activities exhibited by a user or entity. In CloudAI, Behavior Models are built from Behavior Features observed during the Baseline Period and are used to score Behavior Features observed during the Scored Period.

In CloudAI, a model of expected user or entity behavior derived from the combined activity across a specific subset of Behavior Features.

A number from 1 to 100, used by CloudAI, that indicates how anomalous a user or entity’s behavior was during the Scored Period when compared to the Baseline Period within a given Behavior Model.

Personal data protection policies to be adhered to by Data Controllers or Processors that are established by the Member State around the transfer of personal data.

The specific requirements of a breach without undue delay, but no later than 72 hours after becoming aware of the breach to Supervisory Authority. Communication of the breach to the Data Subject is required if anticipated impacts may result in high-risk to rights and freedoms of the natural person. This should also include required breach information and appropriate remediation actions to be taken.

An interface component, visible on the Cases page and Cases panel, that displays basic details about a case. It contains the controls for opening and closing cases and managing their incident statuses.

A forensic tool for tracking and documenting suspicious logs and alarms that are believed to be related to the same threat.

A second tier group used to categorize logs and events. There is one or more Classification associated to a Classification Type. A Classification can have one or more Common Events, which are associated to an MPE Rule.

A first tier group used to categorize logs and events. There are three types: Audit, Security, and Operations. Classifications are grouped into one of these three types. There is one classification type for one or more classifications.

Initiator of a session, such as a workstation or laptop.

An international standard (ISO/IEC 15408) for computer security certification.

A short, plain-language description of the log that is associated to a specific classification. There is one Classification for one or more Common Events. A Common Event is created and managed through the Knowledge Tools Common Platform Manager. Common Events are associated with MPE rules (base and sub) located within the Knowledge Tools MPE Rule Builder. There is a one to one relationship between a MPE rule and a Common Event.

An administration tool within Deployment Manager used to manage the changes to existing custom common event filters (such as report and investigation filters) within the users deployment which reference common events that have changed in the master LogRhythm Knowledge Base.

See LogRhythm Components.

An action one can perform on a log to gather more information about specific fields within the log including host, port, and user.

The primary time standard by which the world regulates clocks and time. Time zones around the world are expressed as positive or negative offsets from UTC. The hours, minutes, and seconds that UTC expresses is kept close to the mean solar time at the Earth's prime meridian (zero degrees longitude) located near Greenwich, England.

Software installed by LR Deploy. This includes: Mediator, AIE, Platform Manager, Data Processor, Data Indexer, Web Console, and others. This does not include collection agents.

An action one can perform on a log to perform an additional search based on field values within the log. For example, a user can select a log and choose to correlate on the value within the Common Event field or the values within all fields in the log. Correlation works with the Quick Search Toolbar.

A layout that contains graphs and charts in easy-to-read formats, which allows you to view high-level Events and also drill down on the data for further investigation.

An organization the defines the scope, purpose, and methods of processing personal data.

An Endpoint Monitoring tool that independently monitors and logs the connection and dis-connection of external data devices to the host computer where the Agent is running. It is managed from the System Monitor Agent properties within Deployment Manager.

LogRhythm Data Processor (DP) are Windows Server systems running SQL Server and a single server process, the LogRhythm Mediator Server. There can be one, or many, DPs in a deployment. In medium to large deployments, Data Processors should be dedicated systems. However, in small deployments, a Data Processor can coexist on the same system as the Platform Manager. The Mediator Server takes in log messages, processes them against rules which identify the log message and determine if it will be forwarded to the EM as an Event.

The national authorities tasked with the protection of data and privacy through monitoring and enforcement of regulations established within the EU.

A risk-based assessment methodology to determine an organization’s systems and business processing that may be exposed to risk in the absence of mitigating controls.

A new position created for an individual appointed within the organization to independently ensure adherence to policies and procedures set forth by General Data Protection Regulation in the European Union.

