LogRhythm Echo API
Echo hosts a REST API that can be used to view and run use cases without the Echo web interface. The APIs can be called using the command line—for example, using curl—or a scripting language such as PowerShell.
List all use cases
API: https://localhost:33333/api/usecases
Results:
{
"num_results": 2,
"objects": [{"dateupdated": "2018-06-15T21:43:50.501Z", "description": "This use case demonstrates LogRhythm's Privileged User Monitoring and UEBA capabilities to detect a rogue user (Carl Wilson) attempting to hide their activity via temporary account (Steven Jacobs) and proceeding to exfiltrate financial data.\n\nVertical: Finance\nTechnology: FIM, UEBA\n\nRequired AIE Rules: Finance Account Anomaly: Privilege Escalation (UC1a_AIERule.airx)\nFinance Account Anomaly: Suspicious File Access (UC1b_AIERule.airx)\nFinance Account Anomaly: Temporary Account Usage (UC1c_AIERule.airx)\nFinance Account Compromise: Corroborated Anomalies (UC1d_AIERule.airx)\n\nRequired General Value List: Sensitive Files List (UC1_8_SensitiveFilesList.txt)", "enabled": null, "id": 1, "logs": 15, "pcaps": 0, "timedelay": 10, "title": "UEBA - Finance Data"}, {"dateupdated": "2017-11-14T17:35:11.555Z", "description": "Rouge user Beth Nickels finds a sensitive file (Executive Salaries.doc) and proceeds to attached the document to an email in Outlook and sends it to a Gmail account. \n\nVertical: Finance, General\nTechnology: FIM, NetMon\n\nRequired AIE Rule: Suspicious: Sensitive Data Exfiltration (UC8_AIERule.airx) \n\nRequired General Value List: Sensitive Files List (UC1_8_SensitiveFilesList.txt)", "enabled": null, "id": 8, "logs": 1, "pcaps": 1, "timedelay": 0, "title": "FIM - Sensitive Data Exfiltration"}],
"page": 1,
"total_pages": 1
}
View a specific use case
API: https://localhost:33333/api/usecase/<use case id>
Results:
{
"dateupdated": "2017-11-14T17:35:11.555Z",
"description": "Rogue user Beth Nickels finds a sensitive file (Executive Salaries.doc) and proceeds to attached the document to an email in Outlook and sends it to a Gmail account. \n\nVertical: Finance, General\nTechnology: FIM, NetMon\n\nRequired AIE Rule: Suspicious: Sensitive Data Exfiltration (UC8_AIERule.airx) \n\nRequired General Value List: Sensitive Files List (UC1_8_SensitiveFilesList.txt)",
"enabled": null,
"id": 8,
"logs": [
{
"description": "Realtime FIM alert of Beth Nickels using Outlook to read Executive Salaries.doc",
"id": 12,
"log": "REALTIME FILEMON EVENT=READ OBJECT=C:\\Sensitive\\Executive Salaries.doc USER=SANDBOX\\beth.nickels PROCESS=outlook.exe OFFSET=0 LENGTH=65536 SIZE=11971 DETAILS=lastaccess=9/6/2016 11:08:26 PM lastwrite=4/17/2015 10:20:40 AM create=9/10/2013 12:22:04 PM usersid=S-1-5-21-4140510078-396723217-1023477983-6166 pid=5852",
"message": "Realtime FIM alert of Beth Nickels using Outlook to read Executive Salaries.doc",
"msg_src_id": 3,
"msg_src_name": "LogRhythm File Monitor (Windows)",
"owner_id": 8,
"timestamp": null
}
],
"pcaps": [
{
"byte_size": 48136,
"description": "Replaying network traffic connecting to Gmail via SMTP",
"filename": "6f8ab13a-9d2e-47a2-a7fd-6e307867a609.pcap",
"id": 16,
"message": "Replaying network traffic connecting to Gmail via SMTP",
"owner_id": 8
}
],
"timedelay": 0,
"title": "FIM - Sensitive Data Exfiltration"
}
Run a use case
API: https://localhost:33333/api/execute/<use case id>
Results:
SUCCESS
Number of logs sent to SIEM: 1/1
Number of PCAPs sent to Network Monitor: 1/1
Sample PowerShell Script to Run Use Cases
The following example PowerShell script can be used to run use cases 1, 8, and 9 on the host ECHOBASE:
echo 'Running ECHO use cases...'
add-type @"
using System.Net;
using System.Security.Cryptography.X509Certificates;
public class TrustAllCertsPolicy : ICertificatePolicy {
public bool CheckValidationResult(ServicePoint s,
X509Certificate c,
WebRequest r, int p) {
return true;
}
}
"@
[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy
Invoke-WebRequest -URI https://ECHOBASE:33333/api/execute/1
Invoke-WebRequest -URI https://ECHOBASE:33333/api/execute/8
Invoke-WebRequest -URI https://ECHOBASE:33333/api/execute/9
echo 'Done running ECHO use cases.'