[{"id":"ci_68e93177eabed66563c8dbfce400ae570eec75d69f7fbb4f634412c71f88c884","title":"LogRhythm Release Notes","path":"/lrsiem/7.17.0/logrhythm-release-notes","children":[{"id":"ci_c467a2a8418550825cad300f88a825a9d23e509bdc44a55fbb924de1c53fa702","title":"7.17.0.55 Release Notes - 12 August 2024","path":"/lrsiem/7.17.0/7-17-0-55-release-notes-12-august-2024","children":[]},{"id":"ci_ffc8bf98225fb84bc9434eeaee388e46a37627991db1e116a28b2f994a96b56d","title":"7.17.0 GA Release Notes - 1 July 2024","path":"/lrsiem/7.17.0/7-17-0-ga-release-notes-1-july-2024","children":[]},{"id":"ci_ef4edbd9303a466dde02cf67b548fbc5c9511ab13e238771202daaf6fdfb7ce3","title":"7.16.0.45 Release Notes - 24 April 2024","path":"/lrsiem/7.17.0/7-16-0-45-release-notes-24-april-2024","children":[]},{"id":"ci_19b4278bd59e704c0a112414979a3b01520cb3fc038124cc4ee5c2ee8d2ad207","title":"7.16.0 GA Release Notes - 1 April 2024","path":"/lrsiem/7.17.0/7-16-0-ga-release-notes-1-april-2024","children":[]},{"id":"ci_33a090ca45dcc72fefe6f62d09d332c5b89b7ac89f3c49313c319de46f8a934f","title":"7.15.0.64 Release Notes - 5 February 2024","path":"/lrsiem/7.17.0/7-15-0-64-release-notes-5-february-2024","children":[]},{"id":"ci_e329a663f1a2bc7ce3ea30a03e29456d3bca209321fd088f7d30b587e8b2dc67","title":"7.15.0 GA Release Notes - 4 January 2024","path":"/lrsiem/7.17.0/7-15-0-ga-release-notes-4-january-2024","children":[]},{"id":"ci_d20926d4a44abd88ae112b51773c1f561032862771deeb34928542c7d586f120","title":"7.14.0.107 Release Notes - 18 October 2023","path":"/lrsiem/7.17.0/7-14-0-107-release-notes-18-october-2023","children":[]},{"id":"ci_699ce6e0864551c5a0792941f0112230ac52ee361c7159d08b7e4140dcb05d34","title":"7.14.1 Release Notes - 13 November 2023","path":"/lrsiem/7.17.0/7-14-1-release-notes-13-november-2023","children":[]},{"id":"ci_83c649d3abf2dcf97e1a0ee23e9a14db3e9fd7d010055fde05d422b515eb02a3","title":"7.14.0 GA Release Notes - 2 October 2023","path":"/lrsiem/7.17.0/7-14-0-ga-release-notes-2-october-2023","children":[]},{"id":"ci_419057b21cb592b8177ddda73f4a315537cf542453e65bad81a08836e1170894","title":"7.13.0.78 Release Notes - 2 August 2023","path":"/lrsiem/7.17.0/7-13-0-78-release-notes-2-august-2023","children":[]},{"id":"ci_c7bd2950fd33d004c07908bab4375ce9917403a7c7f61eb9a99b7c1563ea5994","title":"7.13.0.76 Release Notes - 17 July 2023","path":"/lrsiem/7.17.0/7-13-0-76-release-notes-17-july-2023","children":[]},{"id":"ci_729fb08ef37cd0b722a01576c309fa6b6e4de0b53fcd18dfde2309e856728919","title":"7.13.0 GA Release Notes - 29 June 2023","path":"/lrsiem/7.17.0/7-13-0-ga-release-notes-29-june-2023","children":[]},{"id":"ci_e9b96f339500e6dd8119d2115c985047a4994b08348b006ce7218ed7d068fb21","title":"7.12.0 GA Release Notes - 3 April 2023","path":"/lrsiem/7.17.0/7-12-0-ga-release-notes-3-april-2023","children":[]},{"id":"ci_d81cd8f928cb97ca7bf04bd9e458929a48af3e55c0753e3b519182b8b3a49077","title":"7.11.0.43 Release Notes - 6 March 2023","path":"/lrsiem/7.17.0/7-11-0-43-release-notes-6-march-2023","children":[]},{"id":"ci_5c9350f1f4bd46239843252a4511114b65f14889564f52b59eae09b1ff0c8486","title":"7.10.0.124 Release Notes - 6 March 2023","path":"/lrsiem/7.17.0/7-10-0-124-release-notes-6-march-2023","children":[]},{"id":"ci_e185169227f7295462f8e9cefb7a515f7fe7b415b46d4d930adfc4485aac8ada","title":"7.11.0 GA Release Notes - 5 January 2023","path":"/lrsiem/7.17.0/7-11-0-ga-release-notes-5-january-2023","children":[]},{"id":"ci_268b9631f2531f7fe7cf8ebb7831e2d29bbb42efc65bd48372b75bb8eb38d8e5","title":"7.10.0.123 Release Notes - 11 October 2022","path":"/lrsiem/7.17.0/7-10-0-123-release-notes-11-october-2022","children":[]},{"id":"ci_7d12f83b74357ae95877d2ace7b44f6fc907016472c36777c589ce2595cec75c","title":"7.10.0 GA Release Notes - 29 September 2022","path":"/lrsiem/7.17.0/7-10-0-ga-release-notes-29-september-2022","children":[]},{"id":"ci_e4db906accb4e5f676786d786e2f19f9e7c21d1b77739e3d35e5d7574c478a83","title":"7.9.0 GA Release Notes - 23 June 2022","path":"/lrsiem/7.17.0/7-9-0-ga-release-notes-23-june-2022","children":[]}]},{"id":"ci_2227d870f6d510d9d688161cdd4bc7878231a160c5dc1935f8aa14f851ba56ef","title":"Get Started with LogRhythm SIEM","path":"/lrsiem/7.17.0/get-started-with-logrhythm-siem","children":[{"id":"ci_15f7c1fb7b550ecaf9b6b8544e675b8c96e162007485a5a87ca144af5a8b79ef","title":"Log in to the Client Console","path":"/lrsiem/7.17.0/log-in-to-the-client-console","children":[]},{"id":"ci_25e2a3464158327e66cadc3e9775d9e11fb8cf376edca902e63a8d98995cadde","title":"Complete the New Deployment Wizard","path":"/lrsiem/7.17.0/complete-the-new-deployment-wizard","children":[]},{"id":"ci_da10aa85844dcb64bafb518d1cc953894e35fa284d73964ed59e81e634fb983d","title":"Assign LogRhythm Licenses","path":"/lrsiem/7.17.0/assign-logrhythm-licenses","children":[]},{"id":"ci_9ad0b8613015fb5a074eff771377fd5cd0394ca18ad45973e2030d43e968dd04","title":"Log in to the Web Console","path":"/lrsiem/7.17.0/log-in-to-the-web-console","children":[]},{"id":"ci_48a8b29a35c9949e5aa24c1eb342b011d2b9db439395c3a72b72b02113f831f9","title":"Verify the Web Console Connection Status","path":"/lrsiem/7.17.0/verify-the-web-console-connection-status","children":[]},{"id":"ci_77b4a5fa89a58f7fe7e336704cd5a473b617896db7f161c5a0cbae5859dc99e4","title":"Configure NetMon to Integrate with the Web Console","path":"/lrsiem/7.17.0/configure-netmon-to-integrate-with-the-web-console","children":[]}]},{"id":"ci_a8a9893f4e29ebb5ceab71227f195ee330a8130beae6e57502de41d321db7d61","title":"Client Console Administrator Guide","path":"/lrsiem/7.17.0/client-console-administrator-guide","children":[{"id":"ci_5c6132a1cc8e13567ed86c66b5b0e320e1a958041faadf2bfb0a80ecc7c5481d","title":"Advanced Intelligence Engine","path":"/lrsiem/7.17.0/advanced-intelligence-engine","children":[{"id":"ci_a86fb41f708ba6463aa3a70ecfcda463ffbedc224b07478f60d725b9ecf09ae9","title":"Add AI Engine Servers","path":"/lrsiem/7.17.0/add-ai-engine-servers","children":[]},{"id":"ci_bb237116ddbc9bd89a0262760df59df34a65a85c0128d903f19d8623abc82717","title":"Apply Recommended Values to an AI Engine Server","path":"/lrsiem/7.17.0/apply-recommended-values-to-an-ai-engine-server","children":[]},{"id":"ci_6b044c616936a77fd29c32ccf750edc4b2ddd45fe4b6d517cff418019fec014a","title":"Configure the Advanced Intelligence Engine","path":"/lrsiem/7.17.0/configure-the-advanced-intelligence-engine","children":[]},{"id":"ci_eb9afdfcbf0858297bf4edbff2465b0d2758cf64ae66f56203576567b13b030b","title":"Create New AI Engine Rules","path":"/lrsiem/7.17.0/create-new-ai-engine-rules","children":[]},{"id":"ci_7897b7c5605d7cb08178e5ae91db0bf12f5a4b95f83ef02c5d68132ebeb7d538","title":"Define AI Engine Linked Data Block Relationships","path":"/lrsiem/7.17.0/define-ai-engine-linked-data-block-relationships","children":[]},{"id":"ci_efc33b1e76929681f677caeb6f730190d1d3e62933d08ff74b849062b69882c5","title":"Define AI Engine Rule Block Relationships","path":"/lrsiem/7.17.0/define-ai-engine-rule-block-relationships","children":[]},{"id":"ci_aad4840aed5e362ab1c5440545f3b3b78c1492fd460e6bb5d2f2a7e700df8a36","title":"Drill Down on AI Engine Results","path":"/lrsiem/7.17.0/drill-down-on-ai-engine-results","children":[]},{"id":"ci_06ee69bd54b6409fc99db8eedf9d1d38a44e327ecf55fa54c4ee5a27a9a11117","title":"Import or Export AI Engine Rules from the Grid","path":"/lrsiem/7.17.0/import-or-export-ai-engine-rules-from-the-grid","children":[]},{"id":"ci_69bacc8b3cf7155cd349e4a4bf78117d20f3a0331ba50032d73a2bff27233bd1","title":"Modify AI Engine Rules","path":"/lrsiem/7.17.0/modify-ai-engine-rules","children":[]},{"id":"ci_50cf96f83bb33dabd3d5b93657cd61b69c8592c84f395526630b25dc57649800","title":"Restart AI Engine Servers","path":"/lrsiem/7.17.0/restart-ai-engine-servers","children":[]},{"id":"ci_673af244b37a8a2ad3d263203af6062b0d468cd84729295a74e956146ee3534d","title":"Revert an AI Engine Server to a Previous Configuration","path":"/lrsiem/7.17.0/revert-an-ai-engine-server-to-a-previous-configuration","children":[]},{"id":"ci_560f7c5fbdf1af399cd980df0b17aa638828bd136ea9c4a6187cebe2700fb522","title":"Update the IP Address of an AI Engine","path":"/lrsiem/7.17.0/update-the-ip-address-of-an-ai-engine","children":[]},{"id":"ci_979a68fefee26aac90c71184768d664536a70131c0b7fdde256ab4a8962984c3","title":"Use AI Engine Rule Sets","path":"/lrsiem/7.17.0/use-ai-engine-rule-sets","children":[]},{"id":"ci_c79ea6b3d58687e1d6b27256d3d1f04e1dc883936edb3d7f072450b059f27fe4","title":"Use AI Engine Workloads","path":"/lrsiem/7.17.0/use-ai-engine-workloads","children":[]},{"id":"ci_dbc2c51073f326d12e6aaceeaa54889e86d47e54d99d213c9b8c0654e55e0460","title":"Use Saved AI Engine Filters","path":"/lrsiem/7.17.0/use-saved-ai-engine-filters","children":[]},{"id":"ci_ca3337d45c4128a81df8f8150a6754c4e297a2974e1775b962c553ce7d940275","title":"Use the AI Engine Local Configuration Manager","path":"/lrsiem/7.17.0/use-the-ai-engine-local-configuration-manager","children":[]},{"id":"ci_5c703efc20038be90b07eb8860a5d25948d0276947a47e8fc595ad5ae539d5f4","title":"View AI Engine Generated Alarms","path":"/lrsiem/7.17.0/view-ai-engine-generated-alarms","children":[]},{"id":"ci_98dad89e3c45fa20bbb376dcd24764a3be9cc3feaaefb53194a8dd595cdf7276","title":"View AI Engine Rules","path":"/lrsiem/7.17.0/view-ai-engine-rules","children":[]},{"id":"ci_469a8df3700ac6ed431847cb0dc043492c52ebc74a9484b989411ef91d0eb1e8","title":"Work with Existing AI Engine Rules","path":"/lrsiem/7.17.0/work-with-existing-ai-engine-rules","children":[]}]},{"id":"ci_e81813f02a1d9e72e75ef536138de39c7deb5bcd7c40edd4cbe35ca0ed119b79","title":"Alarm Rules","path":"/lrsiem/7.17.0/alarm-rules","children":[{"id":"ci_4e7adc801b82078b3672701b1268361fecf9008c12d5f9d84c247fc603b0ada7","title":"Alarm Notification Policies","path":"/lrsiem/7.17.0/alarm-notification-policies","children":[{"id":"ci_1c62ed230f4fbe6cb068112840622ce08d0de9021d92e81a3993cca02022ebc7","title":"Create Group Notifications for Alarms","path":"/lrsiem/7.17.0/create-group-notifications-for-alarms","children":[]},{"id":"ci_c67e994f7bef609fe51941ec48776281ee98743d2bbbcfd8312fd52d24d9d09d","title":"Create New Email Alarm Notification Policies","path":"/lrsiem/7.17.0/create-new-email-alarm-notification-policies","children":[]},{"id":"ci_6a069b1f7493930c64a6bf024d90c09583f730256ca84319de5ec3cb7e32086d","title":"Create New SNMP Alarm Notification Policies","path":"/lrsiem/7.17.0/create-new-snmp-alarm-notification-policies","children":[]},{"id":"ci_aa6456f5d1752db22893ecfbe014399bc92b03e3ddf2656d5217c954500b97f1","title":"Create New Text File Alarm Notification Policies","path":"/lrsiem/7.17.0/create-new-text-file-alarm-notification-policies","children":[]},{"id":"ci_9b94c883bfec2890533f27c95af9fa91addc02777667aea218d2d0e59268d655","title":"Define a Text File Notification Policy","path":"/lrsiem/7.17.0/define-a-text-file-notification-policy","children":[]}]},{"id":"ci_cb96e9754bf0fc512b084a6a3bc5286f80f664df0a2c90e7b9fda998f98b49a6","title":"Create Alarm Rules","path":"/lrsiem/7.17.0/create-alarm-rules","children":[]},{"id":"ci_2dc7d7b5700db9886b42c2076c98803dd3789a6bcdac6e173ce9e69de37ca87d","title":"Create Alarm Rules for Known Logs","path":"/lrsiem/7.17.0/create-alarm-rules-for-known-logs","children":[]},{"id":"ci_39a979635c57023bda363f7fa03d9e455ffb7e5b8766a13f58d44d205aceebaa","title":"Enable and Disable Alarm Rules","path":"/lrsiem/7.17.0/enable-and-disable-alarm-rules","children":[]},{"id":"ci_ebd7cec2641524ee6640ed70071e37cd7c280fb2f1ab05bc00b06fb84c322f44","title":"Modify Alarm Rule Notifications in Batch","path":"/lrsiem/7.17.0/modify-alarm-rule-notifications-in-batch","children":[]},{"id":"ci_17fdb94816b68783eea696c70c8853780b7a34daa1d122577aafdf7f39f6cf7e","title":"Modify Alarm Rules","path":"/lrsiem/7.17.0/modify-alarm-rules","children":[]},{"id":"ci_be0942d1faa216609f11616480c516335582362714ff007237c37b9f000d2a1b","title":"Retire or Activate Alarm Rules","path":"/lrsiem/7.17.0/retire-or-activate-alarm-rules","children":[]}]},{"id":"ci_845d6920ef444db2f262b2d1d4387d8e5356890f0645006973832820523a0ee0","title":"Automatic Host Contextualization","path":"/lrsiem/7.17.0/automatic-host-contextualization","children":[{"id":"ci_2153ec6c96680b21caec9b513fe601321a54d131898d3de30c4bdfdf052a7b71","title":"Disable Automatic Host Contextualization","path":"/lrsiem/7.17.0/disable-automatic-host-contextualization","children":[]},{"id":"ci_f0257a8df7614e60a76c25eb5f138e0033d2c685d38a27f4b23d83e2183b8597","title":"Map Ports","path":"/lrsiem/7.17.0/map-ports","children":[]}]},{"id":"ci_9e35c1f62f338e2578718fce0e20fcb142d615f87d8add009266b971ec25840f","title":"Data Archives and Restoration","path":"/lrsiem/7.17.0/data-archives-and-restoration","children":[{"id":"ci_97600e5b61da37769f697c200f11568bb0a76f7d2e4e1ad3491ef8940535ab82","title":"Add a Data Processor to Restore Archives","path":"/lrsiem/7.17.0/add-a-data-processor-to-restore-archives","children":[]},{"id":"ci_f47bafdab192e31f81dc5155255d024f9659265fe39fa8d4e3de21949a95283a","title":"Backup and Recovery Procedures","path":"/lrsiem/7.17.0/backup-and-recovery-procedures","children":[{"id":"ci_f176c65261ef2c88a9c8cab9cb0597302ea575b0d11a161dcdac8ec5395fc5a6","title":"Back Up LogRhythm Archives","path":"/lrsiem/7.17.0/back-up-logrhythm-archives","children":[]},{"id":"ci_c50473140e8caf6292ca2c9b7dd260dabc4a73cd155f84592dda6d0b58215809","title":"Configure Automated Platform Manager Database Backups","path":"/lrsiem/7.17.0/configure-automated-platform-manager-database-backups","children":[]},{"id":"ci_7c06f596cf8ada289af978ffed3829ad2954df0bcc9813caae30f047d8f7a5c9","title":"Perform a Manual Platform Manager Backup","path":"/lrsiem/7.17.0/perform-a-manual-platform-manager-backup","children":[]},{"id":"ci_c6e875e7952ee88ff0423115cad769cb71c74208f52dd7c7ef31941bbccb6de0","title":"Restore From a Database Backup","path":"/lrsiem/7.17.0/restore-from-a-database-backup","children":[]},{"id":"ci_997e12c63092c5b2a24aa5b0b75d396067cfa5ef12f43a52dc98f024a6e3d106","title":"Restore Service State","path":"/lrsiem/7.17.0/restore-service-state","children":[]},{"id":"ci_efc5a1a20a8d4eaa7cdeef9f5405150ab3f1a3dd475af870c4bab93fe839b4ab","title":"Use a Dark Spare Backup Appliance","path":"/lrsiem/7.17.0/use-a-dark-spare-backup-appliance","children":[]}]},{"id":"ci_b257df13dbd02dd2158d725495234b653310890f14aee4fa283ea63108b8d394","title":"Change Archive Location","path":"/lrsiem/7.17.0/change-archive-location","children":[]},{"id":"ci_b4872c0097cb9398a169aed57a8d29339a16b774564421cc1cb224e94e4417ef","title":"Configure Object Access Auditing for LogRhythm Archive Files","path":"/lrsiem/7.17.0/configure-object-access-auditing-for-logrhythm-archive-files","children":[]},{"id":"ci_8243b6c16cd35f09d2e8ed4cf3d4eb8e60ba30a5c4085616492d02eb2331ade4","title":"Restore Platform Managers","path":"/lrsiem/7.17.0/restore-platform-managers","children":[]},{"id":"ci_10acca949bf56c2171e5266179d691e4cfc5b57e6ed5fb4b60b75aa32d6ed6bb","title":"SecondLook","path":"/lrsiem/7.17.0/secondlook","children":[{"id":"ci_6a590ad83d291ac45fbcfaed2511fc9e8a67d92b4af8b016a19097bb25ff67d0","title":"Create a SecondLook Restore","path":"/lrsiem/7.17.0/create-a-secondlook-restore","children":[]},{"id":"ci_9f1ac1d6fb53dc7fbbb69004ecdc6cf96dd33dc1acd2dc03141f89ee1d18465c","title":"Run a Saved SecondLook Restore","path":"/lrsiem/7.17.0/run-a-saved-secondlook-restore","children":[]}]},{"id":"ci_1b5c5a258cf0e4569f75f765dd71c752a0eeb8723f62358b5a467c4ba5dacd6e","title":"Use Intelligent Indexing","path":"/lrsiem/7.17.0/use-intelligent-indexing","children":[]}]},{"id":"ci_7caf6ae20a2499458fe3c6ef497278086a30946e58b10582939e0476c565506b","title":"Data Indexer","path":"/lrsiem/7.17.0/data-indexer","children":[{"id":"ci_d9c36ef6aa441b89cae224bd056362e5a314e8e73a4cf8bb1efb54de92c6a46d","title":"Add a Data Indexer Node","path":"/lrsiem/7.17.0/add-a-data-indexer-node","children":[]},{"id":"ci_5006a4cee2e05d7a2cd421e96c79b8e0561dea1f9392ab2c61b6b67e37a504e0","title":"Apply System Updates to a Data Indexer","path":"/lrsiem/7.17.0/apply-system-updates-to-a-data-indexer","children":[]},{"id":"ci_4e02d452d04451aa89cce5cc32bddb2ed96d8e23efa1f45849b427382c2f0a6c","title":"Configure the Data Indexer","path":"/lrsiem/7.17.0/configure-the-data-indexer","children":[]}]},{"id":"ci_c7cc8e7afd48fea6ad8077c669b9132dfa2e848f789657862499a8c6e0e47237","title":"Data Processor","path":"/lrsiem/7.17.0/data-processor","children":[{"id":"ci_9e7bb054f091196388db8c3cf339f130d189808b5246890aeb191f6127ecd94d","title":"Add a Data Processor","path":"/lrsiem/7.17.0/add-a-data-processor","children":[]},{"id":"ci_bbbb6b16107b14799bef4c605fcd548478afea0c7a7ebade663df40da52023b5","title":"Apply Recommended Data Processor Values","path":"/lrsiem/7.17.0/apply-recommended-data-processor-values","children":[]},{"id":"ci_c736e989be75eb3d216c03e2c5627f62c71cc9a5ab9a8dc86ec2d706fb06ee0c","title":"Configure the Mediator for Automatic Startup","path":"/lrsiem/7.17.0/configure-the-mediator-for-automatic-startup","children":[]},{"id":"ci_bb6e3f10413ce6a302cb88bc4ea0e375ee8c52de212b2cfedb325ae8fd59996a","title":"Create a Custom Certificate for the Data Processor","path":"/lrsiem/7.17.0/create-a-custom-certificate-for-the-data-processor","children":[]},{"id":"ci_368d62635214adb918cf1016222ec027490956ffe8dd387263869f1c712cdbfa","title":"Entity Segregation","path":"/lrsiem/7.17.0/entity-segregation","children":[]},{"id":"ci_3c30e3a773afbf4b5051f54d62c9e9a84476929096af7a006ccf55fee170c32e","title":"Filter LogRhythm Diagnostic Events","path":"/lrsiem/7.17.0/filter-logrhythm-diagnostic-events","children":[]},{"id":"ci_1c6fff334890a0782a837ebde04916c9627fc1be9c153185742d6b53bb82f368","title":"Modify Data Processor Advanced Properties","path":"/lrsiem/7.17.0/modify-data-processor-advanced-properties","children":[]},{"id":"ci_1653d0abf84e5f8f12b86ec91717be926f13c4ea81248699640b1cca07b7da79","title":"Modify Data Processor Basic Properties","path":"/lrsiem/7.17.0/modify-data-processor-basic-properties","children":[]},{"id":"ci_2f6174b655b717ba03b6566b634433640e2e4f75191a2ed320c36e83ba9c0248","title":"Retire a Data Processor","path":"/lrsiem/7.17.0/retire-a-data-processor","children":[]},{"id":"ci_5c17e3466a201c07ce00d9267bb7fa456e12d63f5ed2c78d14730005f9cb01ef","title":"Revert to a Previous Data Processor Configuration","path":"/lrsiem/7.17.0/revert-to-a-previous-data-processor-configuration","children":[]},{"id":"ci_463318105315be48608bfe6a7ec755c3911a5c6fb52e6d361a3ef8d2da0b6279","title":"Set Data Processor Messages Per Second Value","path":"/lrsiem/7.17.0/set-data-processor-messages-per-second-value","children":[]},{"id":"ci_affa46798839086f4954e61114d90014410d1ba10786ebbc93815f0f7f7717ec","title":"Start, Stop, and Restart Data Processor Services","path":"/lrsiem/7.17.0/start-stop-and-restart-data-processor-services","children":[]},{"id":"ci_5983b32d255fd436b672d11e66ed7c09f790eea360c047508181e433280ec840","title":"Throttle the