A natural person whose data is being processed by a data controller or processor.

A process that recognizes and consolidates duplicate event data from log sources into a single, aggregate record. All raw log data is captured and archived for accuracy and compliance, while the deduplication process eliminates redundant online data and optimizes forensic search capabilities and storage utilization. Deduplication is a Log Processing Setting that can be set at the log source or log processing policy and can be overridden using a Global Log Processing Rule (GLPR).

Allows users to write rules that will interact with network traffic as it is being processed.

Custom rules that enable users to determine flow state, access and set metadata, trigger alarms, enable capture, write log messages.

A process whereby NetMon analyzes network data using a variety of methods, including pattern matching, heuristic modeling, signatures for session identification, application identification, and metadata extraction.

A utility window in the LogRhythm Console. People with LogRhythm administrator credentials use it to configure and manage LogRhythm components and functionality such as alarming and reporting.

A window in the console that provides administrators with a near-real-time view of the per-formance of LogRhythm including host status, host performance metrics, database utilization, Data Processor metrics, and Data Processor volume.

The LogRhythm software installation tool to which the user adds each host IP in a deployment.

A record that represents a logical grouping of LogRhythm SIEM components. It organizes the deployment in host records, network records, and the LogRhythm components. Small deployments may contain one Entity record, while large deployments that span many sites require multiple Entity records.

A record that represents a computer on a network. It is contained within an Entity. As part of log processing, hosts are identified as impacted or origin and may be represented as a Known Host if it exists as an Entity Host record. Entity Hosts are displayed in the Entities tab within Deployment Manager.

A record that represents a range of IP addresses that can have a host zone, host location, threat level and network risk level associated. It is contained within an Entity. Entity Networks are dis-played in the Entities tab within Deployment Manager.

A Syslog message to LogRhythm SIEM that has more immediate operational, security, or compliance relevance. Typically logs classified as errors, failures, or attacks are considered events.

A rate set at the Rule level via the MPE Rule and the MPE Policy Rule Editor. It is used in the RBP calculation.

A rate set at the Rule level via the MPE Policy Rule Editor. It is used in the RBP calculation.

An Endpoint Monitoring tool that monitors files and directories for modifications. There are two modes: Standard and Realtime.

A collection of activity by a single user on a single application. The flow contains source and destination information, bytes and packet counts transferred in both directions, application identification, and many other metadata fields. Long-running flows send updates every 10 minutes by default, but you can change that value. Each flow has a unique identifier that links multiple intermediate flows together.

The global settings for the deployment including configuration options for event forwarding, log processing, log deduplication, and LogMart settings; maintenance settings for compression, indexing, partition, backup paths, and Time to Live (TTL) values; as well as Classification Based Data Management (CBDM) settings and Global Classification Settings (GCS). It is found within the Platform Manager tab of the Deployment Manager.

A Knowledge Base object used to provide a way to override settings defined in the Classification Based Data Management (CBDM) or standard Data Management settings (log message source and log processing policy). It provides a way to apply data management settings across all Data Processors, Log Sources, and Log Processing Policies to logs that meet specific criteria. The manager is accessed via the administration tools menu within Deployment Manager.

A session is a bi-directional flow of packets between one client and one server. A "half session" defines one direction of that flow, on either the sender or receiver side.

A single machine that has Core LogRhythm Software installed on it.

A small graphic on the page, which you can select to open a dialog box or window.

An account name, a badge number, an ID, or any other piece of data that belongs uniquely to one user.

A unified user. It contains a display name, email address, photo, job title, and any other identifier that belongs to that user.

Part of the Mediator/Message Processing Engine that prevents logs, events, and LogMart data that do not conform to the TTL values set in Global Maintenance Settings from being added to the online databases.

An update of the communications between the client and server.

A search analysis tool that is used to query the Platform Manager, Data Processor, or LogMart databases for a given date range and with specified criteria for log source and field filters, among other settings. The results are displayed in a layout that can be configured and saved and includes various grids, charts, and graphs, including Network Visualization. The data results can be drilled into to provide more detailed information.

