Skip to main content
Skip table of contents

LogRhythm Echo Use Cases and Their AIE Rules, Lists, and SmartResponses

Required Out-of-the-Box AIE Rules

  • CSC: Temporary Account Used
  • CSC: Password Modified by Another User
  • CSC: Accounts Disabled by Admin
  • Lateral: Account Added to Admin Group
  • Lateral: Multiple Account Passwords Modified by Admin

AIE Rule Use Cases

The following table has additional information about which AIE rules go with which use cases.

[ID] Use Case

AIE Rule

Import File

[1] UEBA Finance Data *

Finance Account Anomaly: Privilege Escalation v2

Finance Account Anomaly: Suspicious File Access v2

Finance Account Anomaly: Temporary Account Usage v2

Finance Account Compromise: Corroborated Anomalies v2

UC1a_AIERule.airx

UC1b_AIERule.airx

UC1c_AIERule.airx

UC1d_AIERule.airx

[8] Sensitive Data Exfiltration *

Suspicious: Sensitive Data Exfiltration v2

UC8_AIERule.airx

[14] SSH on Non-Standard Port

Inbound SSH on Non-standard Port

UC14_AIERule.airx

[17] Carbon Black – Unknown Binary

Suspicious Process - Carbon Black - Unknown Binary Running

UC17_AIERule.airx

[18] Concurrent VPN Account Usage

Concurrent VPN from Multiple Locations

UC18_AIERule.airx

[19] Temporary Account Used

CSC: Temporary Account Used

OOTB

[23] NetMon/LogRhythm DPA – Detect Credit Card

DPA rule and AIE rule together

UC23_AIERule.airx

[25] Account Anomaly – Password Modified by Another User

CSC: Password Modified by Another User

OOTB

[26] Admin Changing Multiple Account Passwords

Lateral: Multiple Account Passwords Modified by Admin

OOTB

[27] Account Anomaly - Admin Disabling Multiple Accounts

CSC: Accounts Disabled by Admin

OOTB

[28] Account Anomaly - Account Added to Administrator Group

Lateral: Account Added to Admin Group

OOTB

[29] Single Password Changed by Admin

Password Modified by Admin

UC29_AIERule.airx

[34] Carbon Black – End User PowerShell Network Activity

Carbon Black - End User PowerShell Network Activity

UC34_AIERule.airx

[34] Carbon Black – End User PowerShell Network Activity

[SmartResponse] Endpoint Lockdown

Used by AIE Rule “Carbon Black - End User PowerShell Network Activity”

UC34_SRPlugin.lpi

[35] Ops - Printer Misuse: Excessive Pages Printed

Excessive Pages Printed

UC35_AIERule.airx

[39] Unauthorized Sudo Attempt

CSC: Linux sudo Failure

UC39_AIERule.airx

[43] VPN While Logged in Locally Admin

Concurrent VPN from Multiple Locations

UC43_AIERule.airx

[46] Cylance - Malware Outbreak

Cylance - Malware Detected

UC46_AIERule.airx

LogRhythm versions prior to 7.3.1 do not import AIE Rules with nested lists. Importing AIE Rules for Use Cases with an asterisk requires LogRhythm version 7.3.1 or later. 
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.