Mediator","path":"/lrsiem/7.17.0/throttle-the-mediator","children":[]},{"id":"ci_a2ef206ad66e5544b6319a50dab4b19e315d59ec6d9fe4ad52ff27f573c09caa","title":"Update the IP Address of a Data Processor","path":"/lrsiem/7.17.0/update-the-ip-address-of-a-data-processor","children":[]},{"id":"ci_377945a9db49559026c0cca6e5d4dc5fb3871295a6f14a89486ae566674fe2d7","title":"Use the Data Processor Configuration Manager","path":"/lrsiem/7.17.0/use-the-data-processor-configuration-manager","children":[]}]},{"id":"ci_7a82e9f91362976443b762b7857f395f653afb854fb557e7f1f45d93901556cd","title":"Deployment Health","path":"/lrsiem/7.17.0/deployment-health","children":[{"id":"ci_e63ba51911639d31d277cc6b1350ce1e32474eb40e00db7af3a06cd5fc3c8b71","title":"Centralized Service Metrics","path":"/lrsiem/7.17.0/centralized-service-metrics","children":[{"id":"ci_11c0f56cb907447fc40842a9edc9fcd430b3fa567c5088f87cd4dc4bb3b02a50","title":"Install and Work With Centralized Service Metrics","path":"/lrsiem/7.17.0/install-and-work-with-centralized-service-metrics","children":[]},{"id":"ci_ee07d698d8540bacdc25bf824a997be57bf6ef427aa054f8613637ee617c0fed","title":"Troubleshoot Centralized Service Metrics","path":"/lrsiem/7.17.0/troubleshoot-centralized-service-metrics","children":[]}]},{"id":"ci_1dc04e83284f8880c5071475ff072127fdaa942b4d199365d8adf49dd95fdaa9","title":"Deployment Monitor","path":"/lrsiem/7.17.0/deployment-monitor","children":[]},{"id":"ci_f726e1905db0e644aa2778b3c235f811d1b9e7ebc659d1e1d57c358c349e3f17","title":"Log Processing Reports","path":"/lrsiem/7.17.0/log-processing-reports","children":[{"id":"ci_1273803f5c2ae8cf9b730c0a31c230ee6ef9b3af8df8fb8814768e32131f4dbb","title":"LPS Detail Report","path":"/lrsiem/7.17.0/lps-detail-report","children":[]},{"id":"ci_f5f9a2c7b0b1b89b69f6030c51db0579612b85a80fe266e8bdae84448f2da944","title":"LPS Policy Sorting Stats Report","path":"/lrsiem/7.17.0/lps-policy-sorting-stats-report","children":[]}]},{"id":"ci_5fdee3e2f2d9008584514673d50713c114a84343ec82f65f927576d0c9f254ca","title":"Performance Counters","path":"/lrsiem/7.17.0/performance-counters","children":[{"id":"ci_79dd48a5860e9574c6dc473393bd0ba290a43bf941402645fb52e685df812764","title":"Performance Counters—LR AI Engine Communication Manager","path":"/lrsiem/7.17.0/performance-counterslr-ai-engine-communication-manager","children":[]},{"id":"ci_85bdbd9841bcd143e34ba94a37aefbb0813c4a8a61c0ca85acbd40d26a504c77","title":"Performance Counters—LR AI Engine Data Provider","path":"/lrsiem/7.17.0/performance-counterslr-ai-engine-data-provider","children":[]},{"id":"ci_adbe0643cd4551b2717fb3de610b4121c7373e71a7549f7283612d9694dd4d27","title":"Performance Counters—LR AI Engine Server","path":"/lrsiem/7.17.0/performance-counterslr-ai-engine-server","children":[]},{"id":"ci_d9ba25f7b2886877be6639664bf0ad869794a44328df6b765f8696b1a85b5c09","title":"Performance Counters—LR Alarming and Response Manager","path":"/lrsiem/7.17.0/performance-counterslr-alarming-and-response-manager","children":[]},{"id":"ci_3598a4ae67a13236244e0295a3e83db3bbf6e49635375463c69f81298abddd3c","title":"Performance Counters—LR Mediator, Log Distribution Services","path":"/lrsiem/7.17.0/performance-counterslr-mediator-log-distribution-services","children":[]},{"id":"ci_6c3a45044a0bf1a2f173aee3a46d46952b598b0700a6809850016a5dc597a238","title":"Performance Counters—LR Mediator, LDS, Sender","path":"/lrsiem/7.17.0/performance-counterslr-mediator-lds-sender","children":[]},{"id":"ci_5b96843a3d9e6bb64bfa8cb83721f09e15b2e51e5e7ee3b94758430e70b61ba1","title":"Performance Counters—LR Mediator, LogMart","path":"/lrsiem/7.17.0/performance-counterslr-mediator-logmart","children":[]},{"id":"ci_8d1cb165357c6612701f23b09a95cff195b80ae65a6d319e67a000019c9b0502","title":"Performance Counters—LR Mediator, Processing","path":"/lrsiem/7.17.0/performance-counterslr-mediator-processing","children":[]},{"id":"ci_dac629d5c807d28d872054ed47ec61f735ed7fe234e3f99d2b38bca8b59d5b92","title":"Performance Counters—LR Mediator, Stats","path":"/lrsiem/7.17.0/performance-counterslr-mediator-stats","children":[]},{"id":"ci_e4cede1887bcd1e52f4f0c79f68e0995aea481b7df564afc115b37697ea46b90","title":"Performance Counters—LR Mediator, True Source","path":"/lrsiem/7.17.0/performance-counterslr-mediator-true-source","children":[]},{"id":"ci_734a4e0ed2dbddabec3dd6013990a23f3c600c4aad468f2182a972d352e6ad3a","title":"Performance Counters—LR Messaging (DP to DX)","path":"/lrsiem/7.17.0/performance-counterslr-messaging-dp-to-dx","children":[]},{"id":"ci_1dee4a2b73bf1247551a18db80ac34aa25805d21cf11c00882004d1ecc990e98","title":"Performance Counters—LR System Monitor","path":"/lrsiem/7.17.0/performance-counterslr-system-monitor","children":[]},{"id":"ci_ea0a1165dd0794d3682775384047a054d34a8fd71d6e48ea8629fb003a1c7df3","title":"View and Add Performance Counters","path":"/lrsiem/7.17.0/view-and-add-performance-counters","children":[]}]}]},{"id":"ci_764d2ccc18e130808ff70000a15ae2413980379417068722eb1343cd39eb5e8e","title":"Deployment Manager","path":"/lrsiem/7.17.0/deployment-manager","children":[]},{"id":"ci_5153a1c2701d363de661ed56f283d7f8fbfe39270880b4cf3c346898afbf2657","title":"Deployment Security","path":"/lrsiem/7.17.0/deployment-security","children":[{"id":"ci_dd6434a2af7a8b1d14daf90ac9fc9c59d55dccedacce5b6abc601ef07cc14421","title":"Common Criteria Audit Data Generation","path":"/lrsiem/7.17.0/common-criteria-audit-data-generation","children":[{"id":"ci_9a123560acb0641bda22f649000c3e838c1f1ebf8130aacc9c7ec5d4188fc62c","title":"Set Up the Audit Functionality","path":"/lrsiem/7.17.0/set-up-the-audit-functionality","children":[]},{"id":"ci_6c5b1a70cc4bc2fe266c3e8ec5f96fe7f0447f285be7a1d18b3d14e7976783c3","title":"Set up Discretionary Access Controls on the Trace Folder on an NTFS File System","path":"/lrsiem/7.17.0/set-up-discretionary-access-controls-on-the-trace-folder-on-an-ntfs-file-system","children":[]},{"id":"ci_853d62762b49188dc69c3f9c9c7e9a2d35f7e9e551d77250f1f8a78bb8ccb52c","title":"Configure Windows Task to Alarm on Audit Trace Failure","path":"/lrsiem/7.17.0/configure-windows-task-to-alarm-on-audit-trace-failure","children":[]},{"id":"ci_df7815d5738a5151f17b26ecb848850ce0c88e65c9ec0ea4ba361aa1ee16edeb","title":"Configure SQL Server to Run Under Domain Account","path":"/lrsiem/7.17.0/configure-sql-server-to-run-under-domain-account","children":[]},{"id":"ci_d1a23fb5b7ed705acff4bd676e4ccdc218bfc358a8e930673da298b778a68995","title":"SQL Server Trace File Converter (TFC) User Guide","path":"/lrsiem/7.17.0/sql-server-trace-file-converter-tfc-user-guide","children":[{"id":"ci_4ba402800bef002e39ce58204c71ae8d7bb5276a3fbb09d581f5c55bffefebf1","title":"Download the SQL TFC Installer","path":"/lrsiem/7.17.0/download-the-sql-tfc-installer","children":[]},{"id":"ci_7e8a23adba22afbb46c1164fe8229f8da99d09774fab0e36adbb74117749c9a5","title":"Install the SQL Server TFC Server","path":"/lrsiem/7.17.0/install-the-sql-server-tfc-server","children":[]},{"id":"ci_5277c188ced3763367b76d110575bb49ff951a705ca4260bdf3e1288f1df280e","title":"Configure SQL Server TFC","path":"/lrsiem/7.17.0/configure-sql-server-tfc","children":[]},{"id":"ci_d841e3bb90e32edcf85a23ffa8e2d12eb0fc04bbbd19ad1f38b1b78f2248e19b","title":"Add a SQL Server TFC Log Source","path":"/lrsiem/7.17.0/add-a-sql-server-tfc-log-source","children":[]}]}]},{"id":"ci_e3d91c1bbcd066acd5812182c876607062643096f367790c5ed70bcc6657a0cf","title":"Common Criteria","path":"/lrsiem/7.17.0/common-criteria","children":[{"id":"ci_ba32fb162311157a4cbfcba80bd101f0de99ab93dbd48233e1916ab4223a7381","title":"Web Console Compliance","path":"/lrsiem/7.17.0/web-console-compliance","children":[{"id":"ci_558b981a0a7bcea8faa956e8f0e9c14788f243e2d15e6dc1702d11e5a59614e0","title":"Auto Logout for Idle Users (US9521)","path":"/lrsiem/7.17.0/auto-logout-for-idle-users-us9521","children":[]},{"id":"ci_e54a5605847e67a05622d3118182eb0a845ab6c253d8d1e067feb5e511430efd","title":"Nginx File Configuration Updates (US9305)","path":"/lrsiem/7.17.0/nginx-file-configuration-updates-us9305","children":[]},{"id":"ci_8acfc4f647d08855da0923274f34785bce2df0fdac7b22d32b822b3de1dd5901","title":"Requirements","path":"/lrsiem/7.17.0/requirements","children":[]},{"id":"ci_377ded5452fa80e900fd1fe4e8536e808a9510f1a50b34270596eed03109c834","title":"Warning Banner on Login Page (US9518)","path":"/lrsiem/7.17.0/warning-banner-on-login-page-us9518","children":[]},{"id":"ci_f87a50db40a5422a2e2eeacc892079618afe52b00e688078952f8dee82527dba","title":"Web Console FIPS Compliance Configuration (US9525)","path":"/lrsiem/7.17.0/web-console-fips-compliance-configuration-us9525","children":[]},{"id":"ci_ba0e28261f7af96672db9e9a2a577750fade06d6eb58351a4778b299df9b976f","title":"Web Console Logout Button (US9519)","path":"/lrsiem/7.17.0/web-console-logout-button-us9519","children":[]}]}]},{"id":"ci_942df00a522a5bd49e821307ef16a1f63951ee313922c52f16e3487751203240","title":"Federal Information Processing Standards (FIPS)","path":"/lrsiem/7.17.0/federal-information-processing-standards-fips","children":[{"id":"ci_58cbe07036711088bbba179b9cced3c3ae9f8458857f8797400c343fde222531","title":"Configure User Access Control for FIPS Mode","path":"/lrsiem/7.17.0/configure-user-access-control-for-fips-mode","children":[]},{"id":"ci_6d39da9252f3d1f12dc79fa2cbd165e06faba6e815ef6ab296d20c081c8d13e4","title":"Configure LogRhythm XM for FIPS Mode","path":"/lrsiem/7.17.0/configure-logrhythm-xm-for-fips-mode","children":[]},{"id":"ci_34a854678bd69af7796db18b134a9f1bd62690949b1027ddeef3513d283051f1","title":"Configure LogRhythm DPAWC + DX for FIPS Mode","path":"/lrsiem/7.17.0/configure-logrhythm-dpawc-dx-for-fips-mode","children":[{"id":"ci_8884974a81c44bac80e0564fa9b8d1ea1853bc6356b8c0a8ed22d7b49a65c72d","title":"Configure LogRhythm DPAWC","path":"/lrsiem/7.17.0/configure-logrhythm-dpawc","children":[]},{"id":"ci_3c0eb59a98ea8e8436574eec43747c8f86c4c5921dbe6aa4c3fd8e24de272f9c","title":"Configure LogRhythm DX","path":"/lrsiem/7.17.0/configure-logrhythm-dx","children":[]}]},{"id":"ci_896909850843aae4498b94ef26b1691b98a731dd74ae9dc1bb2270892fdf7a13","title":"Force Encrypted Connections for SQL (Recommended)","path":"/lrsiem/7.17.0/force-encrypted-connections-for-sql-recommended","children":[]},{"id":"ci_31b391fef39067aec940fabdf5f64459cd1a676cca12face844d3f3e610f84af","title":"Deploy LogRhythm in a FIPS-Enabled Domain","path":"/lrsiem/7.17.0/deploy-logrhythm-in-a-fips-enabled-domain","children":[]},{"id":"ci_3f1539c7a021905545087213edbe5a7572e23db3c60a7b01d399f1be38121533","title":"Put Windows into FIPS Mode","path":"/lrsiem/7.17.0/put-windows-into-fips-mode","children":[]},{"id":"ci_18314ce5714a54cfa10e42e76e7d7f94f389c48249a161b37bf4ca794bea410e","title":"Configure LogRhythm Services and the Data Indexer for FIPS Mode","path":"/lrsiem/7.17.0/configure-logrhythm-services-and-the-data-indexer-for-fips-mode","children":[]},{"id":"ci_3d4245cbfa0bfc0e43c4f6388e67c9e79cbcf2ff29c88cb5ede5dca17c6166b0","title":"Establishing IPsec Communications between Windows & Linux OS","path":"/lrsiem/7.17.0/establishing-ipsec-communications-between-windows-linux-os","children":[{"id":"ci_d4a39feec99ebd700806a51109d3aa04e5b015f23d2ac7ecef0e1036655cad2a","title":"Windows OS IPsec Configuration","path":"/lrsiem/7.17.0/windows-os-ipsec-configuration","children":[{"id":"ci_df41b5c87018275fafbd927f9cd7ab858af68eade99da1d7ae5df28f914d9b6d","title":"Create a Custom MMC Console","path":"/lrsiem/7.17.0/create-a-custom-mmc-console","children":[]},{"id":"ci_99257a7642871523d43fcf39f1a23c403ed81a5d85438a744a35d27a7344fa3e","title":"Enable Audit Policy for Your Computer","path":"/lrsiem/7.17.0/enable-audit-policy-for-your-computer","children":[]},{"id":"ci_7a0aba843240e8641e21b2959caea242846dc26266a24c9e02679815d7b2e0ec","title":"Build a Custom IPsec Policy","path":"/lrsiem/7.17.0/build-a-custom-ipsec-policy","children":[]},{"id":"ci_488f3a7fce3a3ac71aa481498c48bf31a5563201b8cdde0c34b39c42ce76fc9a","title":"Configure an IPsec Filter List","path":"/lrsiem/7.17.0/configure-an-ipsec-filter-list","children":[]},{"id":"ci_6452cc3b450dfe4947f4e5091585e3e2697613f312f1ffbda7a404e7711b2ce2","title":"Configure an IKE Authentication Method","path":"/lrsiem/7.17.0/configure-an-ike-authentication-method","children":[]}]},{"id":"ci_accaeb25043ebad2af12834cfe976ef22338337be22ab273c6fa27f9cc6cdc00","title":"Linux/CentOS IPsec Configuration","path":"/lrsiem/7.17.0/linux-centos-ipsec-configuration","children":[{"id":"ci_86c06076ffab1b160ccba20d5e2ea9c17e9d5ace72529bc8cb2a5b1f97c6c57f","title":"Configure IPsec on Linux Machine","path":"/lrsiem/7.17.0/configure-ipsec-on-linux-machine","children":[]},{"id":"ci_987d7081806214833705b0fa2b43e28382004d04a9acc8c8cd6cb95e68aa6cf8","title":"Put Linux/CentOS into FIPS Mode","path":"/lrsiem/7.17.0/put-linux-centos-into-fips-mode","children":[]}]},{"id":"ci_6fa3cd84147dc7e5021291e4e9327088ba32148fe05cbe4caf2fd16a238e667e","title":"Test Your Custom IPsec Policy on both Computers","path":"/lrsiem/7.17.0/test-your-custom-ipsec-policy-on-both-computers","children":[]}]}]},{"id":"ci_574fdcf39aa6659ddd9e45ff274485204aceb926bcac85a30c300b6ddbba8482","title":"Integrated Security","path":"/lrsiem/7.17.0/integrated-security","children":[{"id":"ci_75be006a98ed6c5ff4af00962d90759837d2aaab89e648fed74ac1890162e391","title":"Create Accounts for LogRhythm Components","path":"/lrsiem/7.17.0/create-accounts-for-logrhythm-components","children":[]},{"id":"ci_ec4915666369333027e91e17493ef67c5bf596f9ada2c476b5caedeb069ed6cd","title":"Configure Database Access","path":"/lrsiem/7.17.0/configure-database-access","children":[]},{"id":"ci_fb70d4b46aa376993730f2a659f6c6020477c98259ba44796bb8756a07d6bb37","title":"Shut Down LogRhythm Services","path":"/lrsiem/7.17.0/shut-down-logrhythm-services","children":[]},{"id":"ci_58f19f30936480531648f3da15e09c16f25e361af1e019958532ccda0c3ef91b","title":"Reconfigure LogRhythm Services to Use Integrated Security","path":"/lrsiem/7.17.0/reconfigure-logrhythm-services-to-use-integrated-security","children":[]},{"id":"ci_21d99de4acfde34781d6af7ee5d07cbbe2de74bf493a7afaaff986a95b2e6f81","title":"Enable Mixed Authentication Mode","path":"/lrsiem/7.17.0/enable-mixed-authentication-mode","children":[]},{"id":"ci_79084cfebb9f23ba61298a8cdce04d42f52ca6b3df7f474a6dbe35de82ecca7a","title":"Restart LogRhythm Services","path":"/lrsiem/7.17.0/restart-logrhythm-services","children":[]}]},{"id":"ci_61f0fd7ac06e197437f0dd6f66657551ac9cc186317c2891bb2aa92e02f81fa3","title":"Least Privileged User","path":"/lrsiem/7.17.0/least-privileged-user","children":[{"id":"ci_324b91374e6a2356a46a4b32ded63f5d88ae657430e17273c781bbcdc67c3805","title":"Configuring LogRhythm Permissions","path":"/lrsiem/7.17.0/configuring-logrhythm-permissions","children":[]},{"id":"ci_57d86c6e039110ddb4b328b3156d8af64b3ec62c22c0e788b218e4151a215b88","title":"Least Privileged User: DP, Mediator Server","path":"/lrsiem/7.17.0/least-privileged-user-dp-mediator-server","children":[]},{"id":"ci_7cef781191de79dfbd936b362fb58ea0afadd83681dbe5f164d64a7c1600f8a1","title":"Least Privileged User: DX, Linux","path":"/lrsiem/7.17.0/least-privileged-user-dx-linux","children":[]},{"id":"ci_3ca6d4d6b24144704d5313fed72f94aa15ddf3a0be66f1531b527f0748042b34","title":"Least Privileged User: DX, Windows","path":"/lrsiem/7.17.0/least-privileged-user-dx-windows","children":[]},{"id":"ci_3bce364cee4ef090c59838192e937d03689da91cd70905027fc61c99787ef1df","title":"Least Privileged User: PM, Advanced Intelligence Engine","path":"/lrsiem/7.17.0/least-privileged-user-pm-advanced-intelligence-engine","children":[]},{"id":"ci_1c7f97e848c47c0d03c6922d32a0791b6df091c612e983124dea133cd524631c","title":"Least Privileged User: PM, AIE Communication Manager","path":"/lrsiem/7.17.0/least-privileged-user-pm-aie-communication-manager","children":[]},{"id":"ci_31c9b3aecb9a0745881858096689da07f0669d2c7031ad961d525fda3902b43a","title":"Least Privileged User: PM, Alarming and Response Manager","path":"/lrsiem/7.17.0/least-privileged-user-pm-alarming-and-response-manager","children":[]},{"id":"ci_c263e21c139a4429bbc2d9a791724e6908feec55cea4c9204e986aeb2b3e6697","title":"Least Privileged User: PM, Disaster Recovery","path":"/lrsiem/7.17.0/least-privileged-user-pm-disaster-recovery","children":[]},{"id":"ci_290576e1b376d644ccf488727167ded4c1154d02f53bc6565e4174579126fb41","title":"Least Privileged User: PM, High Availability","path":"/lrsiem/7.17.0/least-privileged-user-pm-high-availability","children":[]},{"id":"ci_e47d44c67cf81c8f99062a4af0be3d1f189398946d7c9515323147fc8d08eaf8","title":"Least Privileged User: PM, Job Manager","path":"/lrsiem/7.17.0/least-privileged-user-pm-job-manager","children":[]},{"id":"ci_6ebf1970a19d12ec4469a670be12595d0ba0ad4cff6a87ae03042710ae70b2c8","title":"Least Privileged User: PM, Web Console","path":"/lrsiem/7.17.0/least-privileged-user-pm-web-console","children":[]},{"id":"ci_043e821bf232c7784e525ec93b8ddb6102b004a84774247dcd3d4a218eb4cd1d","title":"Least Privileged User: SysMon, Linux, Unix","path":"/lrsiem/7.17.0/least-privileged-user-sysmon-linux-unix","children":[]},{"id":"ci_20de1ca7e63a9325de01b60fe64f763413baf67719c7328ab1f0c34ba24f0fa3","title":"Least Privileged User: SysMon, Windows","path":"/lrsiem/7.17.0/least-privileged-user-sysmon-windows","children":[]}]},{"id":"ci_6d2e8ab28c33e0bc791d6697c801072e5c2bc6c792410d9bc0385c6c92984733","title":"Public Key Infrastructure (PKI) Support","path":"/lrsiem/7.17.0/public-key-infrastructure-pki-support","children":[{"id":"ci_c926570dd71a2cad063bc939a4f14bb19c9b5808440a45b34d09a9b9aa2c8a86","title":"Certificate Configuration for LogRhythm Component Connections","path":"/lrsiem/7.17.0/certificate-configuration-for-logrhythm-component-connections","children":[]},{"id":"ci_c7e1cdbb13ff6f352adb8519192c04ee132a47501a2d2d0362b97c898f6e6437","title":"Create a Certificate for Microsoft SQL Server Connections","path":"/lrsiem/7.17.0/create-a-certificate-for-microsoft-sql-server-connections","children":[]},{"id":"ci_fdeebe7d671f5a651b9dccc02e35da391c6404ae5996a9ab6eaa76936243a287","title":"Create Client and Server Certificates","path":"/lrsiem/7.17.0/create-client-and-server-certificates","children":[]},{"id":"ci_305d721a5ba2fafb2eecff6adf0f2cd8b8b51e0a89a30e4e34c0050b8eeaeebe","title":"Verify Certificates","path":"/lrsiem/7.17.0/verify-certificates","children":[]},{"id":"ci_475206009b13ee4dece199e68823b9278cc23cac30154b9684e135827a376d53","title":"View an Example of Configuring Mutual Authentication in LogRhythm","path":"/lrsiem/7.17.0/view-an-example-of-configuring-mutual-authentication-in-logrhythm","children":[]},{"id":"ci_0e23de1800768da05b63dfe58462fbc2971f94d098f02d040c4c447f8dc994f2","title":"View an Example of Configuring Certificates for AI Engine","path":"/lrsiem/7.17.0/view-an-example-of-configuring-certificates-for-ai-engine","children":[]}]},{"id":"ci_86ece2bf19ddd193efbac4db9e74ba6588f9cf3a3a6646147a70e177510b4d48","title":"Security Banners","path":"/lrsiem/7.17.0/security-banners","children":[{"id":"ci_a5feae3dbb64c51559dded03a025069fb6681eecb294052a1dc57b6c5b2b2e61","title":"Configure