The LogRhythm 6.0 services will support running on pure IPv6 networks as well as dual-stack (IPv4 and IPv6) networks. The LogRhythm services (Mediator, ARM, Job Manager, Agents, SQL Server) can be configured to use IPv6 address when communicating with each other.

No terms available

A LogRhythm Package that consists of a mixture of content both required and optional that is shared across a LogRhythm Deployment. It consists of the core Knowledge Base as well as modules. The core Knowledge Base includes content applicable to all deployments, such as log processing rules and policies, classifications, and common. The Knowledge Base is imported using the Knowledge Base Import Wizard accessed from the Knowledge tools menu within the console.

Pre-packaged, customizable content applicable to a specific regulation or need, such as reports, investigations, alerts, or AI Engine rules, to name a few. An example is a compliance module for PCI which would include reports, investigations, and AI Engine rules that provide data relevant in meeting PCI requirements. Modules are managed using the Knowledge Base Manager accessed from the Knowledge tools menu within the Console. Modules are imported with a Knowledge Base depending on their settings.

Defined LogRhythm items such as Alarm Rules, AI Engine Rules, Lists, Report Packages, Packaged Reports, Report Templates, FIM Policies, Investigations, Tails, and GLPRs that can be associated with a KB Module.

In the NetMon Data Rate chart, indicates the rate in megabits per second at which packets are being throttled/discarded according to your licensed capture rate.

A tool that is used to manage lists. A list is a record of data for a given type to allow for grouping similar values together in one location that can then be used with all LogRhythm tools that allow filtering. For example, a list may include all PCI compliance related log sources or suspicious hosts or privileged users. These lists can then be used in filters within Investigator, Personal Dashboard, and Reports (to name a few) while allowing it to be created/modified from one location.

Standard hostname given to the address of the loopback network interface. Localhost is spe-cified where one would otherwise use the hostname of a computer.

Individual log data collected by LogRhythm.

A policy based solution that allows users to forward specific syslog and non-syslog log messages to an external syslog receiver over TCP or UDP. It consists of a Receiver Manager and a Policy Manager both access via the distribution tools menu within Deployment Manager.

The central processing engine for logs sent from the Agents. The Log Manager contains the Mediator service, which is responsible for log identification and classification. A Log Manager can be installed on the Event Manager appliance or it can be a separate appliance in the SIEM deployment. Large environments may need more than one Log Manager in the deployment.

A raw log displayed in the Web Console's Analyzer grid. Also called a raw log.

A record that represents a single source of log data that is collected from a host. It is associated with a log source host, collection agent, and log message source type. It has specific data management and log processing settings and can have a MPE policy applied. An example source is Host 123 Microsoft Application Log.

A record that represents a common data format for logs. It has a specific log format such as syslog, netflow, text file, windows event log, UDLA, Checkpoint firewall, Cisco SDEE, SNMP Trap, QualysGaurd, Nessus, or sFlow. They have MPE Rules written for them so that logs run against them will be optimally parsed. An example type is Microsoft Windows Event Log Application. They are managed via the Knowledge Tools Log Message Source Type Manager.

A summary overview and trending tool that is opened after you perform a LogMart Search with Investigator.

A collection of MPE Rules designed for a specific Log Source Type such as Cisco PIX or Windows 2005 Security Event Log. Only Logs that are generated from Log Sources that have an assigned MPE Policy are processed by the MPE. There can be multiple policies for a single log source type to allow for flexibility in assigning the policy to various log sources.

The Agent can follow log rotations while collecting from files but cannot finish reading a log file that is compressed. The result of reading a compressed file are unpredictable. Disable compression of the log sources that Agent is monitoring. Most Linux systems use the logrotate utility and its corresponding config file logrotate.conf to control this compression.

See Log Message Source.

See Log Message Source Type.

The NetMon Flow Output component that processes the metadata into "flows."

Determines the amount of information logged to scarm.log. The number of logs you see depends on the LogLevel that is set in the Agent Advanced Properties. The log files that can be reviewed for success, error, and general log messages.

Network Connection Monitor logging option to generate logs for listening TCP/UDP sockets when NetworkConnectionMonitor is enabled.

A LogRhythm Appliance is a turn-key LogRhythm Server on custom hardware, designed and offered by LogRhythm. LogRhythm Appliances are available in PM, DP, XM (PM + DP), and SLF (Agent-only log collection machine) configurations. They are also offered in a number of sizes to meet varying collection-volume needs.

The LogRhythm Client Console provides deployment administration and user interaction with LogRhythm with a Graphical User Interface (GUI).

A LogRhythm User and Entity Behavior Analytics (UEBA) service that provides visibility into insider threats, compromised accounts, and privilege abuse.

LogRhythm Services that form the core of the deployment and need to be running on each host. These are the LogRhythm API Gateway, the LogRhythm Service Registry, and the LogRhythm Windows Authentication Service.

The software and associated databases required to run the LogRhythm Solution. This includes the Platform Manager (PM), Data Processor (DP), Advanced Intelligence (AI) Engine, LogRhythm SysMon Agents, and the Client and Web Consoles.

The collection of all hosts on a network.

The core LogRhythm Solution set, including Data Collection, Processing (MDI), Persistence, and AI Engine but not including LogRhythm NetMon or LogRhythm SysMon.

Includes the fields that LogRhythm parses, derives, and calculates from collected log data. For the full list of fields and their descriptions, see the LogRhythm Schema Dictionary and Guide, available under Documentation & Downloads on the LogRhythm Community.

An add-on product for network monitor functionality.

The free version of LogRhythm NetMon with reduced functionality.

The set of LogRhythm products including LogRhythm SIEM, LogRhythm XM, LogRhythm CloudAI, LogRhythm SysMon, LogRhythm NetMon, and LogRhythm NetMon Freemium. Also called the LogRhythm Threat Lifecycle Management Platform.

The LogRhythm Platform Manager (PM) server is a Windows Server system running SQL Server and the LogRhythm Alarming and Response Manager (ARM) service. There is only one PM per deployment. The PM is sent logs that are determined to be important or interesting, called Events, which it maintains. The PM also contains the deployment's configuration data. The ARM is a windows service responsible for processing alarm rules and taking the appropriate response, such as sending e-mails to people on a notification list.

A LogRhythm Server is a Windows Server running as an EM, DP, or both. Customers typically build a Server when they have purchased a software-only solution from LogRhythm.

A fully integrated Security Information and Event Management (SIEM) solution providing log management, advanced log analysis, event management, network and user monitoring, and reporting. The LogRhythm Solution is the collection of LogRhythm components that work together to bring log management, advanced log analysis, event management, monitoring, and reporting into one integrated solution.

An add-on product for system monitor functionality.

The set of LogRhythm products including LogRhythm SIEM, LogRhythm XM, LogRhythm CloudAI, LogRhythm SysMon, LogRhythm NetMon, and LogRhythm NetMon Freemium. Also called the LogRhythm Platform.

A LogRhythm Appliance which includes an Platform Manager (PM) and Data Processor (DP). An XM can also include the Data Indexer, SysMon, and AI Engine. It is targeted for small and mid-market.

A lightweight multi-paradigm programming language designed as a scripting language with extensible semantics as a primary goal.

An open source text retrieval library released under the Apache Software License.

A Media Access Control address (MAC address), which is a unique identifier assigned to network interfaces for communications on the physical network segment.

A working list of user-inputted hosts in a LogRhythm Deployment.

The average time it takes to recognize a threat that requires further analysis and response efforts.

The average time it takes to respond to and ultimately resolve an incident.

A service running on the Log Manager, which is responsible for log identification and classification.