the Session-Timeout Error Message","path":"/lrsiem/7.17.0/configure-the-session-timeout-error-message","children":[]},{"id":"ci_6e316f4800b0df97f73a89f8464c057c15dfa78595993f5e68174a76ebd9e4ca","title":"Configure the Start-Up Warning","path":"/lrsiem/7.17.0/configure-the-start-up-warning","children":[]}]},{"id":"ci_fa3ded2ad2b372b2b11802d6201a85be025c0473c85899fe347d44c13e240d21","title":"LogRhythm Default Passwords","path":"/lrsiem/7.17.0/logrhythm-default-passwords","children":[]},{"id":"ci_2f907034cb0385664c6f10df81972ee575e10f2ef4e8b786731fe210a596df8e","title":"Enhanced Auditing","path":"/lrsiem/7.17.0/enhanced-auditing","children":[{"id":"ci_442fe94566df450336fa7f8d02c97b2035deec63415dcc88a096eee95928a706","title":"Collect Enhanced Audit Logs","path":"/lrsiem/7.17.0/collect-enhanced-audit-logs","children":[]}]},{"id":"ci_6b20ceb93a03c9857d535e8a5e5e606579ba0a7e0df90e178b4eb19fcc8db297","title":"Query Auditing","path":"/lrsiem/7.17.0/query-auditing","children":[]}]},{"id":"ci_cd9690ff37d4923d87137876c90371c5b571cd57bfd1d38f1ba68a583c12e1dd","title":"Endpoint Monitoring","path":"/lrsiem/7.17.0/endpoint-monitoring","children":[{"id":"ci_8487e943787d05901cf75886450e7792e3efa36bda163cb2c8f9a2175bd80836","title":"Data Loss Defender (DLD)","path":"/lrsiem/7.17.0/data-loss-defender-dld","children":[{"id":"ci_dcd0fd82816a2b8491f92a7121bc1eccba83c423bbeb782ce09560b7a018b918","title":"Create DLD Policies","path":"/lrsiem/7.17.0/create-dld-policies","children":[]},{"id":"ci_f5cbbc7036b11e4db5347574ff9262d1124d03a0ee0df925ac1d50f6f96a23dd","title":"Delete DLD Policies","path":"/lrsiem/7.17.0/delete-dld-policies","children":[]},{"id":"ci_68373429c30823e72d57e827bb2acb27d880af05453d7ae7efaff9a9e2af3e16","title":"Enable DLD for an Agent","path":"/lrsiem/7.17.0/enable-dld-for-an-agent","children":[]},{"id":"ci_98b53397fc313c5f45eec0926e13683773d36cfff5fb4f08711c7f1dfb187701","title":"Modify DLD Policies","path":"/lrsiem/7.17.0/modify-dld-policies","children":[]}]},{"id":"ci_1139aeec87dc7e88e502f2e82e84783518957f54375cfa5dd175df51e5ae4e31","title":"File Integrity Monitor (FIM)","path":"/lrsiem/7.17.0/file-integrity-monitor-fim","children":[{"id":"ci_08bd36a167b8497e4232b086333e97049a1911728e857ac504ee265e2d2b0d9d","title":"Create File Integrity Monitor Policies","path":"/lrsiem/7.17.0/create-file-integrity-monitor-policies","children":[]},{"id":"ci_81684e3d7388c2640460ef0e4d160e72fa5bb9ca9b08db31d60563f6b2c323d3","title":"Create Inclusions and Exclusions for FIM","path":"/lrsiem/7.17.0/create-inclusions-and-exclusions-for-fim","children":[]},{"id":"ci_8edab578d046987a3be4b1ceed89d14140cb137bda04ab5f69810aab529f6ba7","title":"Associate a File Integrity Monitor Policy With an Agent","path":"/lrsiem/7.17.0/associate-a-file-integrity-monitor-policy-with-an-agent","children":[]},{"id":"ci_e3e3780f90328cbcec89db030984ba796749ee92954d6ff3c6dab69810ceeec4","title":"Modify File Integrity Monitor Policies","path":"/lrsiem/7.17.0/modify-file-integrity-monitor-policies","children":[]},{"id":"ci_2db73d38dfcded80cf0ab79b22b6b12f10ccfb08801efb9acba49c916ff5bd61","title":"Clone File Integrity Monitor Policies","path":"/lrsiem/7.17.0/clone-file-integrity-monitor-policies","children":[]},{"id":"ci_9d5036ff176d80aad83339d8f4513490158b5870808d41ca0e16c0f89573c6af","title":"Delete File Integrity Monitor Policies","path":"/lrsiem/7.17.0/delete-file-integrity-monitor-policies","children":[]}]},{"id":"ci_0682e564758b334891207da320fc4137547c7c4326bfed158fd51f1ebdf3757d","title":"Network Connection Monitor (NCM)","path":"/lrsiem/7.17.0/network-connection-monitor-ncm","children":[{"id":"ci_b9448db894243e0a16b109bb69f3bad7f6b236007ddf8d2a76bbc6dabbfbef09","title":"Enable NCM for an Agent","path":"/lrsiem/7.17.0/enable-ncm-for-an-agent","children":[]}]},{"id":"ci_1b8c2c791f6df6968a7a63ff2bf60749492ecbf361d3875eaa17039fe1e46653","title":"Process Monitor","path":"/lrsiem/7.17.0/process-monitor","children":[{"id":"ci_d543efb9c8736832d4ca7b36986c30294a895abb716aae8d792651ef702f0201","title":"Enable Process Monitor for an Agent","path":"/lrsiem/7.17.0/enable-process-monitor-for-an-agent","children":[]}]},{"id":"ci_52da20390b0db4e5142a6ea23d8a84b6ef72c50d79843ca465bddd162531edcf","title":"Registry Integrity Monitor (RIM)","path":"/lrsiem/7.17.0/registry-integrity-monitor-rim","children":[{"id":"ci_8477035809b057bcbd33c1688215c344e42d9c94eed3d8abe27b926d976ee6a1","title":"Associate Items to RIM Policies","path":"/lrsiem/7.17.0/associate-items-to-rim-policies","children":[]},{"id":"ci_f5d650d14677d72055bfe0d47bb5bbd007a12ce361d38cd67ad99dfb59c281c0","title":"Associate RIM Policies to Windows System Monitor Agents","path":"/lrsiem/7.17.0/associate-rim-policies-to-windows-system-monitor-agents","children":[]},{"id":"ci_e07e4762b19f7e1d1d5cd66ce6ac4f7d48f224639e51aa74383a5013252f3939","title":"Configure RIM Policy Items","path":"/lrsiem/7.17.0/configure-rim-policy-items","children":[]},{"id":"ci_abe3c2cabdb106cc908cbea30cf151c7d52d6a1d6ce008e2c68755df607e1c6d","title":"Create RIM Policies","path":"/lrsiem/7.17.0/create-rim-policies","children":[]},{"id":"ci_a47eebe8a1c64c9fd1b0dc52d0967ad80900431b219e5b7fd7fa8c26feccfc64","title":"Delete RIM Policies","path":"/lrsiem/7.17.0/delete-rim-policies","children":[]},{"id":"ci_84500a029c3318c2cfec641edfe371e518d5e824ecf95eeecd8fa99288a690b6","title":"Delete RIM Policy Items","path":"/lrsiem/7.17.0/delete-rim-policy-items","children":[]},{"id":"ci_a52d10d5c626f83480a52ab8baf6160c10e16c94b3b6c508aa9f8221f4a09589","title":"Modify RIM Policies","path":"/lrsiem/7.17.0/modify-rim-policies","children":[]},{"id":"ci_3db532562d61a8a3d93a43ca691d23b8d9993e361b04156b2a20059780db2103","title":"Modify RIM Policy Items","path":"/lrsiem/7.17.0/modify-rim-policy-items","children":[]}]},{"id":"ci_33447490c8f45c621f1868c743309ca5809399ce41fb18e0e94684c4c7d7007f","title":"User Activity Monitor (UAM)","path":"/lrsiem/7.17.0/user-activity-monitor-uam","children":[{"id":"ci_9bf77390159d27fb760b3c6fe249d975c3021a770494733630c1d0ff3221b367","title":"Enable UAM for an Agent","path":"/lrsiem/7.17.0/enable-uam-for-an-agent","children":[]},{"id":"ci_23de8d51230d1285918c3c6378c64fc586e36a96466f35d9a3d1df6e8325917c","title":"Include UAM in File Integrity Monitor","path":"/lrsiem/7.17.0/include-uam-in-file-integrity-monitor","children":[]}]}]},{"id":"ci_54eb0a28050df515e72d4e996fe34fb9091e71fac16f95570957c790fb5f19e5","title":"Entities","path":"/lrsiem/7.17.0/entities","children":[{"id":"ci_7d17a545c4054d1fe2f4e6d8893379aabac403112db020087bdb49cb4f195c69","title":"Add a Single Entity","path":"/lrsiem/7.17.0/add-a-single-entity","children":[]},{"id":"ci_6faed8ef8be531b89e1510ae870776a8c0297466ce8506dea7eb7e48c2b128c0","title":"Bulk Import Entities From a File","path":"/lrsiem/7.17.0/bulk-import-entities-from-a-file","children":[]},{"id":"ci_a6d16d79f2bbb3a5a2ba67bca5a68414ec64d217c337a912b83fa5a329d4b0f5","title":"Delete Entities","path":"/lrsiem/7.17.0/delete-entities","children":[]},{"id":"ci_156de71f192f4a95775cd2353fa25c060a4bdfeb145c58e4e9c9a28972f43f80","title":"Modify Entities","path":"/lrsiem/7.17.0/modify-entities","children":[]},{"id":"ci_040ffdc6745ff43da6598354d82305346c410e4739058b15f5491130a7333ec4","title":"Run the Entities Reorganization Wizard","path":"/lrsiem/7.17.0/run-the-entities-reorganization-wizard","children":[]}]},{"id":"ci_9fbe7bf97198625cf7c96699b9237b242650f7d95af8a39ebc2baef3edd340d9","title":"Global Log Processing Rules","path":"/lrsiem/7.17.0/global-log-processing-rules","children":[{"id":"ci_882d49d3a956f50bb535af2151da4453500ec392dbd9ba8f04d1651fa239de17","title":"Create Global Log Processing Rules","path":"/lrsiem/7.17.0/create-global-log-processing-rules","children":[]},{"id":"ci_07717a750af5d194e6cf2e95c68ffb306af5d7a1b00502e9690314bffbe4175b","title":"Modify Global Log Processing Rules","path":"/lrsiem/7.17.0/modify-global-log-processing-rules","children":[]}]},{"id":"ci_194a1f8883a688e174046c2657d2a9af876818a98bcc74b1c37238d5fa22fa5f","title":"Host Records","path":"/lrsiem/7.17.0/host-records","children":[{"id":"ci_d298b91c05c3b1059c863e67d2e335d7bfdf93480bf4acb668bddad5c92606a0","title":"Add Host Records Manually","path":"/lrsiem/7.17.0/add-host-records-manually","children":[]},{"id":"ci_a1b35bbd24567464e4499f0dca7c76a9ac22ce4a862d859dd45ade89d36f08c6","title":"Add Hosts From Clipboard","path":"/lrsiem/7.17.0/add-hosts-from-clipboard","children":[]},{"id":"ci_81296826dd96fbf41786366e7d8938942e5cf8fcee78fac2813d5bf581a9dab3","title":"Add Hosts From File","path":"/lrsiem/7.17.0/add-hosts-from-file","children":[]},{"id":"ci_18a5cc5bb9ecae6fd7099a59b7b9008b0f97d3221a36d78c4e3b5b4a2b4b24aa","title":"Add Origin Hosts or Impacted Hosts as Known Hosts","path":"/lrsiem/7.17.0/add-origin-hosts-or-impacted-hosts-as-known-hosts","children":[]},{"id":"ci_a7ffd914c376e5790259b217c0d66d3c4ac59346b4953e1e30e567727b09f0ba","title":"Add or Remove Multiple Host Roles","path":"/lrsiem/7.17.0/add-or-remove-multiple-host-roles","children":[]},{"id":"ci_2e48f8f32f61c8b248f3640c01f61b9f3a2dbf40942e4d7af2c4b84ce799fb15","title":"Export Multiple Host Roles to File","path":"/lrsiem/7.17.0/export-multiple-host-roles-to-file","children":[]},{"id":"ci_7efaa1e9b69ede7b6b35c3295db2d264c1ccd3b7c2321896597d41be6735507f","title":"Modify Properties for a Single Host Record","path":"/lrsiem/7.17.0/modify-properties-for-a-single-host-record","children":[]},{"id":"ci_5f925f7b7a42724cb3d25e0af13062eae22a00f80f216d3720ad9e6d45328c9f","title":"Modify Properties for Multiple Host Records","path":"/lrsiem/7.17.0/modify-properties-for-multiple-host-records","children":[]},{"id":"ci_6a6575c4d4a2c1ffa6a0632bbfac005e34ab4a53fbe1e7b54dd7b9e55c450aed","title":"Resolve Known Hosts","path":"/lrsiem/7.17.0/resolve-known-hosts","children":[]},{"id":"ci_93b48ffd9760bfe9ed28f1817ef61a7fc4e6df02688eb511e610eb8921426eb6","title":"Retire Host Records","path":"/lrsiem/7.17.0/retire-host-records","children":[]},{"id":"ci_090a75d1b481271aa0f42de5e5b005bc1a8a3cd38e9667c7a882ab2e008b7539","title":"Search for Hosts","path":"/lrsiem/7.17.0/search-for-hosts","children":[]},{"id":"ci_a541b344a60f12fdb2f115e48de67ac5e57866c064c99b08a00275e1941a4f9c","title":"Windows Host Wizard","path":"/lrsiem/7.17.0/windows-host-wizard","children":[{"id":"ci_e3a9ec2c5e6efacf209157cfa55fe3bad628f29d734fca2897c3d42775ccfc74","title":"Configure Initial Host Settings in Windows Host Wizard","path":"/lrsiem/7.17.0/configure-initial-host-settings-in-windows-host-wizard","children":[]},{"id":"ci_4f4f7976065ce2ccec29b342b37840c240de5c1c2347971414133c432f70a13d","title":"Import Computers for Log Collection","path":"/lrsiem/7.17.0/import-computers-for-log-collection","children":[]},{"id":"ci_d8047fb2f261a78bfffe2450ee147c7b5c73736040b4a3e4adee6ecbdeae17dd","title":"Perform Optional Configuration for Remote Log Collection","path":"/lrsiem/7.17.0/perform-optional-configuration-for-remote-log-collection","children":[]},{"id":"ci_338740b4060f311d8b5803ca32acb47b0e184ea09e5aa6a31d75ddcfb3cc274c","title":"Query Computers with Windows Host Wizard","path":"/lrsiem/7.17.0/query-computers-with-windows-host-wizard","children":[]},{"id":"ci_c694bd0a7ec71b030076ebfa660cf2caf21c6cd38bc6ee882d723e025c790364","title":"Review Computers with Windows Host Wizard","path":"/lrsiem/7.17.0/review-computers-with-windows-host-wizard","children":[]},{"id":"ci_4bc995487ff79372b0db4097a9e37e1467e7af983f73682563250502661c7cad","title":"Scan a Domain for Computers","path":"/lrsiem/7.17.0/scan-a-domain-for-computers","children":[]},{"id":"ci_68cde078051454f05112e2925b95b89e42166b2d1cba5b4a0914c093eab8b84d","title":"Work with Hosts and Agents in Windows Host Wizard","path":"/lrsiem/7.17.0/work-with-hosts-and-agents-in-windows-host-wizard","children":[]}]}]},{"id":"ci_0462dd28ab493be44881dfa4771e123d2c21b15ff6a8ce3375ad68738ab8cd40","title":"Knowledge Base","path":"/lrsiem/7.17.0/knowledge-base","children":[{"id":"ci_a4ba61965239ddb599d1bd0c29135b7a3f45cc42b3bab5fa969b7b5e00f2074a","title":"Back Up the EMDB","path":"/lrsiem/7.17.0/back-up-the-emdb","children":[]},{"id":"ci_957633c2318b0079339770897c2bc8dd49d0aefda1b45a2d3fe15a54e1f8652c","title":"Configure Knowledge Base Synchronization Settings","path":"/lrsiem/7.17.0/configure-knowledge-base-synchronization-settings","children":[]},{"id":"ci_9f896b6d37eb49ecf31dddb5a89c489ec8737b70e1161814e665463d5fdba489","title":"Download the Knowledge Base File","path":"/lrsiem/7.17.0/download-the-knowledge-base-file","children":[]},{"id":"ci_feb45e22391f6911e414a7191e0ab276aeaf68a9aa82c661f9cd01fc128aea9b","title":"Import a Knowledge Base","path":"/lrsiem/7.17.0/import-a-knowledge-base","children":[]},{"id":"ci_52dc5425554d4166107bdd90ef35c2715ad5524f84f32893c7b6f8b3ea565bcc","title":"Knowledge Base Manager","path":"/lrsiem/7.17.0/knowledge-base-manager","children":[{"id":"ci_bfb73361abbe61133791fef761edcb62b429e2b7d6ed2fa07231a7097e972eb4","title":"Disable Knowledge Base Modules","path":"/lrsiem/7.17.0/disable-knowledge-base-modules","children":[]},{"id":"ci_6823b60bd3d06495de3da450d70e3dba2abafef197987db81253d4cead547969","title":"Enable Knowledge Base Modules","path":"/lrsiem/7.17.0/enable-knowledge-base-modules","children":[]},{"id":"ci_5ba1077535973a18a6021858ca6f43b80daba7c3540e0c6e489cc0e0802141cd","title":"Export Knowledge Base Module Information to a File","path":"/lrsiem/7.17.0/export-knowledge-base-module-information-to-a-file","children":[]},{"id":"ci_b1a884cfeb33b4dc5badde6b92bde245d1327ffd1314203d549542a814430761","title":"Migrate Common Events","path":"/lrsiem/7.17.0/migrate-common-events","children":[]},{"id":"ci_2fe378a90e2dccaab7ba7950f18a7a8e041963b956a0001ccbea8e7135c016bb","title":"Modify the Properties of Knowledge Base Modules","path":"/lrsiem/7.17.0/modify-the-properties-of-knowledge-base-modules","children":[]},{"id":"ci_76411e3c2301dab4cdd065a9ce2e030b13e59b14326b14335f7ff9fa08daa14e","title":"View Knowledge Base Module Dependent Objects","path":"/lrsiem/7.17.0/view-knowledge-base-module-dependent-objects","children":[]}]}]},{"id":"ci_141cf6dbce38c719bd2bc476e5379ed2550f73502a4960825b2181b8ba88b12d","title":"Log Distribution Services","path":"/lrsiem/7.17.0/log-distribution-services","children":[{"id":"ci_cb2994b6ffbfe5761f5c4815de9efb100170a5b378c32e1a7ca20946159ec18c","title":"Log Distribution Receiver Manager","path":"/lrsiem/7.17.0/log-distribution-receiver-manager","children":[{"id":"ci_4f268eb4983aaf3e868914325346d4a875d1d5c95e56c0b02c84857144b6bc56","title":"Create Log Distribution Receivers","path":"/lrsiem/7.17.0/create-log-distribution-receivers","children":[]},{"id":"ci_758b21e1aef16bfb0b262d6c2299d0168bc9cd8164988c7181d1f3706c49e405","title":"Enable Log Distribution Receivers","path":"/lrsiem/7.17.0/enable-log-distribution-receivers","children":[]},{"id":"ci_a9affaadd4425498b14ba20699b3d3baa55a8d2ee966d503d6c68abbd531da6a","title":"Modify Log Distribution Receivers","path":"/lrsiem/7.17.0/modify-log-distribution-receivers","children":[]}]},{"id":"ci_a202d981894f853a11fab2cafe4df297b8bd98f73c15d928e07f4736afc477f1","title":"Log Distribution Policy Manager","path":"/lrsiem/7.17.0/log-distribution-policy-manager","children":[{"id":"ci_c04a2e5bec46d9e6898eca88b2baba9a1b4c8cab3a6816313b12fb4df33b6daf","title":"Create Log Distribution Service Policies","path":"/lrsiem/7.17.0/create-log-distribution-service-policies","children":[]},{"id":"ci_a0ec31fba8f0b7861fcb7a8e715fdbe39979917757284b8b6e9b1ad7907e7406","title":"Enable or Disable Log Distribution Service Policies","path":"/lrsiem/7.17.0/enable-or-disable-log-distribution-service-policies","children":[]},{"id":"ci_5d679577d7ca21b0c4c134ce119396a828796d5768d83b535ff4de8d558e7614","title":"Modify Log Distribution Service Policies","path":"/lrsiem/7.17.0/modify-log-distribution-service-policies","children":[]}]},{"id":"ci_03c419f110a9e688e8d65fcbd911e98f64748c56ca25331bffbb6b9a070034fb","title":"LogRhythm Log Distribution Services Version 2","path":"/lrsiem/7.17.0/logrhythm-log-distribution-services-version-2","children":[{"id":"ci_d7d2f15c42d0bf12c9ddfb1d7c1b7928790127f90a6f66da788fd2a94765cbc3","title":"Determine When to Switch to Log Distribution Services v2","path":"/lrsiem/7.17.0/determine-when-to-switch-to-log-distribution-services-v2","children":[]},{"id":"ci_4624fc860d270e7cd4f9aed3b1ed7e50e7b6ca8d992f3a362a0f737419b1369a","title":"Enable Log Distribution Services v2","path":"/lrsiem/7.17.0/enable-log-distribution-services-v2","children":[]},{"id":"ci_a5c9e0bc977affdc7ab1760be406316a5298bc1256534e90549261695d1d2240","title":"Troubleshoot Log Distribution Services v2","path":"/lrsiem/7.17.0/troubleshoot-log-distribution-services-v2","children":[]}]},{"id":"ci_9383a052df733a43062080ba773299108ba963d94a476b7859963ca78ffa28ef","title":"Modify Log Distribution Service Properties in Data Processors","path":"/lrsiem/7.17.0/modify-log-distribution-service-properties-in-data-processors","children":[]}]},{"id":"ci_e2c02effc559eefb2444a93d58288d657894d9f4efa6a25f471d03fc5043b6f5","title":"Log Processing Policies","path":"/lrsiem/7.17.0/log-processing-policies","children":[{"id":"ci_46e7c50a0765753a1ef5da6ba0aca0de84e14ca2da5e3081f289d2a89f4038bd","title":"Create Log Processing Policies","path":"/lrsiem/7.17.0/create-log-processing-policies","children":[]},{"id":"ci_d375fb774272a164fc4eb767d6ee945a1259c692d6b33bf73f109ed6ed466fd4","title":"Assign Log Processing Policies","path":"/lrsiem/7.17.0/assign-log-processing-policies","children":[]},{"id":"ci_d3ea41ca87672ab582aa58ca8868f47c2503676094d9cf758da3008ea7c28f0e","title":"Modify Log Processing Policies","path":"/lrsiem/7.17.0/modify-log-processing-policies","children":[]},{"id":"ci_2f667413b5b6e65d7d5e6e51b216523416f666f9cb57717d363ec1e00c9efba3","title":"Delete Log Processing Policies","path":"/lrsiem/7.17.0/delete-log-processing-policies","children":[]},{"id":"ci_8b0c7fa1c02b23f52dc9ea24e0ff6deb40bbbf4479ad2400791b16b058771601","title":"Troubleshoot MPE Rule Performance","path":"/lrsiem/7.17.0/troubleshoot-mpe-rule-performance","children":[]}]},{"id":"ci_7693aa094734e9819cbfdd628f340740a204ed4ceebf3c6443396babd972ff78","title":"Log Sources","path":"/lrsiem/7.17.0/log-sources","children":[{"id":"ci_4682223d2c96ad6ad36d3af63f54d12fa63e7bf74d39019c501f617f0e298310","title":"Work With Log Sources","path":"/lrsiem/7.17.0/work-with-log-sources","children":[{"id":"ci_60cb8b27fe3313e63907c074afb60db93c0494b59c37722347ce8aaa5ab66fc5","title":"Add a Single Log Source","path":"/lrsiem/7.17.0/add-a-single-log-source","children":[]},{"id":"ci_5d1f2dec97a76d557aa9637d7bed91fa59d7bbc9884fe1fe5fc1b7870eed9032","title":"Add Multiple Log Sources","path":"/lrsiem/7.17.0/add-multiple-log-sources","children":[]},{"id":"ci_9076a38261a65cf2eea3a31bdac2bd16ae27dd039e24fab5866c51bffc58aadf","title":"Associate New Log Sources","path":"/lrsiem/7.17.0/associate-new-log-sources","children":[]},{"id":"ci_ae6978839cb233e2e9e938b9f31b6493fb51648f84e450e13f843e8f2ee68298","title":"Collect