Pre-allocated memory space with a fixed size. Pools allow for dynamic memory allocation and can help improve performance.

As part of the Log Manager's Mediator service, the Message Processing Engine is responsible for log identification and classification, Event processing, and metadata processing.

See Log Processing Policy

A record associated to a specific log message source type with a common event, base rule regular expression, sub rules and other processing and policy settings that is used for processing logs.

A record associated to a specific log message source type with a common event, base rule regular expression, sub rules and other processing and policy settings that is used for processing logs.

Details of a log message in a simple format within the LogRhythm databases. Metadata is parsed directly from a log message (explicit) of can be inferred from a log message (implicit).

A deployment in which any two or more hosts have LogRhythm software installed and communicating. This includes hosts with a standalone Web Console or AIE Engine.

A menu in the console for users to manage preferences and properties specific to their login. This includes general preferences for personal dashboard, investigator and tail, regional settings, and color themes as well as settings for personal alarms, notification policies, person properties and password changes.

The selections at the top of the page that allow you to move between Web Console pages. The currently active page is shown in blue letters.

The NetMon Packet Processing component that classifies data during Deep Packet Inspection.

An Endpoint Monitoring tool that independently monitors when network connections are opened and closed on a Windows or UNIX host where a LogRhythm Agent is running and NCM is configured. It is managed from the System Monitor Agent properties within Deployment Manager.

A networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks.

A log that is stored within the Data Processor database and available for immediate search.

A single report built from a template that has specific log source and filter criteria that is then configured and displayed in a specified report format such as Adobe Acrobat, Crystal Reports, or Microsoft Excel. The packaged report can be run ad-hoc and viewed via the console or stored for later viewing.

A unit of data carried by a packet-switched network.

A file format used for saving raw flow data.

An industry-standard format for containing packet capture data. PCAP data includes the raw packets for a flow. NetMon stores the raw packets from the network tap in PCAP files.

A monitoring analysis tool that is used to view data including alarms, events, statistics and various charts and graphs. It is highly configurable and allows for saving multiple layouts for view by various end users. Users can apply filters against the returned data for further refinement. The data within the tool can be drilled into to provide more detailed information.

The plan.yml file produced by the Deployment Tool that contains all information needed for each host in a LogRhythm Deployment to be configured correctly.

See LogRhythm Platform.

See LogRhythm Platform Manager.

An analysis tool of an organization’s exposure to privacy risks based on processing of personal data and the policies put in place to protect personal data.

An Endpoint Monitoring tool that independently monitors when processes start and end on a Windows or UNIX host where a LogRhythm Agent is running and PM is configured on the agent. It is managed from the System Monitor Agent properties within Deployment Manager.

A log after it has been processed through the Message Processing Engine (MPE) of the Mediator Server.

A procedure in which most identifying fields within a data record are replaced by one or more artificial identifiers.

A toolbar located at the bottom of the console window. It provides a quick and easy means of running ad-hoc investigations when the full search capabilities of Investigator aren’t required.

A log in its original form as it was received by the LogRhythm System Monitor Agent.

An analysis tool in the console that provides users the ability to manage report templates, packaged reports, and report packages.

A mixture of packaged reports combined into one package that has specific log source criteria. The report package can be run ad-hoc and viewed via the console or stored for later viewing. It can also be scheduled via the Scheduled Report Job Wizard.

A template that can be used to build a packaged report in a detail or summary form.

A data subject’s rights to access or receive information about their personal data that a data controller or processor is utilizing. Also called Subject Access Rights.

A data subject’s rights to request from data controller and processors to remove of all personal data from private and/or public avenues, including online sources, copies, links, or replications.

A data subject’s rights to deny consent of processing, profiling, or automatic decision making based on their personal data by a data controller or processor.

A data subject’s rights to have inaccurate personal data corrected without undue delay by the data controller or processor.