Local Event Logs with the Server Service Disabled","path":"/lrsiem/7.17.0/collect-local-event-logs-with-the-server-service-disabled","children":[]},{"id":"ci_ad5da102322dae862c7d90c8dee7f71e057876d2225becf82f070577413bd152","title":"Configure Log Sources Automatically","path":"/lrsiem/7.17.0/configure-log-sources-automatically","children":[{"id":"ci_43b24b7bf84bdffc1357a0d4e7c80c62009e833750f70e2ead34785f740e4220","title":"Add and Delete SNMP Connections","path":"/lrsiem/7.17.0/add-and-delete-snmp-connections","children":[]},{"id":"ci_bc1ebe4a75e8af980ff820b91e46ae567f2f0681095f14041902b6a7eda0219f","title":"Enable Automatic Log Source Configuration","path":"/lrsiem/7.17.0/enable-automatic-log-source-configuration","children":[]},{"id":"ci_f1689d42640fe1be15ef3a86a64ef0b116ebca1ea3ef8fcf31818bddec3f3834","title":"Use the Advanced Criteria Manager","path":"/lrsiem/7.17.0/use-the-advanced-criteria-manager","children":[]}]},{"id":"ci_493d24f503a8a4b0a08b226f654bcf1eb608debc9caf0bbe9a6598c2d02de498","title":"Configure Support for Multi-Line Logs","path":"/lrsiem/7.17.0/configure-support-for-multi-line-logs","children":[]},{"id":"ci_720afd9289e62323dd104c15f2197d22266cb17fb80e4c3225506f1078afce6b","title":"Export Log Sources","path":"/lrsiem/7.17.0/export-log-sources","children":[]},{"id":"ci_2c488a73b8e8d7a3a87ab3dd5956a82adf6e97226cf8d60fb15bb166a2fceceb","title":"Modify a Single Log Source","path":"/lrsiem/7.17.0/modify-a-single-log-source","children":[]},{"id":"ci_0fe46db944044a660388ad9d005dd8181280874cfd6a9734854ee29bc387f476","title":"Modify Event Settings","path":"/lrsiem/7.17.0/modify-event-settings","children":[]},{"id":"ci_cef1ac0f9558c484a9708d024761e3a1eb1fc58b45a5b747c3b05e7a9b1c75d6","title":"Modify Multiple Log Sources","path":"/lrsiem/7.17.0/modify-multiple-log-sources","children":[]},{"id":"ci_18707dbe85c97c5af315d0dac91f8ff9e9f07968745527bbf2ed539e4b47e7cf","title":"Move Log Sources to New Hosts","path":"/lrsiem/7.17.0/move-log-sources-to-new-hosts","children":[]},{"id":"ci_2e7279704c24752d4e3dd230972dec592709f2cc1fdd94537966cf6fc04689e8","title":"Preregister Log Sources","path":"/lrsiem/7.17.0/preregister-log-sources","children":[]},{"id":"ci_4ee6fc085cccd1c832344b58b72408351edf6e25d9b6b375abc16bcf57cbd2bb","title":"Resolve Log Source Hosts","path":"/lrsiem/7.17.0/resolve-log-source-hosts","children":[]},{"id":"ci_ce6dd070cb081131cffdd5df4bfb8cbe03fe4c17b76ef7215428cc76ed3fceae","title":"Retire or Activate Log Sources","path":"/lrsiem/7.17.0/retire-or-activate-log-sources","children":[]}]},{"id":"ci_32cce1cab3815f11b78669db504c5633981e89507d197f8d712876c860b1160c","title":"Log Source Types","path":"/lrsiem/7.17.0/log-source-types","children":[{"id":"ci_04654e21113be51bc75cc0452a56f5e5fda53702a8c16b1c24c0fc3a1e7b4ce7","title":"Create Custom Log Source Types","path":"/lrsiem/7.17.0/create-custom-log-source-types","children":[]},{"id":"ci_cd30858f6b7ec6dd3ade4e33346eac6136f61c4b70b570c3cd5af773669cd9b8","title":"Delete Custom Log Source Types","path":"/lrsiem/7.17.0/delete-custom-log-source-types","children":[]},{"id":"ci_a4a80a37d3137a40c57449519d1d48e707447be1fd9c5ca94067cfec2f20c817","title":"Modify Custom Log Source Type","path":"/lrsiem/7.17.0/modify-custom-log-source-type","children":[]},{"id":"ci_33e5070cb9e8faece2de1d501cd27c8848804cd5c95e29d79cf70f591deeea0c","title":"Modify Type for Pending Log Source","path":"/lrsiem/7.17.0/modify-type-for-pending-log-source","children":[]}]},{"id":"ci_2f0e924c2152549429337227850ab35ff2bc46fe9e7628750cd63606186665eb","title":"Data Masking","path":"/lrsiem/7.17.0/data-masking","children":[{"id":"ci_aaa8a87bf25c28ffdf500b600a48186ad32ec5db0088d5764ce51f81802b103d","title":"Add New Data Masking Rules","path":"/lrsiem/7.17.0/add-new-data-masking-rules","children":[]},{"id":"ci_d83036ac925caaa3df2bad242878372cb503c4649e0354a05e295d1e75d75543","title":"Import and Export Data Masking Rules","path":"/lrsiem/7.17.0/import-and-export-data-masking-rules","children":[]},{"id":"ci_d1ccf57a5b46022348795a404df31fe08fc9f312337bb2d07be8838e9b96242c","title":"Enable and Disable Data Masking Rules","path":"/lrsiem/7.17.0/enable-and-disable-data-masking-rules","children":[]},{"id":"ci_d7328167f946244200598017ba047a4d54a56325bdb30ac21b990fe3290a49a6","title":"Reorder Data Masking Rules","path":"/lrsiem/7.17.0/reorder-data-masking-rules","children":[]},{"id":"ci_9c77db50612bd967ac1081613567b152fb40d9ee4d9f68d57b6dd9de6a0da6f4","title":"Delete Data Masking Rules","path":"/lrsiem/7.17.0/delete-data-masking-rules","children":[]}]},{"id":"ci_722a93c3b446b9db459e03fe0ae0f5435a8613832f4d135113595b833c957a67","title":"Log Source Identification and Acceptance","path":"/lrsiem/7.17.0/log-source-identification-and-acceptance","children":[{"id":"ci_ecffecdd58525624f943411579dfca96b94a7c9ae757116d98262efa5a8dfeb2","title":"Accept New Log Sources","path":"/lrsiem/7.17.0/accept-new-log-sources","children":[]},{"id":"ci_e07739c34ca5e553f27e075e2c6ede328e84296db744acca08a5531076b378b2","title":"Accept New Log Sources Automatically","path":"/lrsiem/7.17.0/accept-new-log-sources-automatically","children":[{"id":"ci_5f94caf45d6a169473b21849acdd9d6061507d23eaf67153cf9d505202c14d77","title":"Create IP Range Log Source Acceptance Rules","path":"/lrsiem/7.17.0/create-ip-range-log-source-acceptance-rules","children":[]},{"id":"ci_72fc0b59ec6ee1867a27997e608f51da0598bc13c488b848832b799ba46569fb","title":"Create Pattern Match Log Source Acceptance Rules","path":"/lrsiem/7.17.0/create-pattern-match-log-source-acceptance-rules","children":[]},{"id":"ci_6fe867d6c645314755506352e3652423b39c9eb6c84b5780ea5664d769c1b8a8","title":"Manage Automatic Log Source Acceptance Rules","path":"/lrsiem/7.17.0/manage-automatic-log-source-acceptance-rules","children":[]}]},{"id":"ci_29a3f381bc3de3a40c2b5ac12a985d5d910baf47c7698792b0048c7048d91ca1","title":"Set the Log Source Identification Search Scope","path":"/lrsiem/7.17.0/set-the-log-source-identification-search-scope","children":[]},{"id":"ci_e2f53a972800df746e0ac5065c2728a6e07ec18508c86e4939017373b6ce23ac","title":"View Log Source Acceptance Properties","path":"/lrsiem/7.17.0/view-log-source-acceptance-properties","children":[]}]},{"id":"ci_b49583fce8cd5e15be89225b3a5ec318a3fc3020306adb92771d4b31d91d6141","title":"Log Sources and Agents","path":"/lrsiem/7.17.0/log-sources-and-agents","children":[{"id":"ci_3c57e8ecab0ed1910a3786d3731ad89298e6dff3eff5f70ca1eda4936490ebb0","title":"Limit the Number of Agents Available for Batch Updates","path":"/lrsiem/7.17.0/limit-the-number-of-agents-available-for-batch-updates","children":[]},{"id":"ci_4b8e2b31cb33c4730f004a043ea616ddb873372413d3754542edfea6974c19dc","title":"Move Log Sources Between Agents","path":"/lrsiem/7.17.0/move-log-sources-between-agents","children":[]}]},{"id":"ci_92323fe5f81c4d2f5fa7c97ca81aedaf6e35f469b46bdcce02a0d27905b0da68","title":"Flat File Collection","path":"/lrsiem/7.17.0/flat-file-collection","children":[{"id":"ci_9bff750fae7661390b7d4128fe8576231b96109f37d043c9dd040cd1bb455251","title":"Configure a Host for Local Flat File Collection","path":"/lrsiem/7.17.0/configure-a-host-for-local-flat-file-collection","children":[]},{"id":"ci_2e72f14adc89f28025be37722b1f4e5c9b7d227e391eeb4f8d5b7113c9522687","title":"Configure an Agent for IIS Log Collection","path":"/lrsiem/7.17.0/configure-an-agent-for-iis-log-collection","children":[]},{"id":"ci_d818911b7eaf23544626e10997fdef4a56798c0c35bba12c0d1f4e597dbc7a8f","title":"Convert Flat File to Epoch Time","path":"/lrsiem/7.17.0/convert-flat-file-to-epoch-time","children":[]},{"id":"ci_f1f689b7778f49fdeb495af737c46b4667be5267e4f4ef96997fd586fa92511a","title":"Supported Date Parsing Formats","path":"/lrsiem/7.17.0/supported-date-parsing-formats","children":[]}]},{"id":"ci_c84376e20735b2d6f376ac87a6506e6ad04ae9cf43f4cb75c1f280346bd7b529","title":"UDLA Collection","path":"/lrsiem/7.17.0/udla-collection","children":[{"id":"ci_bc9ae6cdb98bcc007cf301df86b3b5d886c16548bfbfbdb726b71da2c81a2b59","title":"Configure UDLA Log Collection","path":"/lrsiem/7.17.0/configure-udla-log-collection","children":[]},{"id":"ci_0d8b1f1d721b3265e83b6c1b4bb74de93af49ca6de7d7c36cffb2eb1fdbe4057","title":"Create a Sample McAfee ePolicy Orchestrator (ePO) Event Log Source","path":"/lrsiem/7.17.0/create-a-sample-mcafee-epolicy-orchestrator-epo-event-log-source","children":[]},{"id":"ci_bd6d8a3e835e8f8893d7ca4571987c1eee3eb4e980441857ce0e643239ad349b","title":"Create a Sample Oracle 10g Audit Trail UDLA Log Source","path":"/lrsiem/7.17.0/create-a-sample-oracle-10g-audit-trail-udla-log-source","children":[]},{"id":"ci_62e6c7c5b32072d9a52ef58361c8d63ef674596105e408a426900695d56371c9","title":"Export and Import UDLA Log Source Configurations","path":"/lrsiem/7.17.0/export-and-import-udla-log-source-configurations","children":[]},{"id":"ci_72821bb3c9acafe5fd328c7240fb9aa24db76b4e518052ef710a5493ccb370a4","title":"Override UDLA SQL","path":"/lrsiem/7.17.0/override-udla-sql","children":[]}]},{"id":"ci_f02ffc18261a54237d0f60547028a5dacfa412a433adab541017559c90dfb750","title":"Log Source Virtualization","path":"/lrsiem/7.17.0/log-source-virtualization","children":[{"id":"ci_143b06c49f4c443488612b41b9a085f3e34e7642d43791ba0316a3780e2bf712","title":"Create Log Source Virtualization Templates","path":"/lrsiem/7.17.0/create-log-source-virtualization-templates","children":[]},{"id":"ci_f7e92dddbd0b6677baf1c717235e3e4ac8dc73c5d00c814a73f63f70b465033a","title":"Create Virtual Log Sources","path":"/lrsiem/7.17.0/create-virtual-log-sources","children":[]},{"id":"ci_324a97e9c740604e7714770e42c7a9acc4de267f77bcef10623d8ce39c658799","title":"Delete Log Source Virtualization Templates","path":"/lrsiem/7.17.0/delete-log-source-virtualization-templates","children":[]},{"id":"ci_efa812b62f05cc82882f858e4a61a2378e2b97702920bca46cd8e46891489643","title":"Delete Virtual Log Sources","path":"/lrsiem/7.17.0/delete-virtual-log-sources","children":[]},{"id":"ci_ee88cc304fd070e13c1206a84f1c534de2701e0275d362cbf465c8dd6254c04f","title":"Enable Virtualization on a Single Log Source","path":"/lrsiem/7.17.0/enable-virtualization-on-a-single-log-source","children":[]},{"id":"ci_24b42c1ae5366fde1e61cb1d648f707112a5cf4d4397e545ae111c598920f9b2","title":"Enable Virtualization on Multiple Log Sources","path":"/lrsiem/7.17.0/enable-virtualization-on-multiple-log-sources","children":[]},{"id":"ci_de6024aaa61f79e6264431ec9978cd9c4bb97ae0f14ced75205f5abc965f77ee","title":"Export Log Source Virtualization Templates","path":"/lrsiem/7.17.0/export-log-source-virtualization-templates","children":[]},{"id":"ci_3d4a639d547ae19de7c82986835e3f68ef7346f5c0bcdb8caffa2a5d59afb358","title":"Filter Virtual Logs at the Agent","path":"/lrsiem/7.17.0/filter-virtual-logs-at-the-agent","children":[]},{"id":"ci_7694ddef2a17c5f126f23df5d0b398d233f95250797742a6c0bdf7c7e8a0d295","title":"Import Log Source Virtualization Templates","path":"/lrsiem/7.17.0/import-log-source-virtualization-templates","children":[]},{"id":"ci_b62936c4d43646583025a0390c9791e3f7bdf3cb78197d35a911c61951c5a73b","title":"Modify Catch-All Sources on a Batch of Parent Log Sources","path":"/lrsiem/7.17.0/modify-catch-all-sources-on-a-batch-of-parent-log-sources","children":[]},{"id":"ci_de926899c188b4cf74b185e8fac617d936d5787da2a003cdb63f7780e8e31a86","title":"Modify Log Source Virtualization Templates","path":"/lrsiem/7.17.0/modify-log-source-virtualization-templates","children":[]},{"id":"ci_599cbe872437f6d4f08ad1d2b3c039c02037ab29f42f8063444f35daad4564c7","title":"Modify Virtual Log Sources","path":"/lrsiem/7.17.0/modify-virtual-log-sources","children":[]}]}]},{"id":"ci_46e74d79746ea2837139bd5ed71fd10512908d24037d9c4ca09fe0535d19246e","title":"Network Monitor","path":"/lrsiem/7.17.0/network-monitor","children":[{"id":"ci_da0c0e8309f5d0b90f11cbae69f829ec4bc423644b979d7fad3f0a2cd03753e8","title":"Add NetMon in the Client Console","path":"/lrsiem/7.17.0/add-netmon-in-the-client-console","children":[]},{"id":"ci_168e43ac8cdaa671008a0cc33c4b4823b68177481be139812f59dede86da2feb","title":"Configure NetMon in the Client Console","path":"/lrsiem/7.17.0/configure-netmon-in-the-client-console","children":[]},{"id":"ci_361d8b158603d14b9c28cdd9481f81b0593dc02e4a3c0dd4180fe841f4fc2a94","title":"Delete NetMon in the Client Console","path":"/lrsiem/7.17.0/delete-netmon-in-the-client-console","children":[]},{"id":"ci_56a7783efd95633fa649d2ac774565d3930b1bdd60a65f1f52069ef0ffdc92f6","title":"Modify NetMon in the Client Console","path":"/lrsiem/7.17.0/modify-netmon-in-the-client-console","children":[]},{"id":"ci_c4bfccc5dc512756fa93df9380ac94353b4916487635e3382bcc34ed57dfb959","title":"Monitor NetMon in the Client Console","path":"/lrsiem/7.17.0/monitor-netmon-in-the-client-console","children":[]}]},{"id":"ci_2220e0f8d9fafc41743c9d8281d846c388ad8816ac26653dd507984dc2662af1","title":"Network Records","path":"/lrsiem/7.17.0/network-records","children":[{"id":"ci_820135cd4b796cb93ae8a8f3e4d7e4dd28788449088bc637c3f84300e016fda7","title":"Add Network Records from File","path":"/lrsiem/7.17.0/add-network-records-from-file","children":[]},{"id":"ci_50ee75edeec9516f3a845b4e4169666a4bcbd444e5e2959ee565664578f2f078","title":"Manually Add Network Records","path":"/lrsiem/7.17.0/manually-add-network-records","children":[]},{"id":"ci_a784e8d20879e291bb4b4183e04088ba03069a68c92724c4013d3f8788219451","title":"Modify Properties for a Single Network","path":"/lrsiem/7.17.0/modify-properties-for-a-single-network","children":[]},{"id":"ci_2dd7f13c6379a89da7eb64fe168a4fe20840a8be76dccd3fd801a28de94ceb5d","title":"Modify Properties for Multiple Network Records","path":"/lrsiem/7.17.0/modify-properties-for-multiple-network-records","children":[]},{"id":"ci_582ed3af825e8c6cc5acfe8115c581ea5c17d810b1d04ae4f0dba7ec3123ed35","title":"Resolve Known Networks","path":"/lrsiem/7.17.0/resolve-known-networks","children":[]},{"id":"ci_934b2d9b05a8cf3c1d71956c25b6301e3daaa4878a745aa99e41476d14d6b715","title":"Retire Network Records","path":"/lrsiem/7.17.0/retire-network-records","children":[]},{"id":"ci_b7e027a5ecfd43cb4fab8bc589cb3e1170765bba1a27ac4afbfac4489e9e840e","title":"Search for Networks","path":"/lrsiem/7.17.0/search-for-networks","children":[]}]},{"id":"ci_7ccc1d99bc5f144038f37ea0ddf1edead23e139a0ab559dd1f2496e9b5a5fbba","title":"Object Permissions Manager","path":"/lrsiem/7.17.0/object-permissions-manager","children":[{"id":"ci_a974aa70e451cf64faab941fee014bf03d43c33fb47ce7db5a63b481dae79b81","title":"Modify Objects' Security Settings","path":"/lrsiem/7.17.0/modify-objects-security-settings","children":[]}]},{"id":"ci_9e71376a6f5657833ab32a885ce90e34d796d14650d196a0edfc68aa6940347b","title":"People and Users","path":"/lrsiem/7.17.0/people-and-users","children":[{"id":"ci_438da101f05d57dbfa3cede4cf1a10cd00985f4694dd19c192ffd0079c489fa0","title":"Add Person Records or Roles","path":"/lrsiem/7.17.0/add-person-records-or-roles","children":[]},{"id":"ci_0e53908f9b382da314457d52e96661360f60cecedbf445376c0bfdacdfc695b5","title":"Assign Active Directory Credentials to Local Users","path":"/lrsiem/7.17.0/assign-active-directory-credentials-to-local-users","children":[]},{"id":"ci_48b132f6a2cf560de3cb20ed6e041cb1fe60dac1fff6a3a8dd70bbce1ae03d71","title":"Create User Accounts for Person Records or Roles","path":"/lrsiem/7.17.0/create-user-accounts-for-person-records-or-roles","children":[]},{"id":"ci_ad63c7570fc33889593ac3093fcd73c4419a479d9046f4fcfe24cbcc87bcbe78","title":"Direct Requests to the Case API URL","path":"/lrsiem/7.17.0/direct-requests-to-the-case-api-url","children":[]},{"id":"ci_084cd6c3b5e6daee1eaf8bfc52dd6db829027e9776f0f97af77875360746c111","title":"Disable Person Records or Roles","path":"/lrsiem/7.17.0/disable-person-records-or-roles","children":[]},{"id":"ci_3eec9659469d6a5fb9b5c7194b6d202d6d02fd92569e64540507d4e28e1a82e6","title":"Modify Logins for Person Records or Roles","path":"/lrsiem/7.17.0/modify-logins-for-person-records-or-roles","children":[]},{"id":"ci_d940cf24aa18049c02e81d49c5de0465e4684d6c26b8c675fc8642fb22fe24da","title":"Modify Person Records or Roles","path":"/lrsiem/7.17.0/modify-person-records-or-roles","children":[]},{"id":"ci_b3fc22554643ea0e44fa5bb65ccea33a2f10b49dabc21dba2ad40635a90c783e","title":"Rename LogRhythm Users","path":"/lrsiem/7.17.0/rename-logrhythm-users","children":[]},{"id":"ci_e1203fbe070f409155158f6ba1c9e3d6c9f7d1edc8f4b89b07b5d801128ec594","title":"Reset Multi-Factor Authentication Access to the Web Console","path":"/lrsiem/7.17.0/reset-multi-factor-authentication-access-to-the-web-console","children":[]},{"id":"ci_942b96d9b8a7bf4eabb6177823d980a179165f6fd0f082b766f046d2a6b2afa3","title":"User Profile Manager","path":"/lrsiem/7.17.0/user-profile-manager","children":[{"id":"ci_d6b4913546b4df3e7f59623997d74c0ff43b7b98948307c2a53552db9985cd2b","title":"Create a New User Profile","path":"/lrsiem/7.17.0/create-a-new-user-profile","children":[]},{"id":"ci_a99149170ad9469f3541ef336d1f55cde79903f607c3ec95de5e77071531fc95","title":"Manage User Profile SmartResponse Access Rights","path":"/lrsiem/7.17.0/manage-user-profile-smartresponse-access-rights","children":[]},{"id":"ci_23930164e6360c7fd251dec5650127a35200d17a7b39efa659aeb11dc0f6a134","title":"Modify User Profile Data Processor Access Rights","path":"/lrsiem/7.17.0/modify-user-profile-data-processor-access-rights","children":[]},{"id":"ci_b73883e1adbf34c6ea2d1504d98c317ee12d72f1ded968d1c001df3dee03015c","title":"Modify User Profile Effective Log Sources Settings","path":"/lrsiem/7.17.0/modify-user-profile-effective-log-sources-settings","children":[]},{"id":"ci_61f023b4c4499fd05d3328a233bc34bd93ea512c3609a73adfea0b617ec985d4","title":"Modify User Profile Entities Settings","path":"/lrsiem/7.17.0/modify-user-profile-entities-settings","children":[]},{"id":"ci_3f6e23284958f0474acb3d72839f58fb72b199501da23e24b499444da7e53860","title":"Modify User Profile General Settings","path":"/lrsiem/7.17.0/modify-user-profile-general-settings","children":[]},{"id":"ci_dcf4b4353a03395acf04e76d7ab63aa013aacb34b10d16ad6333178aa4e49216","title":"Modify User Profile Log Sources Access Rights","path":"/lrsiem/7.17.0/modify-user-profile-log-sources-access-rights","children":[]},{"id":"ci_45c83ec9c317d813346a88f9d1e173987cde5da8765ef39cc89dfc9e8d6b0fb3","title":"Manage User Profile Notification Group Access Rights","path":"/lrsiem/7.17.0/manage-user-profile-notification-group-access-rights","children":[]},{"id":"ci_66dd1144f5c9c7c01e08fceac263b9ffe682cea2965f238751105807712aa15b","title":"Modify User Profile Management Permissions","path":"/lrsiem/7.17.0/modify-user-profile-management-permissions","children":[]}]}]},{"id":"ci_3879c8a1dfa22e34e2fba857e0d095488188ddda7c1b8550c333a06ac187a3af","title":"Platform Manager","path":"/lrsiem/7.17.0/platform-manager","children":[{"id":"ci_d9520ea64722c9b672f2976dbd9db5c82faf4744bd9b9918a1c4b5ed3b4509b3","title":"Alarming, Reporting, and Response Manager