A calculation that results in a number between 1 and 100. It is used to determine how critical an event is based on a number of other rating and probability factors.

See Message Processing Engine Rule.

The collection of all rules developed to identify and normalize log data collected from a single log source type. Rule bases consist of multiple base rules and sub rules.

A Report tool used to schedule report packages to run for a specified period on a specified date and time. The job can be set to email an existing person and/or export to a UNC path.

The period of time used to measure user or entity behavior that is then compared to the Behavior Models built during the Baseline Period in CloudAI. The default length of the Scored Period is 24 hours. Data is analyzed in one-hour intervals, and the final hour shown includes data through the end of that hour.

A search analysis tool that is used to restore archived logs. The logs are reprocessed through the MPE using current settings. The logs are restored to the Online Archive Data Processor.

A bi-directional flow of packets between one client and one server. A "half session" defines one direction of that flow, on either the client or server side.

Security Information and Event Management.

An XM that does not have additional servers for the Web Console or AI Engine.

The ability to connect to a Mediator either within or outside network and have configurable connection paths. Agents need to be able to connect to a Mediator using more than one IP address. If a laptop has an Agent on it, the Agent connects to the Mediator using a particular IP address. That IP address may only be accessible from in the office and on the network. When the laptop moves to a remote location, the Agent will have to connect to the using a different IP address. The secondary IP address can be the external IP address for the Mediator (Agent communications get sent to the secondary IP and get routed internally to the Mediator’s IP.

A form of LogRhythm incident response that can be configured to automatically trigger with specific alarms or be set to trigger after passing through a chain of approvals. It reduces the need to perform common incident and investigation mitigation steps.

A tool that supports the collection of SNMP Traps (v1, v2c, or v3) sent from third-party network devices and systems. It collects the traps and translates them into LogRhythm logs. It is managed from the System Monitor Agent properties within Deployment Manager.

Part of the MPE Rule that differentiates log messages that match the same base rule using values in the log. Sub-rule tags can include a regex that only applies to the string in a specific field to identify information such as a log / event identification number, a message string, or even a user or group name.

An independent public authority established by Member States within the EU to monitor the application of regulations.

Syslog is a standard for logging program messages. It allows separation of the software that generates messages from the system that stores them and the software that reports and analyzes them. It also provides devices which would otherwise be unable to communicate a means to notify administrators of problems or performance. NetMon transfers data to the LogRhythm SIEM (or to a third-party system) using the Syslog protocol.

A monitoring analysis tool that provides real-time monitoring of log and event activity. It is an easy means of monitoring any activity based on device, log classification, or metadata contained in the log.

A potentially harmful situation for an information system that can have unwanted consequences. CloudAI classifies observations with a score of 70 or higher as threat events.

The framework that defines security workflows addressed by LogRhythm products.

The transfer of personal data between entities or third-countries for strictly valid business purposes and where consent from the data subject has been obtained.

A log that has been sent through the Message Processing Engine (MPE) that was not identified against any of the MPE Rules.

An Endpoint Monitoring tool that is used in conjunction with FIM, DLD, Process Monitor and Network Connection Monitor to include the user information related to the log activity. It is man-aged from the System Monitor Agent properties within Deployment Manager.

A number from 1 to 100 that indicates how anomalous a user or entity’s behavior was during the Scored Period when compared to the Baseline Period in CloudAI. The User Anomaly Score is a function of all Behavior Model Anomaly Scores for that user or entity.

An administration tool within Deployment Manager used to manage User Profiles. A User Profile is a configuration that defines the security role, Data Processor access and log source access for one or more user accounts.

No terms available

A mini-application, such as a chart or graph, that provides content for dashboards. Widgets can be resized and repositioned in page layouts to modify existing dashboards or create new ones.

A tool that allows users to configure LogRhythm to collect Windows Event Logs. It has the ability to scan domains and allows users to import computers. It is accessed via the administration tools menu within Deployment Manager.

No terms available

No terms available

No terms available