Services","path":"/lrsiem/7.17.0/alarming-reporting-and-response-manager-services","children":[{"id":"ci_d4c62042d1577d5378232d7e00382671d0b2fffc5de22e6d4a5272fddbc07609","title":"Apply Recommended Platform Manager Values","path":"/lrsiem/7.17.0/apply-recommended-platform-manager-values","children":[]},{"id":"ci_7321260a7a5d3c53489acedda818f57f0fefd40526b0b7a9534b6f9a5378e1b9","title":"Integrate LogRhythm and McAfee ePolicy Orchestrator","path":"/lrsiem/7.17.0/integrate-logrhythm-and-mcafee-epolicy-orchestrator","children":[]},{"id":"ci_77cca2e2c3e9736861fab265dfe732e9118b629710e6f51c5ec214e1238e4625","title":"Modify Platform Manager Advanced Properties","path":"/lrsiem/7.17.0/modify-platform-manager-advanced-properties","children":[]},{"id":"ci_b5b2eb5ef36f6006a63694575e07f0c97f0f0f2e59df15951e44492021fca8c4","title":"Modify Platform Manager Basic Properties","path":"/lrsiem/7.17.0/modify-platform-manager-basic-properties","children":[]},{"id":"ci_6006d75df9185dc840216c61eeadd08ec6033c79efdabded2dc3ed40f03438f3","title":"Revert to a Previous Platform Manager Configuration","path":"/lrsiem/7.17.0/revert-to-a-previous-platform-manager-configuration","children":[]},{"id":"ci_4bb536aa6a76b25d60caacf6a41fe452d80ec3e337d5ea4d6b9f90185364ccc7","title":"Specific SMTP Servers to Allow for Failover","path":"/lrsiem/7.17.0/specific-smtp-servers-to-allow-for-failover","children":[]},{"id":"ci_243d875df62e67f0d6840caabbb4c782d0a3c890014fbe5f06e08a93fac0c330","title":"Start, Stop, and Restart Platform Manager Services","path":"/lrsiem/7.17.0/start-stop-and-restart-platform-manager-services","children":[]}]},{"id":"ci_0091a24840c209c230aaf9908cb616b5e7d7fe4d498687c1e83f0ba15950f2e1","title":"Global Risk Based Priority","path":"/lrsiem/7.17.0/global-risk-based-priority","children":[{"id":"ci_9a9b48249b722bae9ace8c9d3d745d09baabcbcb4ce0a3afbf5a10775e61db8a","title":"Determine the MPE RBP Manually","path":"/lrsiem/7.17.0/determine-the-mpe-rbp-manually","children":[]},{"id":"ci_66623d15873e6eff4ee4b6eaad3433fad09d15c793d7bcede37aa27916eb12cb","title":"Modify AIE Risk Based Priority Settings","path":"/lrsiem/7.17.0/modify-aie-risk-based-priority-settings","children":[]},{"id":"ci_a175b37027e60b9348d9fcba24615289b53b3272459c6fd15c565bddaf8f1578","title":"Modify the Default Destination Risk Level","path":"/lrsiem/7.17.0/modify-the-default-destination-risk-level","children":[]},{"id":"ci_df03552dcade48f80a74fdd1783cb51c4d9818e517d7689a87aec8a0aca3ccb2","title":"Modify the Default Source Threat Level","path":"/lrsiem/7.17.0/modify-the-default-source-threat-level","children":[]},{"id":"ci_8c31ed8be9316cda017e841df4d48774f154588ae2f27d7a5c3cec52863ad891","title":"Modify the MPE Risk Based Priority Settings","path":"/lrsiem/7.17.0/modify-the-mpe-risk-based-priority-settings","children":[]},{"id":"ci_cbdfdb55684e140a287fa339a1641db409c21e7a4f7f9ae1a0e38f7af1991e51","title":"Risk Based Priority Calculator","path":"/lrsiem/7.17.0/risk-based-priority-calculator","children":[{"id":"ci_cd4c369647c7546fad61251757cff409078c91a6eaea47f939c55d991ed3e0e4","title":"Install the RBP Calculator","path":"/lrsiem/7.17.0/install-the-rbp-calculator","children":[]},{"id":"ci_c64379e21874dfbd0d22357af05257eacb93a434ae147309bf6787dc043a268d","title":"Determine MPE or AIE Risk Based Priority With The RBP Calculator","path":"/lrsiem/7.17.0/determine-mpe-or-aie-risk-based-priority-with-the-rbp-calculator","children":[]},{"id":"ci_112a0c3518b926641cd7f008aa6895808b56c80f28772059a52c592efe7a832b","title":"Transfer AIE RBP Calculator Values to a LogRhythm Deployment","path":"/lrsiem/7.17.0/transfer-aie-rbp-calculator-values-to-a-logrhythm-deployment","children":[]},{"id":"ci_90376eb6a176060063b17336beedd87cb4063eccb87c24d00f4fa6845c212fba","title":"Host, Network, and Default DRL and STL Settings","path":"/lrsiem/7.17.0/host-network-and-default-drl-and-stl-settings","children":[{"id":"ci_cd6621f1c2a1d26acc54b28ee94f02416fdf75d4f25405470f666c6edad39b58","title":"Known Host and Network Search Algorithm","path":"/lrsiem/7.17.0/known-host-and-network-search-algorithm","children":[]}]},{"id":"ci_bf3153959b45b158301be4c5430842ff965e77446d9a8dddfa80733077fc5447","title":"Message Processing Engine RBP Algorithm","path":"/lrsiem/7.17.0/message-processing-engine-rbp-algorithm","children":[]},{"id":"ci_3ec12b7bb9a5c094d0bb59750e1ee910e1ebd1b8ae1ebea55c6188750173d913","title":"AI Engine RBP Algorithms","path":"/lrsiem/7.17.0/ai-engine-rbp-algorithms","children":[]}]}]},{"id":"ci_96a3a14a1ff4b95aaeede60b4783312e120dc357c65932f92863c70ab1a20da9","title":"Job Manager Services","path":"/lrsiem/7.17.0/job-manager-services","children":[{"id":"ci_f610c62c78044ee6c33192e3c6b0b3f668a501adb0b236accc482295200aba06","title":"Modify Job Manager Advanced Properties","path":"/lrsiem/7.17.0/modify-job-manager-advanced-properties","children":[]},{"id":"ci_220a508fdc58dbc1acc6ea3ec767847f1f6875df561a2b088cd1648ce136f52f","title":"Modify Job Manager Basic Properties","path":"/lrsiem/7.17.0/modify-job-manager-basic-properties","children":[]},{"id":"ci_f2002875f9ab6fbbc0bd689a904692de27a95af463c9f1724b06c52d438761c8","title":"Start, Stop, and Restart Job Manager Services","path":"/lrsiem/7.17.0/start-stop-and-restart-job-manager-services","children":[]},{"id":"ci_aac36a61790dabb844687fda5792d2ac762fdd3310719a75129c26ed9019c2aa","title":"Use the Job Manager Configuration Manager","path":"/lrsiem/7.17.0/use-the-job-manager-configuration-manager","children":[]}]},{"id":"ci_2fb2d1c2206d34d5969d7637b887c78f211787e4216838042459e10889a21418","title":"System Management Settings","path":"/lrsiem/7.17.0/system-management-settings","children":[{"id":"ci_64c5cff2e1db7ee82ab1c71b60665f3343b1e77407c5d989ac038266f082e05b","title":"Active Directory Domain Manager","path":"/lrsiem/7.17.0/active-directory-domain-manager","children":[{"id":"ci_2da68ace30f25822ee4aac4f791d728106230c354afb5cafd3210442d789efd2","title":"Add Active Directory Groups as Filters","path":"/lrsiem/7.17.0/add-active-directory-groups-as-filters","children":[]},{"id":"ci_44f325a21c216312a51ce02609f86a83cb35a994adcfbf22ae00d22be05e67f9","title":"Add New Active Directory Domains","path":"/lrsiem/7.17.0/add-new-active-directory-domains","children":[]},{"id":"ci_5141f5aedc6fdf115a3171f5a579a82a170817d719786e960db8f7dbbce64def","title":"Check the Active Directory Synchronization Status","path":"/lrsiem/7.17.0/check-the-active-directory-synchronization-status","children":[]},{"id":"ci_146b5a4ee0129a18b573a2ce7e08a7ef3e92f6e4b0fbbd5d57c4fa64d28c3b6f","title":"Modify Active Directory Domains","path":"/lrsiem/7.17.0/modify-active-directory-domains","children":[]},{"id":"ci_d8ad41b680702a54fa1148f37c86cd40ca31303ff5d69203b989e31a467de1bc","title":"Retire or Activate Active Directory Domains","path":"/lrsiem/7.17.0/retire-or-activate-active-directory-domains","children":[]},{"id":"ci_f12854c2026bbe40d3c53ffe46dd2d70b44480ca4967841871899ddcf07ae88c","title":"Run Active Directory Browser Investigations","path":"/lrsiem/7.17.0/run-active-directory-browser-investigations","children":[]}]},{"id":"ci_ba078cc1cd5e7d1416acfc83ddcf705c38ea7aa576f0841e625c570ca6375b27","title":"Configure Global Maintenance Settings","path":"/lrsiem/7.17.0/configure-global-maintenance-settings","children":[]},{"id":"ci_c6382575022083ef9373001df7518698d4d5fbe6a9cc9f3206e6b10ae2359e50","title":"Set or Modify Data Management Settings","path":"/lrsiem/7.17.0/set-or-modify-data-management-settings","children":[]},{"id":"ci_0ef02e3ebfd01a39f7680ee4b3712786479de04a5cc9322ada92076c16696a1a","title":"Enable Intelligent Indexing Globally","path":"/lrsiem/7.17.0/enable-intelligent-indexing-globally","children":[]}]},{"id":"ci_f4daa5f070cf8981535d9ca7d6d808a5548d1e744981099031efa058e2aaaf67","title":"Update the IP Address of the Platform Manager","path":"/lrsiem/7.17.0/update-the-ip-address-of-the-platform-manager","children":[]},{"id":"ci_d4a8f7294cc9049e71b6838c635e388e8ca79658841cb71effd3637a68c030bb","title":"Use the Platform Manager Configuration Manager","path":"/lrsiem/7.17.0/use-the-platform-manager-configuration-manager","children":[]}]},{"id":"ci_bf0b850c0b0fa865052619e128c365c9a704ecfca8e2f0146a4ae47a3378c525","title":"SmartResponse","path":"/lrsiem/7.17.0/smartresponse","children":[{"id":"ci_1fbfc650b43edf948e88ae504effd9674bc96d6add411bd19bd296134f2eb3f5","title":"Approve or Deny SmartResponse Actions in the Client Console","path":"/lrsiem/7.17.0/approve-or-deny-smartresponse-actions-in-the-client-console","children":[]},{"id":"ci_8782846fb276e744d8e7246665dff99d11e1345d4b3fcc5855c1065005734731","title":"Develop SmartResponse Plugins","path":"/lrsiem/7.17.0/develop-smartresponse-plugins","children":[{"id":"ci_7367173f0189c966ba0e7f63a219e3fa137980221d9b643ff81fb68d2642ef1c","title":"Create the Payload","path":"/lrsiem/7.17.0/create-the-payload","children":[]},{"id":"ci_d176540cbf28ca72e501a242d9b95d12252aaef242b5d09bd5b894d12442fd55","title":"Create the Configuration File","path":"/lrsiem/7.17.0/create-the-configuration-file","children":[]},{"id":"ci_f91d559bbf28e3033408367f68a24af3c4e6ab9edd071fcdda0723115b75da3f","title":"Package and Test the SmartResponse","path":"/lrsiem/7.17.0/package-and-test-the-smartresponse","children":[]},{"id":"ci_86bd531a118aebdc9e68c63923b90b68946ec0488ff37c5a868dfba6da0b26e5","title":"Deploy Custom SmartResponse Plugins","path":"/lrsiem/7.17.0/deploy-custom-smartresponse-plugins","children":[]}]},{"id":"ci_661c55d0b68e95559e63c5a4d20729669dcd4200c18641afcde2fe6476b0bfab","title":"Import SmartResponse Plugins","path":"/lrsiem/7.17.0/import-smartresponse-plugins","children":[]},{"id":"ci_fa7415d418e5e9d36e79040b869b5aee8a4e0998acc584a458926b198b1cc533","title":"Initiate SmartResponse","path":"/lrsiem/7.17.0/initiate-smartresponse","children":[]},{"id":"ci_67595a1a524e4ff43c94f247f64e6199bfea2c49e6641cccf9518b2729db5a14","title":"Preview SmartResponse Command Execution","path":"/lrsiem/7.17.0/preview-smartresponse-command-execution","children":[]},{"id":"ci_10326e259d4bb16429ea651bc108e9500c8e1eeaaed53bb48957c2c19dc65f10","title":"Test SmartResponse Plugin Actions","path":"/lrsiem/7.17.0/test-smartresponse-plugin-actions","children":[]},{"id":"ci_b283263b5d6385f1b16f8f39e0606b1a103485fd7abdf49ff2c2bf3cabd8204c","title":"Troubleshoot SmartResponse Action Testing","path":"/lrsiem/7.17.0/troubleshoot-smartresponse-action-testing","children":[]},{"id":"ci_10808751fbc2e02ef53948aa9e608f36a300a47e5a29d3a291e60ecbd60d3c8a","title":"Validate SmartResponse Plugins","path":"/lrsiem/7.17.0/validate-smartresponse-plugins","children":[]}]},{"id":"ci_4883c007023d12898e7dd3b18c454b575d21798c5f8eeacb22f12c125c2607a0","title":"System Monitor","path":"/lrsiem/7.17.0/system-monitor","children":[{"id":"ci_d4bb4d72d2fc3f9c68dfe631ddac8fff1e3ba1ee29140dfd815a2ed14b2296b4","title":"Agent Identification and Acceptance","path":"/lrsiem/7.17.0/agent-identification-and-acceptance","children":[{"id":"ci_f1fb67b3e85e4e817158901e994bd0adf08ee19f3014420f9525fb6bd5dd5cd1","title":"Accept a New System Monitor","path":"/lrsiem/7.17.0/accept-a-new-system-monitor","children":[]},{"id":"ci_f7e689cc0ccaefc42a337c42e9f821939d1f810fb12f475192e15618148ef239","title":"Associate a System Monitor Agent","path":"/lrsiem/7.17.0/associate-a-system-monitor-agent","children":[]},{"id":"ci_96caa9558f7216ed68f10b748f797752d0ecd634f09327b568f30d53bfb72c99","title":"Work With New System Monitors","path":"/lrsiem/7.17.0/work-with-new-system-monitors","children":[]}]},{"id":"ci_10082dbc0b59278c66ac6d297a46a16f7f07adf3d86fbc3d9375d97ef99a2c1d","title":"NetFlow, IPFIX, and J-Flow Collection","path":"/lrsiem/7.17.0/netflow-ipfix-and-j-flow-collection","children":[{"id":"ci_5bab149cbdcc5f4434d388e21ec02b07b9d6df4841e49359b9567908894f53a7","title":"Configure a Device or Host for NetFlow, IPFIX, or J-Flow Collection","path":"/lrsiem/7.17.0/configure-a-device-or-host-for-netflow-ipfix-or-j-flow-collection","children":[]},{"id":"ci_abef6831b04d03aec2b9fe5e7a266a8178c19b77ff80c3c43dd4f3605bb572d5","title":"Customize IPFIX Logs","path":"/lrsiem/7.17.0/customize-ipfix-logs","children":[]}]},{"id":"ci_d496c638896d573a49717d569e714c95fcd8891171d662228edda53a92d15886","title":"Work With System Monitor Agents","path":"/lrsiem/7.17.0/work-with-system-monitor-agents","children":[{"id":"ci_1b4771d5038084a2ca3d4e763a4a53bb5cf45b7b397bbfd88c4df3162fe8da3b","title":"Add System Monitors","path":"/lrsiem/7.17.0/add-system-monitors","children":[]},{"id":"ci_f3a9502313ccc4ae510928a870d76fa27b8d60da84d0e895b1ae4f9ef8081c19","title":"Configure the scsm Service","path":"/lrsiem/7.17.0/configure-the-scsm-service","children":[]},{"id":"ci_e13c9b5b98a595bd74078d0c64de2f3e68f312fc60124e0e9e4f1a5e8dd068cd","title":"Connect System Monitor Agents to Different Entities","path":"/lrsiem/7.17.0/connect-system-monitor-agents-to-different-entities","children":[]},{"id":"ci_f57af8f219acab40f0e9818c6c29203884d0dbe890370cfc274f51d1abecccd3","title":"Connect System Monitor Agents to New Data Processors","path":"/lrsiem/7.17.0/connect-system-monitor-agents-to-new-data-processors","children":[]},{"id":"ci_2715a0297efc89ec9917f1de2af5c0d465aaad703030286768ff9bbb8f2220ab","title":"Connect System Monitor Agents to Existing Data Processors","path":"/lrsiem/7.17.0/connect-system-monitor-agents-to-existing-data-processors","children":[]},{"id":"ci_de389951805e55b1fa190e75936cf5fbf0669039b1f38ea95cf1eb7d4faa1298","title":"Data Processor Pooling","path":"/lrsiem/7.17.0/data-processor-pooling","children":[{"id":"ci_e63edc1d83b53382354430854d49e94caa1fa3e774e8158f419d9ad341896fca","title":"Data Processor Pool Manager","path":"/lrsiem/7.17.0/data-processor-pool-manager","children":[]},{"id":"ci_8a919d0483c53e13b64d68c18cbaacf9ee237e2d0919386a67cf1a630fb4ad9b","title":"Assign a Data Processor to a DP Pool","path":"/lrsiem/7.17.0/assign-a-data-processor-to-a-dp-pool","children":[]},{"id":"ci_358da74f625bb3d3391f4af9375e4e6f103fa4f81db524e3ab344d2236c12ab9","title":"Remove a Data Processor from a DP Pool","path":"/lrsiem/7.17.0/remove-a-data-processor-from-a-dp-pool","children":[]},{"id":"ci_756dc1ad4aec64f6456d1813f33f3f4828d43215fdc19060248f6510d356e690","title":"Configure a System Monitor Agent into DP Pool Mode","path":"/lrsiem/7.17.0/configure-a-system-monitor-agent-into-dp-pool-mode","children":[]},{"id":"ci_468a44e1d35cb28a024ed333a9d85a1e90a740ef37bcce13f5a4d2cd38dfd6f4","title":"Edit System Monitor Data Processor Settings","path":"/lrsiem/7.17.0/edit-system-monitor-data-processor-settings","children":[]},{"id":"ci_050626068d061fe0092b9d3927401938c17c9f90bad0479d4bc690a483de41ae","title":"Assign a DP Pool to a System Monitor Configuration Policy","path":"/lrsiem/7.17.0/assign-a-dp-pool-to-a-system-monitor-configuration-policy","children":[]}]},{"id":"ci_b6fd21f224ff72842d6d8dd6066208259dbeba03262f1c4180a583eb0a7c6dbb","title":"License System Monitors","path":"/lrsiem/7.17.0/license-system-monitors","children":[]},{"id":"ci_dc13c3492ce836d0e000537af47c4faa6734258309f66b8abdb28b8953cbf8a5","title":"Load Balanced Agent Groups","path":"/lrsiem/7.17.0/load-balanced-agent-groups","children":[{"id":"ci_95e2c64fc83d6248a9a75cca859abaef4200d080adb2a89f22a6238136adce7e","title":"Load Balanced Group Manager","path":"/lrsiem/7.17.0/load-balanced-group-manager","children":[]},{"id":"ci_81e9c234673734ef5651c6bcde7bd68ca23d4d6fbb114ace407dc1138c1cb8af","title":"Assign Agents to a Load Balanced Group","path":"/lrsiem/7.17.0/assign-agents-to-a-load-balanced-group","children":[]}]},{"id":"ci_ac0bc4088c78ab8afffe2772156de4adde1bbb8d61e94956bc36fc38050380bb","title":"Modify System Monitor Basic Properties","path":"/lrsiem/7.17.0/modify-system-monitor-basic-properties","children":[]},{"id":"ci_fdfa94f426c51f234ab4f8f4dd9886645b6c2b17d6565d10cf48def9c828073d","title":"Modify System Monitor Advanced Properties","path":"/lrsiem/7.17.0/modify-system-monitor-advanced-properties","children":[]},{"id":"ci_f1d0b3353a158f86a027f200a30b30346d3f7de9fe96b764a025edd1dfe2305c","title":"Modify Properties of Multiple System Monitor Agents","path":"/lrsiem/7.17.0/modify-properties-of-multiple-system-monitor-agents","children":[]},{"id":"ci_25734ecd8675e4663d95c2c3c0ed8f64aedd65f287e9e5b0d7acf7103d4c6bca","title":"Modify System Monitors","path":"/lrsiem/7.17.0/modify-system-monitors","children":[]},{"id":"ci_a811bfd9f7f664e35c5d11f520ac0e8f2cb8f5b28469901d9969435b27102331","title":"Configure a Secure Syslog Agent","path":"/lrsiem/7.17.0/configure-a-secure-syslog-agent","children":[]},{"id":"ci_667394cd4f24c1c9d386b4b807ecea3dcb1df4ace23ba0f2e4d03c65d971c281","title":"Retire or Activate System Monitor Agents","path":"/lrsiem/7.17.0/retire-or-activate-system-monitor-agents","children":[]},{"id":"ci_525c0ec00a63e874e61aa09822985d97e658f2baf265d9138d28a9e039149d39","title":"Revert System Monitor Agents to Previous Configurations","path":"/lrsiem/7.17.0/revert-system-monitor-agents-to-previous-configurations","children":[]},{"id":"ci_3b6951a0b962e12708e6f6e814f4fc4153d9fbf950fab0e41e5e9312c1c5f421","title":"Startup and Shutdown System Monitors on Linux","path":"/lrsiem/7.17.0/startup-and-shutdown-system-monitors-on-linux","children":[]},{"id":"ci_18467262d1274095944b957cd266639ce5596b739d36aa74858397f819a421b4","title":"Stop, Start, and Restart Agent Services on Windows","path":"/lrsiem/7.17.0/stop-start-and-restart-agent-services-on-windows","children":[]}]},{"id":"ci_e3d325e38808423c7c23b92cb4089f7ac463ee769eec3a84025e411b4ae7782b","title":"Register Agent to Host with Duplicate Name","path":"/lrsiem/7.17.0/register-agent-to-host-with-duplicate-name","children":[]},{"id":"ci_6278be86aaa74094f6f23d24d5a0a886365246727bb24f5b536f75a64ca8981e","title":"sFlow Collection","path":"/lrsiem/7.17.0/sflow-collection","children":[{"id":"ci_1644d73b0e188a16b4f92c73fca7eb16d623a3976caf1e9a56ddb1e924db088e","title":"Configure a Device or Host for sFlow Collection","path":"/lrsiem/7.17.0/configure-a-device-or-host-for-sflow-collection","children":[]}]},{"id":"ci_5513c926870fb9ca817934914a7cccaa9d56974298586ff5707184a9104d1ae0","title":"SNMP Trap Receivers","path":"/lrsiem/7.17.0/snmp-trap-receivers","children":[{"id":"ci_77eb697fa095704e1e81d9bf06ab9bddd7eed1e558349d2b2ebb4f9718129c2c","title":"Configure a System Monitor for SNMP Trap Receiver","path":"/lrsiem/7.17.0/configure-a-system-monitor-for-snmp-trap-receiver","children":[]}]},{"id":"ci_2f8aefaf9e1b378a7d9ac8cb8eb3aff5657390bbeac64b118d500638d762a80b","title":"Syslog Collection","path":"/lrsiem/7.17.0/syslog-collection","children":[{"id":"ci_d7045c38dc4e7b9435c2af7ef37753261032046b2baa57ec575e9172466ade81","title":"Configure a Device or Host for Syslog Collection","path":"/lrsiem/7.17.0/configure-a-device-or-host-for-syslog-collection","children":[]}]},{"id":"ci_02e328ddf4a2bd321a33e5b713228eab1c323e1e903604c80b13c45d8193e862","title":"System Monitor Configuration Policy Manager","path":"/lrsiem/7.17.0/system-monitor-configuration-policy-manager","children":[{"id":"ci_6b9191988762c21bd68848f5d711e66ee35926836c7f5ed506ba0a3d5ff0cb40","title":"Apply System Monitor Configuration Policies","path":"/lrsiem/7.17.0/apply-system-monitor-configuration-policies","children":[]},{"id":"ci_ac63e52730de282c6d371a50207342ef583ac12f5b07e810018b85d09f59e188","title":"Assign Configuration Policies to Multiple System Monitor Agents","path":"/lrsiem/7.17.0/assign-configuration-policies-to-multiple-system-monitor-agents","children":[]},{"id":"ci_977d54162015bccf8f519ecc42794f03d592641225b777ebe8e07911c3b96fa5","title":"Create New System Monitor Configuration Policies","path":"/lrsiem/7.17.0/create-new-system-monitor-configuration-policies","children":[]},{"id":"ci_347946b2d6d79c87921d84852220ad24849a37f4256de471d724e2635b368869","title":"Delete System Monitor Configuration Policies","path":"/lrsiem/7.17.0/delete-system-monitor-configuration-policies","children":[]},{"id":"ci_80527b41545ca53e8fde883e0d9cc0e8d3c92439657deeb42978a6d1c42a02e8","title":"Modify Configuration Policies on System Monitor Agents","path":"/lrsiem/7.17.0/modify-configuration-policies-on-system-monitor-agents","children":[]},{"id":"ci_8999f9b12ded8d11b9995b5e73a42ede483d7d5edee33777e92d1ea48cc75c09","title":"Modify System Monitor Configuration Policies","path":"/lrsiem/7.17.0/modify-system-monitor-configuration-policies","children":[]}]},{"id":"ci_c4224b7469520bbb24d5a28f89d7590c6a86659c530d8b5c8d556008f6142b8a","title":"Unidirectional Windows Agent Settings","path":"/lrsiem/7.17.0/unidirectional-windows-agent-settings","children":[{"id":"ci_21344a51f95051162880a1a09fcf238b726950067e35ad3b51a4bca277c4fa7d","title":"Confirm a SysMon Agent is Sending Logs","path":"/lrsiem/7.17.0/confirm-a-sysmon-agent-is-sending-logs","children":[]},{"id":"ci_4358763bb80dd5e10646c8489f61d694c8ab56614c29ca7335cb5598a1dac212","title":"Copy the System Monitor Agent Configuration File to the Agent Machine","path":"/lrsiem/7.17.0/copy-the-system-monitor-agent-configuration-file-to-the-agent-machine","children":[]},{"id":"ci_e5e019e1371ca900901919b89b852a1e3da73993c0d793bc007e256428133667","title":"Enable the Unidirectional Feature on the Data Processor","path":"/lrsiem/7.17.0/enable-the-unidirectional-feature-on-the-data-processor","children":[]},{"id":"ci_86459cb49a82d4473f07b8896eff20b66d4ecab4cf3d88996df2f5cde3353542","title":"Enable the Unidirectional Feature on the System Monitor Agent","path":"/lrsiem/7.17.0/enable-the-unidirectional-feature-on-the-system-monitor-agent","children":[]},{"id":"ci_7af420cf159e1aa72ac39275c647814e7d45e2525f3e57679d16cdceed449cce","title":"Export the System Monitor Agent's Local Configuration File","path":"/lrsiem/7.17.0/export-the-system-monitor-agent-s-local-configuration-file","children":[]}]},{"id":"ci_c9417c1e2c5bc1253b309189b2cbf677577b4d4e390294caf0d20dfdf6711f49","title":"Windows Event Log Collection","path":"/lrsiem/7.17.0/windows-event-log-collection","children":[{"id":"ci_eb3ea3f0bb4119a7e4558c66210b1610f529696a92e1a01cff2068a31c4093b3","title":"Collect Non-Domain Logs Remotely","path":"/lrsiem/7.17.0/collect-non-domain-logs-remotely","children":[]},{"id":"ci_ea208fd287964d115e1d2038ffad459f456d92a7bde198be17b9df77ec5b550b","title":"Create a Least-Privileged Domain User Account for Remote Log Collection","path":"/lrsiem/7.17.0/create-a-least-privileged-domain-user-account-for-remote-log-collection","children":[]},{"id":"ci_92596a0f9cb0e7d2aa6b4d144e9a21308b7483c82984369d91cc4ae21cfcfb60","title":"Set Up Remote Log Collection","path":"/lrsiem/7.17.0/set-up-remote-log-collection","children":[]}]}]}]},{"id":"ci_9e093e0cac69451e9e0222e2847f8383794c4dead4877fcb4e8a2d126be3e429","title":"Client Console Analyst Guide","path":"/lrsiem/7.17.0/client-console-analyst-guide","children":[{"id":"ci_83fe4b111b4174b6d9cea91a808a591ea62af82cc87a70ec4873177902cb5f86","title":"Filters and Wizards","path":"/lrsiem/7.17.0/filters-and-wizards","children":[{"id":"ci_ad24841dab6c4b8df65405d144e388a2ff6e779fadcf0381cc650d34e4711edc","title":"Use Filter Modes","path":"/lrsiem/7.17.0/use-filter-modes","children":[]},{"id":"ci_763d9bd4638c9e4ccf7f3b2938f42a451edeecce93216eb39f37e2c2b90f9936","title":"Use Lists with Filters","path":"/lrsiem/7.17.0/use-lists-with-filters","children":[]},{"id":"ci_55f67e0336ad0c80cc612ae828c615f9521bd473e1cff581ba427cd20bcc70d3","title":"Use Multiple Filters","path":"/lrsiem/7.17.0/use-multiple-filters","children":[]},{"id":"ci_95545328dcffa486986faa37bcc6ee3d7cc6c5a7268bf3b755ac0b83499ff3a4","title":"Use Multi-Type Filters","path":"/lrsiem/7.17.0/use-multi-type-filters","children":[]},{"id":"ci_f334483911418811ab1c85a187c5d3f8099478cf81d5a3c598b1344a5a8537ca","title":"Use Search Strings with Filters","path":"/lrsiem/7.17.0/use-search-strings-with-filters","children":[]},{"id":"ci_f0f346af3efedcbd167bb88aaa5a5b34be92bc465b009b554008be1501392147","title":"Use SQL Pattern Match with Filters","path":"/lrsiem/7.17.0/use-sql-pattern-match-with-filters","children":[]},{"id":"ci_5be6a45a9d5ebde4fa9a8c9cb59bc74690360fb7830d9d65a426e58373635495","title":"Use the Filter Editor","path":"/lrsiem/7.17.0/use-the-filter-editor","children":[{"id":"ci_9170c911ddc224b5c3e7fed1a468033d1275d3eccc89c1284ce1daf3850bf51c","title":"Filters—Action","path":"/lrsiem/7.17.0/filtersaction","children":[]},{"id":"ci_e5f12705d1240f6dcf40a762c1152b6684d939e584488f9ffc4795d9f34dd9ec","title":"Filters—Aggregation","path":"/lrsiem/7.17.0/filtersaggregation","children":[]},{"id":"ci_a6a2a93ad98389c7057583ca6902b91676ff3dbd5797d6de7a18a842fb0704f0","title":"Filters—AIE Summary Fields","path":"/lrsiem/7.17.0/filtersaie-summary-fields","children":[]},{"id":"ci_21811c6a2aca5432b60a584ad06eb9510772e408057ca4ab86540fe30edabce8","title":"Filters—Data Fields","path":"/lrsiem/7.17.0/filtersdata-fields","children":[]},{"id":"ci_62d1f46af0b513f3e2da5d226e79afe070efe35630458571fb3d4b3838be7b07","title":"Filters—Day and Time Criteria","path":"/lrsiem/7.17.0/filtersday-and-time-criteria","children":[]},{"id":"ci_56b0c3f500d2dba026834fdf9749f0a03b223b2fd7875cf3fc613c6aee6531c0","title":"Filters—Distinct","path":"/lrsiem/7.17.0/filtersdistinct","children":[]},{"id":"ci_60384f3396910afa87e757a564c5ce0df4daaa75f3c69ec38508126466193c32","title":"Filters—Exclude Filter","path":"/lrsiem/7.17.0/filtersexclude-filter","children":[]},{"id":"ci_c70b9cb2ba0c313ac9f72d6bd6933c4f396219684dc812095b74f3929a965d2c","title":"Filters—Expressions","path":"/lrsiem/7.17.0/filtersexpressions","children":[]},{"id":"ci_fdb1645bff849736aff159a0c07c3d6af70683c52d0d86bae99c9a8d0adf2f4c","title":"Filters—Group By","path":"/lrsiem/7.17.0/filtersgroup-by","children":[]},{"id":"ci_a9aec3dd6ee3ed133cca3fd8601ae30d3c3b58bd7be7c995a10f527a33afc836","title":"Filters—Include Filter","path":"/lrsiem/7.17.0/filtersinclude-filter","children":[]},{"id":"ci_76587c7f9438686d9b51756cae8f60fe3f9de2c35267fb52ed75470e779e0d91","title":"Filters—Information","path":"/lrsiem/7.17.0/filtersinformation","children":[]},{"id":"ci_29dbc72201b52ce0d258e3686eb0103767e051220dc4794432c7e9e60366f748","title":"Filters—Log Source Criteria","path":"/lrsiem/7.17.0/filterslog-source-criteria","children":[]},{"id":"ci_099ecdac4c8945817e9e2407973828d2a6c93514d00fad6c37b0e20694372203","title":"Filters—Notify","path":"/lrsiem/7.17.0/filtersnotify","children":[]},{"id":"ci_14d7651769825f8e9d491dcaab55e14e7ebf3690952ec48fb60d3117420c6c0b","title":"Filters—Primary Criteria","path":"/lrsiem/7.17.0/filtersprimary-criteria","children":[]},{"id":"ci_3361db5107848375caac8f8b5dbe7c88c8ac0db6accdf0592908bc91b90f1c04","title":"Filters—Profile","path":"/lrsiem/7.17.0/filtersprofile","children":[]},{"id":"ci_ac44770a4f60dcf412fae95737595d00733b3b587d701b15caca36ef9d6acdae","title":"Filters—Schedule","path":"/lrsiem/7.17.0/filtersschedule","children":[]},{"id":"ci_cc4095df2ff7f9885eba18933f05f7edeb32de37a26177eb3b0edf9f732751a7","title":"Filters—Settings","path":"/lrsiem/7.17.0/filterssettings","children":[]},{"id":"ci_0066ed0afc304efd135859f59ca6b5d373cadff8dedaa7a0c2ee182adef01476","title":"Filters—Thresholds","path":"/lrsiem/7.17.0/filtersthresholds","children":[]},{"id":"ci_1497d16f4907712d13a6c2a2741f1c45b06698fa44eb5a062539c0aceb8b980c","title":"Filters—Time and Schedule","path":"/lrsiem/7.17.0/filterstime-and-schedule","children":[]},{"id":"ci_82a4d589ba8021eec7d654c1392173eee60be686640329b3e44c135c12a189a6","title":"Filters—Unique Values","path":"/lrsiem/7.17.0/filtersunique-values","children":[]}]}]},{"id":"ci_2b51f6ab28e1c3e9266fd4604cea686caeadee8c8d8c2b7f28f836e732471c84","title":"General Console Features","path":"/lrsiem/7.17.0/general-console-features","children":[{"id":"ci_ceb02eaeadf4ed9e50e31c67e3cd5f7210814b96916c0a4b1fd82b70e89fe44b","title":"Export Grid to File","path":"/lrsiem/7.17.0/export-grid-to-file","children":[]}]},{"id":"ci_70b3b1f088c2980b94c201af8bf5355f29cc0bcbe145c6ef10b4f0d1598ceb02","title":"Layouts","path":"/lrsiem/7.17.0/layouts","children":[{"id":"ci_528a67c068bf6bc3acd7975336643e5196148d926a9f75cf31d33be38de5e052","title":"Clone Existing Layouts","path":"/lrsiem/7.17.0/clone-existing-layouts","children":[]},{"id":"ci_3f11dab63473831f243769d5032a0242b90df2680baff66f85a83180b8d38f19","title":"Create New Layouts","path":"/lrsiem/7.17.0/create-new-layouts","children":[]},{"id":"ci_1ebf8f5407e4720ea84db84a99c315af1131b058d0052bc3208bdb5c6fe8b92f","title":"Delete Layouts","path":"/lrsiem/7.17.0/delete-layouts","children":[]},{"id":"ci_0d39cb4fbab34c6864252bf26e0e193b1f958ec7b020b3f98b031d7282c96ee3","title":"Import and Export Layouts","path":"/lrsiem/7.17.0/import-and-export-layouts","children":[]},{"id":"ci_351ee8c86987de0d62a9fb6bee743f145e028128344cb3e028e4ac9fc7f0ce02","title":"Make or Clear Default Layouts","path":"/lrsiem/7.17.0/make-or-clear-default-layouts","children":[]},{"id":"ci_2f9468308a5862f7f2338aa30b115b8c96a5f9f6ba23d7789d93f050fed81f8e","title":"Modify Layout Properties","path":"/lrsiem/7.17.0/modify-layout-properties","children":[]},{"id":"ci_493c2c61255e3288d740482e74219b722822078db0ecb34c407724cd72dfe80e","title":"Reset Layouts","path":"/lrsiem/7.17.0/reset-layouts","children":[]},{"id":"ci_f47d98591a2faf23b59b3d7cdd1ce0b9e3c59261971c75a9240452a698bf6856","title":"Save Layouts","path":"/lrsiem/7.17.0/save-layouts","children":[]},{"id":"ci_11bf5302ed66dc67f028467ec4d62aaf7b813deaab1c48101c2d7de4e5d68c30","title":"Set Color Themes in Layouts","path":"/lrsiem/7.17.0/set-color-themes-in-layouts","children":[]}]},{"id":"ci_95d6bfe72ae97dec36dde3aba9bd38141096ef5e208c148395c5299c6d467c39","title":"Lists in the Client Console","path":"/lrsiem/7.17.0/lists-in-the-client-console","children":[{"id":"ci_e250507684cad3b03a0fbffa2822299f0185fa4c676da36440d89fda1f44f8ce","title":"Add Expiring Items to a List","path":"/lrsiem/7.17.0/add-expiring-items-to-a-list","children":[]},{"id":"ci_1cf9c3e9bb34075440b94c45ef32f8c25f0178653aedf4a5c57a386b2271a80a","title":"Add Values to a List","path":"/lrsiem/7.17.0/add-values-to-a-list","children":[]},{"id":"ci_5d00cc90d76df41689fcf37e6a2f09dbaa0192a5b4a56821a4328cd862e8006f","title":"Clone Lists","path":"/lrsiem/7.17.0/clone-lists","children":[]},{"id":"ci_831b50dc8df9c375e8938554dd88135305bf18805829da6c67a6b6f7bfefca83","title":"Create Lists in the Client Console","path":"/lrsiem/7.17.0/create-lists-in-the-client-console","children":[]},{"id":"ci_351ea9c508f3ca575105504bb32d6a59a006ee4c59467d0f809b4c03443148bb","title":"Modify the Properties of Lists","path":"/lrsiem/7.17.0/modify-the-properties-of-lists","children":[]},{"id":"ci_e5cfb6dc5d9481f8d641708300af794123cf828f88ae40c4cffcfa15ff4a83d6","title":"Remove List Items","path":"/lrsiem/7.17.0/remove-list-items","children":[]},{"id":"ci_402969703b4dc6bc76ac901ff18c7a0ad60ce0de146eb7baae2a16150ba72423","title":"Reset Expiration Date for List Items","path":"/lrsiem/7.17.0/reset-expiration-date-for-list-items","children":[]}]},{"id":"ci_e465b7fc451847834248a0a519e3665b28f9e5d255a09c086a5e61057a48fb37","title":"Message Processing Engine Rule Builder","path":"/lrsiem/7.17.0/message-processing-engine-rule-builder","children":[{"id":"ci_1b6966cbc06ba7e8bdbd287018de27e8825d83fa57eff5d613ed520a60ff62ff","title":"Application Manager","path":"/lrsiem/7.17.0/application-manager","children":[{"id":"ci_b13f45e556ad23d65dd4dec96de4fa75df4600c319fbd377848ad4f737547e74","title":"Create New Application Records","path":"/lrsiem/7.17.0/create-new-application-records","children":[]},{"id":"ci_885e203da997868f38efd899af94b89e95b8cea33ea8cbec4795d2bca0d849fc","title":"Modify Application Record Properties","path":"/lrsiem/7.17.0/modify-application-record-properties","children":[]},{"id":"ci_2f5ba72880820efda36f75bfe705d73950d11db8747468bc209fad5ecd605d66","title":"Refresh the Application Manager","path":"/lrsiem/7.17.0/refresh-the-application-manager","children":[]},{"id":"ci_fde113106f9500247a45c69a491dbe0539c913cab1ff114afc42f7600b516066","title":"Retire or Activate Application Records","path":"/lrsiem/7.17.0/retire-or-activate-application-records","children":[]}]},{"id":"ci_aba7ef89d47bee0aa9e4c5a54f4e72c62cbbd22a1e3ccd7d81e21b403ef80925","title":"Common Event Manager","path":"/lrsiem/7.17.0/common-event-manager","children":[{"id":"ci_883c2c6e5e72a4c9949f3f73224a3e744124a96fc11e0360432995a59c0fd6b8","title":"Create Common Events","path":"/lrsiem/7.17.0/create-common-events","children":[]},{"id":"ci_8e891cfa6e875b828e25aaa2e8c70f813267e94ad93e693907d01fdaaf641c29","title":"Delete Common Events","path":"/lrsiem/7.17.0/delete-common-events","children":[]},{"id":"ci_fe05aa0d0eee6950a5aba7812ed2863fedbf4cd29902ab5dc69b89666964bab0","title":"Modify Common Events","path":"/lrsiem/7.17.0/modify-common-events","children":[]},{"id":"ci_c819b6c209b86139d594748762a15493372fefce3ac9eee3fa37c2d54639d0d8","title":"Search for Common Events","path":"/lrsiem/7.17.0/search-for-common-events","children":[]}]},{"id":"ci_d596b31a22e7204cc9e485cfb96081644ce314cfa7a386bb5f3aa34c7455b475","title":"Create Custom MPE Sub-Rules","path":"/lrsiem/7.17.0/create-custom-mpe-sub-rules","children":[]},{"id":"ci_689582b32a8194aa9e7c2d51349c2cea44fd0ba7c0990a472fb7321ffa73a53d","title":"Create MPE Policies","path":"/lrsiem/7.17.0/create-mpe-policies","children":[]},{"id":"ci_c7aba5d1ca2b0f78bf78410f3c780f2b6d9b967995d9cd4059db68ab55510932","title":"Create New Base MPE Rules","path":"/lrsiem/7.17.0/create-new-base-mpe-rules","children":[]},{"id":"ci_5f32f7ef8e6fc5992ba86d05a0ca94f8112943061b3c57033823942691839cdf","title":"Edit MPE Rules","path":"/lrsiem/7.17.0/edit-mpe-rules","children":[]},{"id":"ci_2187b96544453740dac1e20f736ed27c47e92bb9a6d53b7fbc8df77369133619","title":"Edit Sorting Properties for System Base MPE Rules","path":"/lrsiem/7.17.0/edit-sorting-properties-for-system-base-mpe-rules","children":[]},{"id":"ci_85779e1675cf8080cae046c79cac9316dd74738a8dde686e93e619edb265de4d","title":"Import and Export MPE Rules","path":"/lrsiem/7.17.0/import-and-export-mpe-rules","children":[]},{"id":"ci_67f27ec3fb270ba4e625f289c0d9bdc0b0c577f11646a0c6e9d2f8f6b91a1da9","title":"Regular Expression Characters and Practices","path":"/lrsiem/7.17.0/regular-expression-characters-and-practices","children":[]}]},{"id":"ci_0d8029a4fc5dcf47d319c197ed95145d84c233c441c6ebbd63a641b58a20a29e","title":"Monitor, Search, and Analysis","path":"/lrsiem/7.17.0/monitor-search-and-analysis","children":[{"id":"ci_74e8ad6de3fd141d16075ff6ef3b005f5d00e0a8b7f127b74e8788d6566ca4d8","title":"Alarm Viewer","path":"/lrsiem/7.17.0/alarm-viewer","children":[{"id":"ci_faf6c10acb411cc928f38a5c6c91be83c16cc5fde50b8aff8f43dd1aa860345c","title":"Change the Status of a Single Alarm","path":"/lrsiem/7.17.0/change-the-status-of-a-single-alarm","children":[]},{"id":"ci_34a686357b2702ed802c00b31967b85a365b029758a27d069b72971e6c4dd425","title":"Change the Status of Multiple Alarms","path":"/lrsiem/7.17.0/change-the-status-of-multiple-alarms","children":[]},{"id":"ci_8c9e99599144abd06535656c34eb8f1936a813cee561caa4242c75e5e9b00bdc","title":"Create Alarm Lists","path":"/lrsiem/7.17.0/create-alarm-lists","children":[]}]},{"id":"ci_9e5c6493358ce94584f7d85fbbf911ada21be552744a06aa73d749208651ecb1","title":"Investigator","path":"/lrsiem/7.17.0/investigator","children":[{"id":"ci_3898bc7f52c3a3098f746a8b64ffda4f4470bdbc853965d03a995670d79de6e7","title":"Change Share Permissions on a Saved Investigation","path":"/lrsiem/7.17.0/change-share-permissions-on-a-saved-investigation","children":[]},{"id":"ci_fef057fd33373c8e12c74257d674d6b344130cbe84edddd50f9181e8b9025bc9","title":"Create Investigations","path":"/lrsiem/7.17.0/create-investigations","children":[]},{"id":"ci_ab11252ee4d53434f311f44d2d5a4c146b1aed1c430e68fa7845c1fd046071e0","title":"Drill Down on a Single Item in Investigation Results","path":"/lrsiem/7.17.0/drill-down-on-a-single-item-in-investigation-results","children":[]},{"id":"ci_514b9ad8ced9d8fe66cb8bf42a0be27600cf76e4d3dcc1702d483808d7fb94de","title":"Drill Down on Multiple Items in Investigation Results","path":"/lrsiem/7.17.0/drill-down-on-multiple-items-in-investigation-results","children":[]},{"id":"ci_2bdddba79181bd09a0b1f5edd73e91807524402284b4ecea791108f1d6fd6999","title":"Import and Export Investigations","path":"/lrsiem/7.17.0/import-and-export-investigations","children":[]},{"id":"ci_36592b0fa595f3cf64637f2591314d2b3fe38e7814cdc6f05906f47eeab7f1d2","title":"Run Saved Investigations","path":"/lrsiem/7.17.0/run-saved-investigations","children":[]},{"id":"ci_f4415fd8ee6c766af97df1714aae53f7555aa4ef10c9e509d31bd20a4778a597","title":"Save Investigations with Report Packages","path":"/lrsiem/7.17.0/save-investigations-with-report-packages","children":[]},{"id":"ci_4a3526859740e85b4c58bbc8e9597858f7226bf2688a36c4031d8021b7717a92","title":"Save Investigations with Report Templates","path":"/lrsiem/7.17.0/save-investigations-with-report-templates","children":[]},{"id":"ci_bf8f428dfcce8bd29c218295be7affb554455b10cc61027707da0a44db2650f5","title":"Search for Most Frequent Common Events","path":"/lrsiem/7.17.0/search-for-most-frequent-common-events","children":[]},{"id":"ci_870ad807fbd4c0dae1f1a7c31ea19045cb91841d64fef606962ad04866fc2028","title":"View Metadata in the Log Viewer Tab","path":"/lrsiem/7.17.0/view-metadata-in-the-log-viewer-tab","children":[]},{"id":"ci_5f254569de324b5b99b3d24708a2bf6285849b4fca580e24ae7760f0fe1c84de","title":"Work With Investigation Result Graphs","path":"/lrsiem/7.17.0/work-with-investigation-result-graphs","children":[]},{"id":"ci_d6dac247b94e23f4b8c42c1696644a0186c79352d15f93f3c24fcac10727337a","title":"Work with Log Miner","path":"/lrsiem/7.17.0/work-with-log-miner","children":[]},{"id":"ci_0dc09b9df6bb779040bdcf59ceb2bed7245b36d280cac6bcd4d665908f8da448","title":"Work With Network Visualization Diagrams","path":"/lrsiem/7.17.0/work-with-network-visualization-diagrams","children":[]}]},{"id":"ci_453fca564b8128868d44456b170938c4193935a79ae84b8f0d460d9eb1d7807e","title":"Personal Dashboard","path":"/lrsiem/7.17.0/personal-dashboard","children":[{"id":"ci_3491271a976c5d37bb653711dea5ddcd4add4d2a68549b7e0fe22361341ceb3b","title":"Add Personal Dashboard Filters","path":"/lrsiem/7.17.0/add-personal-dashboard-filters","children":[]},{"id":"ci_d7518221a55d69820b66491af7df3eee0d95c3a7276258222e793deee7851c91","title":"Apply Personal Dashboard Filters","path":"/lrsiem/7.17.0/apply-personal-dashboard-filters","children":[]},{"id":"ci_5ab5bfea5bf4d80a1eee62f3d582017d6426c4d7526433a1ce1bbcd32e329624","title":"Clone Personal Dashboard Filters","path":"/lrsiem/7.17.0/clone-personal-dashboard-filters","children":[]},{"id":"ci_a2208f63362a93b3423ec513ab88ad761586110381d243a6171bb69217bf86b3","title":"Configure the Personal Dashboard Display","path":"/lrsiem/7.17.0/configure-the-personal-dashboard-display","children":[]},{"id":"ci_b651fcd6c032d491a57c8535dd4ff66bc29e54fcd80f4288ab5d6e3949332775","title":"Delete Personal Dashboard Filters","path":"/lrsiem/7.17.0/delete-personal-dashboard-filters","children":[]},{"id":"ci_48cae64cd62b48ce21374e609edff632d68189a635e305ccdd2528cc2e429c19","title":"Drill Down on Dashboard Data","path":"/lrsiem/7.17.0/drill-down-on-dashboard-data","children":[]},{"id":"ci_3176d218d4621e242f3a786dafbb0e69165e9cfdd9f2d81dfc2e9d55e1fa6649","title":"Modify the Properties of Personal Dashboard Filters","path":"/lrsiem/7.17.0/modify-the-properties-of-personal-dashboard-filters","children":[]}]},{"id":"ci_7ba6cf22b763832d6f736ce6a6823170151b4cb21cec714fddfb6f1057e1a402","title":"Quick Search Toolbar","path":"/lrsiem/7.17.0/quick-search-toolbar","children":[{"id":"ci_91dbf07c3c5ade15f3f6d6fc320ad444d766164bd4dcdae33063829967348d0b","title":"Use the Quick Search Toolbar","path":"/lrsiem/7.17.0/use-the-quick-search-toolbar","children":[]}]},{"id":"ci_35941f6a910bfb04d18da25deca89229f0d9fa06bfe9f7ae0ea049f19117239f","title":"Run Contextualize","path":"/lrsiem/7.17.0/run-contextualize","children":[]},{"id":"ci_e6a88360d2f9ba6e79916f95f365787f6122a3f96ea365dd330e77d5350a34fd","title":"Run Correlate","path":"/lrsiem/7.17.0/run-correlate","children":[]},{"id":"ci_c9af9d2c228ccd96e45a74954866eacf8a4e2006fb626a9b16956781bb400039","title":"Tail","path":"/lrsiem/7.17.0/tail","children":[{"id":"ci_341c0f8653769d6505ca0031ebd0c7b968e48314d9051848a15451212d98023a","title":"Create New Tails","path":"/lrsiem/7.17.0/create-new-tails","children":[]},{"id":"ci_11a0eb15fcd0d44b82ccc2f281d440f98656cc04251419abcd556c62080cad5c","title":"Run Saved Tails","path":"/lrsiem/7.17.0/run-saved-tails","children":[]},{"id":"ci_bc76a35de272166d150e6fdec1adb3e717b44e4c1038be496d75bf8e9da1dad1","title":"Tail Log Sources","path":"/lrsiem/7.17.0/tail-log-sources","children":[]}]},{"id":"ci_8d927ac06225058e3acc12229b0f4aaadec8d8b8016fef6c00f8d1efb1a6445a","title":"TopX Analysis","path":"/lrsiem/7.17.0/topx-analysis","children":[{"id":"ci_f29e2ba08a3e3f932abd9aeaf7ff1c467db9c7b07e7c27466a12632842cb5718","title":"Analyze TopX Results","path":"/lrsiem/7.17.0/analyze-topx-results","children":[]},{"id":"ci_2b37b1b0fd922a9f93655a4157eb02df3645b669ca6aa44b4a759d438e96b621","title":"Configure TopX Widgets","path":"/lrsiem/7.17.0/configure-topx-widgets","children":[]}]}]},{"id":"ci_bd810bbbbf1c25691a23c6c97a990896885802c637ca0e6c4f3c250e95e9bd5d","title":"My LogRhythm","path":"/lrsiem/7.17.0/my-logrhythm","children":[{"id":"ci_3e8a18b510ece49d7985d254f193dafa838cd19ad2d12bb2672d12d5dfd8c6e6","title":"Add or Modify a Person Record","path":"/lrsiem/7.17.0/add-or-modify-a-person-record","children":[]},{"id":"ci_3ba668dd5a09e79cf310ad5fb0f2736f6450594563efcb5d11165107d489e262","title":"Change Your Password","path":"/lrsiem/7.17.0/change-your-password","children":[]},{"id":"ci_9a6ab100e8e45847aa79870de0204dbcc42895969baabee977cd06d435d5e3d7","title":"Create Email Notification Policies","path":"/lrsiem/7.17.0/create-email-notification-policies","children":[]},{"id":"ci_bef811343eb46cc5c66bfc6a7d93f8ae25dc165dd012d7d76e95d068c848e895","title":"Manage Your Preferences","path":"/lrsiem/7.17.0/manage-your-preferences","children":[]}]},{"id":"ci_5457922cae53f5bc8b6e3768d558d06a5ae790f725497817260def0b0c51a2af","title":"Report Center","path":"/lrsiem/7.17.0/report-center","children":[{"id":"ci_d40df955accae26172eaf33043eca68c349d9adae01bef01b83712c4f16976c9","title":"Add Custom Logos to Reports","path":"/lrsiem/7.17.0/add-custom-logos-to-reports","children":[]},{"id":"ci_b1c1ad7898b3b20d6fb48e947a3f89e7bd549e6c39ede28742f08020ba937671","title":"Clone Reports or Report Packages","path":"/lrsiem/7.17.0/clone-reports-or-report-packages","children":[]},{"id":"ci_4a685bb09560fc9302e22401dc8e4c270e51a5575bbd04befd57d8b9c24d4f6d","title":"Create Custom Log Detail Report Templates","path":"/lrsiem/7.17.0/create-custom-log-detail-report-templates","children":[]},{"id":"ci_b12d522191db3e79fefad7784b121ca67e4a82efc6b7455b50b42942b6a4c574","title":"Create Custom Log Summary Report Templates","path":"/lrsiem/7.17.0/create-custom-log-summary-report-templates","children":[]},{"id":"ci_a72a103e5276e67908069c97cf1c46518a070be8002fad51693ed697f5d08586","title":"Create Report Packages","path":"/lrsiem/7.17.0/create-report-packages","children":[]},{"id":"ci_fe8ce23110b6d6e3ee955852f03d8de2578184ffdee5ba608a7d9678f4a40977","title":"Create Reports","path":"/lrsiem/7.17.0/create-reports","children":[]},{"id":"ci_1b3497567d75cfb4a72bd502eb3d49d17f45b4b2093dac203c06ec8f926ecb1a","title":"Create Scheduled Reports","path":"/lrsiem/7.17.0/create-scheduled-reports","children":[]},{"id":"ci_2aa816c845fd6a10c347a86e65c1a601a4909bf712f36256efc51e480ebbe104","title":"Import or Export Reports or Report Packages","path":"/lrsiem/7.17.0/import-or-export-reports-or-report-packages","children":[]},{"id":"ci_eaeaf966c4f85edd10dcd80054e94340d9d95ed452d72f0dc05948eb802b700c","title":"Manage Scheduled Reports","path":"/lrsiem/7.17.0/manage-scheduled-reports","children":[]},{"id":"ci_85d18e0c49eb676051cf0531aa29dbae7684161b886a890b13291a83fd23e654","title":"Modify Custom Report Templates","path":"/lrsiem/7.17.0/modify-custom-report-templates","children":[]},{"id":"ci_de48c3feb14b48a26e40f2d13fa4a7e6d74281d84a685f25c4c217f50fe6b7ee","title":"Restore Default Logo to a Report","path":"/lrsiem/7.17.0/restore-default-logo-to-a-report","children":[]},{"id":"ci_c54f772ad8046e5ad0835b80cea038b59f779e1ccd43c2e0ca4090f968d71cc0","title":"Run Reports","path":"/lrsiem/7.17.0/run-reports","children":[]},{"id":"ci_78cade3ab2e6b7ed0062843221ac40e357fecae60278c21e30cb554b2a506e3b","title":"Run Reports as Investigations","path":"/lrsiem/7.17.0/run-reports-as-investigations","children":[]},{"id":"ci_b3d9a1fe0948dbb694e84ca398332930107d0a3f61455e57be6cfaea19dd518f","title":"Troubleshoot Empty Reports","path":"/lrsiem/7.17.0/troubleshoot-empty-reports","children":[]},{"id":"ci_8b65afcec2727c4c48549e4bcca4a68fb985c4ab87fa237289a4c65180badb9e","title":"View Report Center Job Status","path":"/lrsiem/7.17.0/view-report-center-job-status","children":[]},{"id":"ci_5f5408bec332f482f81548ab1549276190db260ff81f03f719bc050df6695bbf","title":"View Reports in the Client Console","path":"/lrsiem/7.17.0/view-reports-in-the-client-console","children":[]}]}]},{"id":"ci_1495811b7e057b5475dce0222c99c419f2d48eb5d0e45718a4f15d587f90cb56","title":"Web Console User Guide","path":"/lrsiem/7.17.0/web-console-user-guide","children":[{"id":"ci_0a89feb68153c7b2302698620463d88f2c08fb5c4db6b95e868f2c4ab8666ca7","title":"Alarms","path":"/lrsiem/7.17.0/alarms","children":[{"id":"ci_2e397465d08ec3e3123cd4ecd4e66454a748001065220dc9ed47ef50d575cba9","title":"Alarms Page Overview","path":"/lrsiem/7.17.0/alarms-page-overview","children":[{"id":"ci_81cf13cf9f3018fbfe115f135f7e28904562a1e3188349cfe713a47c0968e797","title":"Alarm Cards","path":"/lrsiem/7.17.0/alarm-cards","children":[{"id":"ci_ede6f3d1db96929875840593b8e677463688d2c569513c39be22d99e9fa8b42d","title":"Sort Alarm Cards","path":"/lrsiem/7.17.0/sort-alarm-cards","children":[]}]},{"id":"ci_d1516eeb92962a305d34edb19571bd22e38b9a0ea5b038368b8da2b4b240ceb8","title":"Alarm Grid","path":"/lrsiem/7.17.0/alarm-grid","children":[{"id":"ci_5063f609e037cbc8576a86c5ede19bc3ffef902b0b612907e6c28da2c8ff4c4e","title":"Pin and Resize Alarm Grid Columns","path":"/lrsiem/7.17.0/pin-and-resize-alarm-grid-columns","children":[]}]},{"id":"ci_ddcce9fe2ec11876b104293f0a0bb8fc2789c373480e8b808ff8f2850feefa7e","title":"Alarm Status Trends","path":"/lrsiem/7.17.0/alarm-status-trends","children":[]}]},{"id":"ci_65d7f06d655af4a4dbef294716f1ba9764370684c091dca159edb284d1f1497f","title":"Alarm Filters","path":"/lrsiem/7.17.0/alarm-filters","children":[{"id":"ci_21936a8c0986d73713119229887c14594a87c486eb97f3be6020cc050e2b72da","title":"Remove Alarm Filters","path":"/lrsiem/7.17.0/remove-alarm-filters","children":[]},{"id":"ci_9d5988da904b21df957e10f6b10e7d40abbf389d3af581331e65ed062a0b70e3","title":"Use Status, Entity, Risk, Notification List, and Alarm ID Filters","path":"/lrsiem/7.17.0/use-status-entity-risk-notification-list-and-alarm-id-filters","children":[]},{"id":"ci_460ccd16b1c901657d8755c6d0422c3f06da00146026d68b67526039425ef16a","title":"Use the Time Frame Filter","path":"/lrsiem/7.17.0/use-the-time-frame-filter","children":[]}]},{"id":"ci_4d8db8a0b2e35f0a88e98520f907e6be8eda6730ed7800c59d8b79890d473688","title":"Add Comments to Alarms","path":"/lrsiem/7.17.0/add-comments-to-alarms","children":[]},{"id":"ci_da772318bda1e151d5aec198577e4faccb603b65e85667c5ac6d2106b70437cb","title":"Approve or Deny SmartResponse Actions in the Web Console","path":"/lrsiem/7.17.0/approve-or-deny-smartresponse-actions-in-the-web-console","children":[]},{"id":"ci_8218a90d319ab1c4b7f852afe16adc164362ac195d4dce5350c84e9d3e1d751c","title":"Drill into Log Data Associated with an Alarm","path":"/lrsiem/7.17.0/drill-into-log-data-associated-with-an-alarm","children":[]},{"id":"ci_cde3796f9a19c9aff8248cad30ae9a18301f6cee0f9da570bc71e343afcae4d9","title":"Update the Alarm Status","path":"/lrsiem/7.17.0/update-the-alarm-status","children":[]},{"id":"ci_b05aea6ee0ad8973ebfbcbf90126f1417787f888847f6eef68ad260331af296c","title":"View Alarms in Your Browser","path":"/lrsiem/7.17.0/view-alarms-in-your-browser","children":[]},{"id":"ci_3775b290f2a714ab0d6942fb1484163e823f23f0d8ca050d2b326c15963cb681","title":"View Additional Alarm Information","path":"/lrsiem/7.17.0/view-additional-alarm-information","children":[]}]},{"id":"ci_c2eacc5540e2653bed9a4666a38607fb947ff509b7ed2a6c5e708e36be4febc1","title":"Analyzer Grid","path":"/lrsiem/7.17.0/analyzer-grid","children":[{"id":"ci_a24c75334fe638bc0ede2aaa361522bec7ed3c9bfa0abb4ff9fd16f6849ef04d","title":"Use the Analyzer Grid","path":"/lrsiem/7.17.0/use-the-analyzer-grid","children":[]},{"id":"ci_a8ec0fe0531c3fc3ab6e6356f3cd3977ded5f1afafe920f8bf1fa543187c88fd","title":"Configure the Analyzer Grid","path":"/lrsiem/7.17.0/configure-the-analyzer-grid","children":[]},{"id":"ci_e08b57de7c9d820727ac98b755266e8a3a454b2e020cbac1b78ad5501fc80c90","title":"Details & Actions Panel","path":"/lrsiem/7.17.0/details-actions-panel","children":[]},{"id":"ci_5bf44ead1dbf62d199c3153b80525e48d23ccd6eb1f460d7d3ca32168849c9a8","title":"Export Log Data into a CSV File","path":"/lrsiem/7.17.0/export-log-data-into-a-csv-file","children":[]},{"id":"ci_f1e89cd14854621866752fab77aa419e2dc092b7cf62e98cc31c8a16c3b116f4","title":"Inspector Panel","path":"/lrsiem/7.17.0/inspector-panel","children":[{"id":"ci_7970175a749bab0ef57d5799829b5dc7c260d66ed769a0fd98224c7e2504e597","title":"Integrate with LogRhythm UEBA (formerly CloudAI)","path":"/lrsiem/7.17.0/integrate-with-logrhythm-ueba-formerly-cloudai","children":[]},{"id":"ci_5b27bfd2fad2d1daf22d4a26d9ed38d796193656666a5df096c018a4213a0608","title":"Use Contextualize","path":"/lrsiem/7.17.0/use-contextualize","children":[]},{"id":"ci_a8c4d68e46ce82d4472dbfa0c1907144a52a8207a182e72d58cf0d2b97e4bb19","title":"Configure Third-Party Contextualize Actions","path":"/lrsiem/7.17.0/configure-third-party-contextualize-actions","children":[]},{"id":"ci_3be33fcbcd1cad024775d1261332937378c5d369eab7c7f0aca24f00e153a3b1","title":"Use SmartResponse","path":"/lrsiem/7.17.0/use-smartresponse","children":[]},{"id":"ci_a9c371212aa0f56c251e57a8b0c2ba5193c9531366f4be4763e9ba7b5c82193c","title":"Use the AI Engine Rule Viewer","path":"/lrsiem/7.17.0/use-the-ai-engine-rule-viewer","children":[]},{"id":"ci_0f71fefa0adea8afdef41acc9e938cf5a47f832ab4c286b917d31b0bc925cb78","title":"Use Threat Intelligence Service Integration","path":"/lrsiem/7.17.0/use-threat-intelligence-service-integration","children":[]}]}]},{"id":"ci_9f25caf69ef546bee1729c77427862979f336aa82229de82a7520592212718a2","title":"Case Management","path":"/lrsiem/7.17.0/case-management","children":[{"id":"ci_6155d31aaef62db000e29108e490ad9721db83f666135aee78fdbd6d3c023c10","title":"Case Cards","path":"/lrsiem/7.17.0/case-cards","children":[]},{"id":"ci_494f16eb0e25275a3653bc39298b68ab9174f5a4432616d6c4da26171434777a","title":"Case History Widgets","path":"/lrsiem/7.17.0/case-history-widgets","children":[]},{"id":"ci_563578ddf3c65f8bb22f34296388270aa802e9cdc7b165fd6048abd75b3e3480","title":"Case List Widgets","path":"/lrsiem/7.17.0/case-list-widgets","children":[{"id":"ci_96c74d9d1448ac0ee2d8a5dfec0523c64d28191a9854dc9c28821f2d43a97e0f","title":"Configure Case List Widget Settings","path":"/lrsiem/7.17.0/configure-case-list-widget-settings","children":[]}]},{"id":"ci_7b8a7f752f89fd6a87644acb531d1ab146bb6d18500a8018905faec8c5295f13","title":"Case Owners vs. Collaborators","path":"/lrsiem/7.17.0/case-owners-vs-collaborators","children":[]},{"id":"ci_8c8cf5f6e2411a9e51d9bcc30c5ecf6ecc381dd615d907610f92117320f558c5","title":"Case Status and Workflow","path":"/lrsiem/7.17.0/case-status-and-workflow","children":[]},{"id":"ci_f9e2279169c88c72d343e7f06460458ac93fcea5caf6925684aeee572f5599d1","title":"Case Trend Widgets","path":"/lrsiem/7.17.0/case-trend-widgets","children":[{"id":"ci_3e0a57ddfc3ee91007e8cb70f96e280cf0a5d3e2f0865bfd8f66dd471ef894cc","title":"Configure Case Trend Widget Settings","path":"/lrsiem/7.17.0/configure-case-trend-widget-settings","children":[]},{"id":"ci_f67318ea26546cf3dbf2fa98153f7082af18a42b52d913c2933796d6a6a727e2","title":"Read Case Trend by Priority Charts","path":"/lrsiem/7.17.0/read-case-trend-by-priority-charts","children":[]},{"id":"ci_1ffe1d84f6344c0e05320120a5145bb3c9bbb3de8e44a3fdb2d42a3cc703e0c3","title":"Read Case Trend by Status Charts","path":"/lrsiem/7.17.0/read-case-trend-by-status-charts","children":[]}]},{"id":"ci_182bde437ac8527616d25ffc78ab456d8a1b9765978c694207b4707411816218","title":"Open the Case Details View","path":"/lrsiem/7.17.0/open-the-case-details-view","children":[]},{"id":"ci_b51fad09e2e87607510c6bf6fd0ad76e75929595b78a1e6a6f11650208810555","title":"Separate Entities in Cases","path":"/lrsiem/7.17.0/separate-entities-in-cases","children":[]},{"id":"ci_4cc8456569435fa6cf58a9e4a16cd3a9ae9237fbb4cd0cfd72fd40fdc43bc2b2","title":"Work with Cases","path":"/lrsiem/7.17.0/work-with-cases","children":[{"id":"ci_1c7dc8157478c9a965c5eca572409a815916bb1ba6b695d607006149f52f4ae9","title":"Add Alarms to a Case","path":"/lrsiem/7.17.0/add-alarms-to-a-case","children":[{"id":"ci_484375ca9d464e56f17dac5b95e706f798cd71a3f4c1561e6a385c771e419c4c","title":"Update the Status of Alarms Associated with a Case","path":"/lrsiem/7.17.0/update-the-status-of-alarms-associated-with-a-case","children":[]}]},{"id":"ci_d376722b915760bed6f66206590020e569ebc77c9dd7b567be97d3b9a2579929","title":"Add Files to a Case","path":"/lrsiem/7.17.0/add-files-to-a-case","children":[]},{"id":"ci_da21ce70a67c9ef95d08b9aa7fe34cbfbc882f20ff882fd25946ff2f277dd567","title":"Add Logs to a Case","path":"/lrsiem/7.17.0/add-logs-to-a-case","children":[]},{"id":"ci_c75e011167b1c1410b21d22aec65e9d99d7c05ada60135f33fbb896b33289995","title":"Add Notes to a Case","path":"/lrsiem/7.17.0/add-notes-to-a-case","children":[]},{"id":"ci_f1aeabd321007cab0b2a4de0f14dfcc277d432420f15a3f002f93a94231afffc","title":"Case Associations","path":"/lrsiem/7.17.0/case-associations","children":[{"id":"ci_b3db82aefc04229c95112c7cda6124bcfed9b5997e6b92c337446b75d15d8e3a","title":"Add Case Associations","path":"/lrsiem/7.17.0/add-case-associations","children":[]},{"id":"ci_5a992333a5aaee5bfa91fdd64fee070621362da5e6955866c019906c875f8c1f","title":"Remove Case Associations","path":"/lrsiem/7.17.0/remove-case-associations","children":[]}]},{"id":"ci_5e52a9be9bfdbd98251e31014b1de03d3096b534f59e291ceeab24408d8254df","title":"Case Collaborators","path":"/lrsiem/7.17.0/case-collaborators","children":[{"id":"ci_13bd866d5cce31a994567a8bd47bfef73de7f1fdd5fddb55b1d4c6b16ba03e90","title":"Assign Collaborators to a Case","path":"/lrsiem/7.17.0/assign-collaborators-to-a-case","children":[]},{"id":"ci_98410d48f29d6e041bd1ae626a9d9b105a529469f01df66d9b462dd06b3ee95a","title":"Remove Collaborators from a Case","path":"/lrsiem/7.17.0/remove-collaborators-from-a-case","children":[]},{"id":"ci_ca45c11c97847940e8b0fcc6004a300e747cacecf12c08c64ba765ff1d8c9d71","title":"Transfer Case Ownership","path":"/lrsiem/7.17.0/transfer-case-ownership","children":[]}]},{"id":"ci_a343b8bb0502d4ce1e36922a08b8b1c49683f92ad601d4f6438dae3c4231e091","title":"Case Tags","path":"/lrsiem/7.17.0/case-tags","children":[{"id":"ci_710d24b0104d6cb4f9af1dc8b41ac71b0d348bf031653ed2ac41e75f1e3146e7","title":"Add Case Tags to a Case","path":"/lrsiem/7.17.0/add-case-tags-to-a-case","children":[]},{"id":"ci_3a160afc7e7af31ec8783893f5ae559e8178fd327ef2fbd1be328f76418d5044","title":"Remove Case Tags from a Case","path":"/lrsiem/7.17.0/remove-case-tags-from-a-case","children":[]},{"id":"ci_4bcb25f28398363c44b84f06028219495c6833a92e353dc1c3a8645144671041","title":"Use Case Tags to Filter Cases in Case Widgets","path":"/lrsiem/7.17.0/use-case-tags-to-filter-cases-in-case-widgets","children":[]},{"id":"ci_6936b376343e29ee94e4af62edd52ca92948c9777b9d8dba738c13e5627f64f8","title":"Use the Case Tag Library","path":"/lrsiem/7.17.0/use-the-case-tag-library","children":[]}]},{"id":"ci_6a0962356ff152df65eac3fc0667f58133a98d2cc682732a6182e875d0804e23","title":"Close Cases","path":"/lrsiem/7.17.0/close-cases","children":[]},{"id":"ci_45da156f39664493762df6b66780bb71cd4e858d996919990f971e4581e93a4e","title":"Create New Cases","path":"/lrsiem/7.17.0/create-new-cases","children":[]},{"id":"ci_e893931d724ec5966ebcd497d836d4e392526eb4f510a90966f9ccce5c632034","title":"Delete Logs, Alarms, and Files from Case Evidence","path":"/lrsiem/7.17.0/delete-logs-alarms-and-files-from-case-evidence","children":[]},{"id":"ci_29195d6dac3191d86e3e4b52b74429eebdbffc38c976169d28a8cc24949fdcac","title":"Edit and Delete Notes in Case Evidence","path":"/lrsiem/7.17.0/edit-and-delete-notes-in-case-evidence","children":[]},{"id":"ci_3c829cb347647dbc19e2bf0fe42259e0b40a6d2fba9c1d3c7ba141f0597ac2d7","title":"Edit Case Names, Priorities, Due Dates, and Summaries","path":"/lrsiem/7.17.0/edit-case-names-priorities-due-dates-and-summaries","children":[]},{"id":"ci_922158713a0e69a51a2e79741cbd1a317c2b5f2499ef103a6947ae814107d7d1","title":"Filter Cases","path":"/lrsiem/7.17.0/filter-cases","children":[]},{"id":"ci_f7edcd66473691dc78289392ca1afa1e819638ff1112af19566278ebfc8c7527","title":"Pin Important Evidence","path":"/lrsiem/7.17.0/pin-important-evidence","children":[]},{"id":"ci_ce780cd8692c2b511e5805149a29f8e1a02735059a9eb530ae1f38acd3e31a18","title":"Reopen Cases","path":"/lrsiem/7.17.0/reopen-cases","children":[]},{"id":"ci_67e1788eb0cf0a6dfec05f882362426cfa20dbf8556fa33b10f7f0b3672256c2","title":"Unpin Evidence","path":"/lrsiem/7.17.0/unpin-evidence","children":[]}]},{"id":"ci_5a706d2ece327cb81f57156abf1d921b6a856b54a3adcfd4034bda4c7f5b67cb","title":"Work with the Current Case Panel","path":"/lrsiem/7.17.0/work-with-the-current-case-panel","children":[]}]},{"id":"ci_df4ba1c3a8bbf8c4e08383eb9dbfd0fc22b21c32a3cad83adb49811b332e281c","title":"Cloud to Cloud Log Collection","path":"/lrsiem/7.17.0/cloud-to-cloud-log-collection","children":[{"id":"ci_b3f31e4965217b4d55608df0818b7e094b93bb6c8a7e1e7e47e8e89683168b52","title":"Configure an Open Collector Log Source","path":"/lrsiem/7.17.0/configure-an-open-collector-log-source","children":[]},{"id":"ci_cd323b6306fb25ccff1d8eb3a4d56b39427c138aef0fee97c8ee89ed072378a2","title":"Add a Log Source Configuration","path":"/lrsiem/7.17.0/add-a-log-source-configuration","children":[]},{"id":"ci_0ba0ea782a43270cfaf2246fb2748c6e2b81d19eb6b7a552e0b1a3e7503763bf","title":"Use the Log Source Configuration Grid","path":"/lrsiem/7.17.0/use-the-log-source-configuration-grid","children":[]},{"id":"ci_04b092d9c98be6839b25d3daa7d4d1eed43272d88d70483325a5269aeb642e21","title":"Edit a Log Source Configuration","path":"/lrsiem/7.17.0/edit-a-log-source-configuration","children":[]},{"id":"ci_0770c97f3736f901c1ecde3af22303793c0afadf7156deaa06c9c3535c76a25f","title":"Delete a Log Source Configuration","path":"/lrsiem/7.17.0/delete-a-log-source-configuration","children":[]}]},{"id":"ci_81f9bb9cdb93a6b7e136a3091f409a2f23b737d127b2601885807284b75cfcf2","title":"Dashboards","path":"/lrsiem/7.17.0/dashboards","children":[{"id":"ci_0b634892413eee7d65975d85f5e1ea8229a19fd1b0a736167861819ab9a65d03","title":"Create New Dashboards","path":"/lrsiem/7.17.0/create-new-dashboards","children":[]},{"id":"ci_4fbaf2798dfd665b802beb2183eaffc8e44254049c2b44eaa093df70f316634a","title":"Clone Dashboards","path":"/lrsiem/7.17.0/clone-dashboards","children":[]},{"id":"ci_be95940a2f40f2d26f8951e913ae714fa33384dc5d09612d081f8b60b3d64ca1","title":"Import and Export Dashboards","path":"/lrsiem/7.17.0/import-and-export-dashboards","children":[]},{"id":"ci_560b07ce4e7f5ff36c22062a5c9ae420400e7580df10dbd983477f07d75eafa2","title":"Change Dashboards","path":"/lrsiem/7.17.0/change-dashboards","children":[]},{"id":"ci_9a7bf854081e712d2f74b44b1cb815320fb8370bb94423a4acc5bae19497ea94","title":"Revert Changes","path":"/lrsiem/7.17.0/revert-changes","children":[]},{"id":"ci_70bff547393054301ae25fb0d02317d0702012b8ee4e3ccbe26d150d4a97822e","title":"Print Dashboards","path":"/lrsiem/7.17.0/print-dashboards","children":[]},{"id":"ci_ae4baeed168fa110aada4daa041d0cc231870d363a081e15aea79104e002a86c","title":"Save Dashboard Changes","path":"/lrsiem/7.17.0/save-dashboard-changes","children":[]},{"id":"ci_9ac83259a76dd98f99e7693d3936c861369e0c845b8bd7a8dd07f13e2df59c7d","title":"Filter Data with Lucene Searches","path":"/lrsiem/7.17.0/filter-data-with-lucene-searches","children":[{"id":"ci_50d9bb57725cc76dc7cd25cfe5bf7964b391e8331388d7889d96375813f230a2","title":"Lucene Search Syntax","path":"/lrsiem/7.17.0/lucene-search-syntax","children":[{"id":"ci_a1531ff5b10a234285e3476d3eb64a32550481debfc3856c6160be95485fa41d","title":"Basic Queries","path":"/lrsiem/7.17.0/basic-queries","children":[]},{"id":"ci_1ddc8ce6b6d01fb2681c9b8f10e13a780904c7310f1e39df8a501cfbdbe720e1","title":"Complex Queries","path":"/lrsiem/7.17.0/complex-queries","children":[]},{"id":"ci_5b7794c6e476a9f3afe1596249fbb899fdc9bf0a9b5d414698543c4630f1a6ee","title":"Troubleshoot the Lucene Search","path":"/lrsiem/7.17.0/troubleshoot-the-lucene-search","children":[]},{"id":"ci_8e5e3f52bdd7013b2e8c2ca6ce16524201c24b34ce5d6903fdbd8baa091328c1","title":"Wildcard Queries and Fuzzy Matches","path":"/lrsiem/7.17.0/wildcard-queries-and-fuzzy-matches","children":[]},{"id":"ci_b10ca73be1f7151abb7db559452d6fe8dc08972419ebdb78152784962967eec7","title":"Metadata Fields","path":"/lrsiem/7.17.0/metadata-fields","children":[{"id":"ci_a5f7621ec822cfaced9a113118cab9910d136a7edd08f22bb2e0f4b0bb1f5143","title":"Applications","path":"/lrsiem/7.17.0/applications","children":[]},{"id":"ci_9b2caf1ba8c51bc9c46fc8d5717bc9870862da03136161fa3a04ed56e81e7659","title":"Classification","path":"/lrsiem/7.17.0/classification","children":[]},{"id":"ci_d2af403295a71dca3130f86fb32f1973a6f854f0aac57a2f24801f822af88dee","title":"Host","path":"/lrsiem/7.17.0/host","children":[]},{"id":"ci_9c89a220cab3f28c41172368d04b6e41a9285955a826fa0c1fd2ff4e04e248ad","title":"Identity","path":"/lrsiem/7.17.0/identity","children":[]},{"id":"ci_a87d2035856a4ef2a8e4178f42a1d3d37b0007009c30b06bd2a32e38681606cf","title":"KBytes and Packets","path":"/lrsiem/7.17.0/kbytes-and-packets","children":[]},{"id":"ci_b04bd09be28efc7a672c4caf4e4150c281caced7b16b8ae43714a68b01f745d8","title":"Location","path":"/lrsiem/7.17.0/location","children":[]},{"id":"ci_eebea1f567740664bd3afc61768fa3184ec396ead69b167e1a5298d018830c93","title":"Log","path":"/lrsiem/7.17.0/log","children":[]},{"id":"ci_1e4f04e79ef2311ca97887b48687bb195aacfce9510b32c90d23c9766ad9981f","title":"Network","path":"/lrsiem/7.17.0/network","children":[]}]}]}]}]},{"id":"ci_80212d21515b216aaca638ae08b420fece3c1c3c965d1958a982f9a3d8eb759c","title":"Lists in Web Console","path":"/lrsiem/7.17.0/lists-in-web-console","children":[{"id":"ci_1fcc35302baeb454dc67842e9b198b816314f4055ecfd628930ce02244447155","title":"Add List Items in the Web Console","path":"/lrsiem/7.17.0/add-list-items-in-the-web-console","children":[]},{"id":"ci_5efb7e69f71fd40e4d86ff68f355a9efffebe497d872241e6d5427d59a30279b","title":"Add Related Lists","path":"/lrsiem/7.17.0/add-related-lists","children":[]},{"id":"ci_5557445ed0e656d956c0a2225fb3fb588a71cde57ac4e0a31ee946e9f9753272","title":"Create a List in the Web Console","path":"/lrsiem/7.17.0/create-a-list-in-the-web-console","children":[]},{"id":"ci_d6157f0299df2c9ed440ce5056eb9c58d9253fa4da2c4ded289d4d37aaf6ef4c","title":"Filter and Sort Lists","path":"/lrsiem/7.17.0/filter-and-sort-lists","children":[]},{"id":"ci_177330a4a5bddf60d95ad0d81d6a7a5b15cf244446c4abe2cb73cc1d4bef8973","title":"Remove List Items in the Web Console","path":"/lrsiem/7.17.0/remove-list-items-in-the-web-console","children":[]},{"id":"ci_255d94f17d2a40d1288fafea4e9ed19e5ffdba86263887a75dd158a67ea2e3be","title":"Select and View a List","path":"/lrsiem/7.17.0/select-and-view-a-list","children":[]},{"id":"ci_e4b141e75516a0407ef866b77fc43f0c55b2eaa7263b2abc304055290b7ef749","title":"View Retired Lists","path":"/lrsiem/7.17.0/view-retired-lists","children":[]}]},{"id":"ci_c985c55b21440f899c4e822a703b1d08edd6b8f9179af4899c4b210507902fc9","title":"Log Collection in Web Console","path":"/lrsiem/7.17.0/log-collection-in-web-console","children":[{"id":"ci_4760ca2fb37260be74369b4275a0234b4d5e45fe610a7666d3ec0782ccf81e77","title":"Agents Grid","path":"/lrsiem/7.17.0/agents-grid","children":[]},{"id":"ci_a2a52cbc76ea0086d31677f749f9dd9e3f7babba572bafcbc2b7c0693adbca4d","title":"Beats Grid","path":"/lrsiem/7.17.0/beats-grid","children":[]},{"id":"ci_e8d159325ab3630d7c9f89025bc62d35b33492b9b225b233116db4177f27449c","title":"Add a New Beat in Web Console","path":"/lrsiem/7.17.0/add-a-new-beat-in-web-console","children":[]},{"id":"ci_4ecf9ad0fc6679d7cd207375552c9dade3c4df9d95f8525a27cf7e36c7e1901f","title":"Retire Beats","path":"/lrsiem/7.17.0/retire-beats","children":[]},{"id":"ci_849e9dd841f0033462ec36a5e92309cbb184d5fb61e7045c6f689f3040fc4475","title":"Log Sources Grid","path":"/lrsiem/7.17.0/log-sources-grid","children":[]},{"id":"ci_55175a543a46f55223fd7cddd493cfef52a21801959ca368764729297c5be2cf","title":"Add a New Log Source in Web Console","path":"/lrsiem/7.17.0/add-a-new-log-source-in-web-console","children":[]},{"id":"ci_91827dd8d8f3b81b8864db58d1a803eaf8829dd1c712cc17f97fee9d5ee9c83d","title":"Open Collectors Grid","path":"/lrsiem/7.17.0/open-collectors-grid","children":[]},{"id":"ci_6b731056744bd25ca187db76f8c27e66a5ba7b975bad4cbbc0daeac30fe09326","title":"Retire Open Collectors","path":"/lrsiem/7.17.0/retire-open-collectors","children":[]}]},{"id":"ci_f68a207c0eb13db19ead32fab551a9ef93ee0aec14570ea84523e6e8077afe2f","title":"Playbooks","path":"/lrsiem/7.17.0/playbooks","children":[{"id":"ci_5be3520a84d387d4e62b9ff81357448111d5298d51a7400aba9eedb2826f40a7","title":"Create Playbooks","path":"/lrsiem/7.17.0/create-playbooks","children":[]},{"id":"ci_00d5ed97169a8201be4aa4a3dde5611a18d603806648252c7b1b74a8d7c0a7ed","title":"Import Playbooks","path":"/lrsiem/7.17.0/import-playbooks","children":[]},{"id":"ci_e25a88d067c500d3cc902fae7aae06562ca9f1727d3511309d195ae123f73349","title":"Work with Playbooks","path":"/lrsiem/7.17.0/work-with-playbooks","children":[]},{"id":"ci_4339a56a2547ecd70fa861510aee0849913ea153e43b512e6017b0296e9008d2","title":"Add Playbooks to a Case","path":"/lrsiem/7.17.0/add-playbooks-to-a-case","children":[]},{"id":"ci_6cfa4dc8788a8c92d3472a7863fcf6dfe98d58358be4aff2057b340bca37e043","title":"Work with Playbooks in a Case","path":"/lrsiem/7.17.0/work-with-playbooks-in-a-case","children":[]},{"id":"ci_937bd81b1e8c15884cab7818cd1d438517254f1eb57977e8617e4f785c7700bb","title":"Procedures List Widget","path":"/lrsiem/7.17.0/procedures-list-widget","children":[]}]},{"id":"ci_1651bac551ecfc26f31c8ae8ea443c56199201c5f2365b5a252549649e914f3d","title":"Reports","path":"/lrsiem/7.17.0/reports","children":[{"id":"ci_d7c279dd2843eea236a65a607b065111c8d2166efaf74740fb837bcf909cb15f","title":"Completed Reports Widget","path":"/lrsiem/7.17.0/completed-reports-widget","children":[{"id":"ci_d1fe5d508df13e7944a75038faa73693b9bc9eaf1e48857431e52824a6dea6bc","title":"Configure Completed Reports Widgets","path":"/lrsiem/7.17.0/configure-completed-reports-widgets","children":[]}]},{"id":"ci_4b330594a77437b3b7cc624246e8afcf178b6b068cd98e7814da5775269ae48a","title":"Download Reports from the Web Console","path":"/lrsiem/7.17.0/download-reports-from-the-web-console","children":[]},{"id":"ci_8f33b0d4611af50f28ea3019e20ed9c2b46591c28ca2b72035180552e7bf13ff","title":"Filter Report Packages on the Reports Grid","path":"/lrsiem/7.17.0/filter-report-packages-on-the-reports-grid","children":[]},{"id":"ci_c0bc024331b25bb3e783f565f302a40b5f7266c07396188981826ef000a0e094","title":"Pin and Resize Reports Grid Columns","path":"/lrsiem/7.17.0/pin-and-resize-reports-grid-columns","children":[]},{"id":"ci_b6867899b4de5f7ea1f64b343c247159726914843dace46148f0e2b635b6f785","title":"Run Searches from Report Filter Criteria","path":"/lrsiem/7.17.0/run-searches-from-report-filter-criteria","children":[]},{"id":"ci_8563096d6ec3198b100f286e19a0e459685a8c890de94c6565ce57a5c4f6c0cf","title":"Sort Content on the Reports Grid","path":"/lrsiem/7.17.0/sort-content-on-the-reports-grid","children":[]},{"id":"ci_40b15b350da9e3fc1b116f6a51df655ca69b9c2c83f3c66333411876db73e96e","title":"View Package and Reports Details in the Inspector","path":"/lrsiem/7.17.0/view-package-and-reports-details-in-the-inspector","children":[]}]},{"id":"ci_30917ae4e5b5c5488799078f1b2a4ce81d40be4f0b35747245b2813a7924bc03","title":"Search","path":"/lrsiem/7.17.0/search","children":[{"id":"ci_fd2f23f6e8a74cf2253e8267ed1ddf5f1e614683d14bd006a79b5c0d35e3c0ce","title":"Manage the Searches Page","path":"/lrsiem/7.17.0/manage-the-searches-page","children":[]},{"id":"ci_dc00b12884d525f8c9bdb429152ba2750657403d7d5aab216234750df550f7f8","title":"Run Searches from the Searches Page","path":"/lrsiem/7.17.0/run-searches-from-the-searches-page","children":[]},{"id":"ci_7a97d426aaa657b1125659b46b868ec33ef67bdb69d371fa0753f4b4f31e61da","title":"Use Search","path":"/lrsiem/7.17.0/use-search","children":[]},{"id":"ci_df7c751f3313a28bd2be9b676b318ddf50d97b70c79cfc6fe1ff11bf449266a7","title":"Save Searches","path":"/lrsiem/7.17.0/save-searches","children":[]},{"id":"ci_160c8c2807eb00a7f32f8901ef4bc3d2e5f1e7af93e558c5545d2ce205807f7c","title":"Perform Details Searches (User/Host)","path":"/lrsiem/7.17.0/perform-details-searches-user-host","children":[]},{"id":"ci_4097d24b95b2441e2a1d4bcf54644d3fad5b96bef16899d0614aa2228558d161","title":"Perform Pivot Searches","path":"/lrsiem/7.17.0/perform-pivot-searches","children":[]}]},{"id":"ci_e78289d7ef1ab40e8598218b98a9c6ccf672885b9e5ca133f821e0234b9e80cf","title":"SecondLook - Web Console","path":"/lrsiem/7.17.0/secondlook-web-console","children":[]},{"id":"ci_cbbdeb6962d71231a24b7e68c0ca984f604bfaada442b7fc33ee7dd77e9b08cc","title":"Single Sign-On","path":"/lrsiem/7.17.0/single-sign-on","children":[{"id":"ci_d0a51ebb5433915547dde0fb8bb299c3b6f79521b4790bafd66263c648a227d8","title":"SSO Known Issues and Recommendations","path":"/lrsiem/7.17.0/sso-known-issues-and-recommendations","children":[]},{"id":"ci_08039bfb7cedec250668fe052f0261fdb4bb8771c963707de2d340229a04e970","title":"SSO User Auto-Provisioning","path":"/lrsiem/7.17.0/sso-user-auto-provisioning","children":[]},{"id":"ci_f33a51d559536d6acb1554c9431d3caf4525358799af9ec40d783358c145e4b0","title":"SSO Configuration","path":"/lrsiem/7.17.0/sso-configuration","children":[{"id":"ci_b3a3d28eae33853a3a04cb55ab5089bcef72703af7d8485e8b1da226377b9445","title":"Supported Identity Providers","path":"/lrsiem/7.17.0/supported-identity-providers","children":[{"id":"ci_a8a9a63f17fe0789292392c5cd540aaf20d6234c7362cdf2095b03aecbfc6203","title":"Configure SSO with Okta","path":"/lrsiem/7.17.0/configure-sso-with-okta","children":[]},{"id":"ci_17a0add45a88156343b4106460e23c8d3fcc418c2e727456aa60707ab273f028","title":"Configure SSO with Azure AD","path":"/lrsiem/7.17.0/configure-sso-with-azure-ad","children":[]},{"id":"ci_639354300b12b740944e0893c9ffeee18b91c4422289b336616ff8e20e0f70ef","title":"Configure SSO with PingOne for Customers","path":"/lrsiem/7.17.0/configure-sso-with-pingone-for-customers","children":[]},{"id":"ci_8ed442e356b186d5a58c28d932a2d94b865f20d17af4e3e01bf27fe6ba100522","title":"Configure SSO with PingOne for Enterprise","path":"/lrsiem/7.17.0/configure-sso-with-pingone-for-enterprise","children":[]}]}]}]},{"id":"ci_b4d316148b5eba4a5ef76582e355ffee1ee57d4d1bac7cddd494cad849683709","title":"TrueIdentity","path":"/lrsiem/7.17.0/trueidentity","children":[{"id":"ci_e8a70a7f85789eb1089f87bd35ffed621b3f2079dd33d0aff3e51701043d4c3b","title":"Work with TrueIdentities","path":"/lrsiem/7.17.0/work-with-trueidentities","children":[]}]},{"id":"ci_51113fe53c10a6e0b7877b5a23689a42b4f10d0434a68484b85e55ef3d9db2d6","title":"User Interface","path":"/lrsiem/7.17.0/user-interface","children":[{"id":"ci_abd52a56a69b466735489588c0bd3b64bf0ea87879514fce9e714e65ccf892ff","title":"Resource Center","path":"/lrsiem/7.17.0/resource-center","children":[]},{"id":"ci_42276b153c7f3a1b91491139c6b8f7505b989ae7665ccf3eada427e247ad8b03","title":"Pages","path":"/lrsiem/7.17.0/pages","children":[{"id":"ci_5f05b016f082f31a7cb37abc580cad0fc0718604f7a322cf042851c98556016b","title":"Alarms Page","path":"/lrsiem/7.17.0/alarms-page","children":[]},{"id":"ci_a3b16e78549f685aa36f105689f2727e216c39f333e0aeeb5cdf7679fbecc523","title":"Analyze Page","path":"/lrsiem/7.17.0/analyze-page","children":[]},{"id":"ci_f5c31f63857681eef05b03273202fb3d4659f83c2f4b0c0266981384f9c2c050","title":"Cases Page","path":"/lrsiem/7.17.0/cases-page","children":[]},{"id":"ci_6790f79963a9ccb0609d495b401bb24f5aae7feae4de7964dcfaf998d47ae73e","title":"Dashboards Page","path":"/lrsiem/7.17.0/dashboards-page","children":[]},{"id":"ci_e9109cb2cea26d0d25107d79b742de3266cf0be6a48a37ccf7adca451321d168","title":"Host/User Detail Page","path":"/lrsiem/7.17.0/host-user-detail-page","children":[]},{"id":"ci_c5060a21c8063d217b8b06b1e73126bfceaf3c65b8704aca28be4ed264a306d5","title":"Lists Page","path":"/lrsiem/7.17.0/lists-page","children":[]},{"id":"ci_0dbfeb08e7fb9beb036db5479270398ede55f9a0c0e946e61e2208a953924ce0","title":"Reports Page","path":"/lrsiem/7.17.0/reports-page","children":[]},{"id":"ci_e6060939e4333a97828129026c811b8221ea474908ca27a0a19509026d2a04ac","title":"Searches Page","path":"/lrsiem/7.17.0/searches-page","children":[]},{"id":"ci_bdcff3eb747b91686a0734917b903413525c44430d8267a5f9d42311a1e0661f","title":"TrueIdentity Page","path":"/lrsiem/7.17.0/trueidentity-page","children":[]}]},{"id":"ci_ab444168921def2f483c2fe39057273b4b98955a39fd9bd16b7fe6b5e16f7f88","title":"Panels","path":"/lrsiem/7.17.0/panels","children":[{"id":"ci_e2e3b11cbe990851aaa7f0fe3bb8a0a8df5cff6af63b82e9dd491acf45d52df0","title":"About the Analyzer Grid","path":"/lrsiem/7.17.0/about-the-analyzer-grid","children":[]},{"id":"ci_2eeb55683ca8b1e423b231005585594b18b10e4a58a56e447989ca5dc26c2812","title":"Current Case Panel","path":"/lrsiem/7.17.0/current-case-panel","children":[]},{"id":"ci_da388c6a7ef03460727cfe36428c8d71f907905cb8625e5d60b08dedc98ac4d9","title":"Inspector","path":"/lrsiem/7.17.0/inspector","children":[]}]},{"id":"ci_c7f780e53f1451831da50614ff5537f600e406f4779344158121fc8da7d6a56f","title":"Tools","path":"/lrsiem/7.17.0/tools","children":[{"id":"ci_46676b964a4dfd1e32208f61f257caf32feed9a69386f07107046d8fa8433e90","title":"About Widgets","path":"/lrsiem/7.17.0/about-widgets","children":[]},{"id":"ci_6c308b66de9532b796a8045b25d42e9e1d584db1cb739eb3e0436f8a1cbdf130","title":"Breadcrumbs","path":"/lrsiem/7.17.0/breadcrumbs","children":[]},{"id":"ci_5ac2946a1a11d64d3a745d9df458bffe313dbaae3e9bfebbd8105688ce8b706d","title":"Hotkeys","path":"/lrsiem/7.17.0/hotkeys","children":[]},{"id":"ci_44eb2c1ccada9394955f6d183b88c3725f8b33f3be38431ac4c5cdc5a1b61faf","title":"Icons","path":"/lrsiem/7.17.0/icons","children":[]},{"id":"ci_faa9303da5f8c743864571dd7f88612f6949f9b9b2b3fb3e7841b01bb4a0db83","title":"Search Tools","path":"/lrsiem/7.17.0/search-tools","children":[]},{"id":"ci_caeb47a7c179af64688e6796b9b61eca8c045f5228c3c33ac6d480b3ef1f763f","title":"Taskbar","path":"/lrsiem/7.17.0/taskbar","children":[]},{"id":"ci_cfc8771e946d1b0827545551c9735a18f9358299655254f3e3fe5d291d30be2b","title":"Typeahead Filters","path":"/lrsiem/7.17.0/typeahead-filters","children":[]}]}]},{"id":"ci_2e873d4ed5235c63b486e49711b0a7703b8ba7af8490be3beb5cf6c921bea880","title":"User Settings","path":"/lrsiem/7.17.0/user-settings","children":[{"id":"ci_2133f74dee825f6b44850bac98e71f6f1c85ad9cc9004816b2f47d062897724f","title":"Access Web Console Help","path":"/lrsiem/7.17.0/access-web-console-help","children":[]},{"id":"ci_4056693263b059d842cc8da5b485f36cfb9c70337f843b737c17725e20010573","title":"Change the Default Web Console Search Timeout Period","path":"/lrsiem/7.17.0/change-the-default-web-console-search-timeout-period","children":[]},{"id":"ci_f3f7ecfd9bdbff9b671ab6cdbfa89796c68495f092b2d8b8b80c828a47aa38a4","title":"Change the Web Console NGINX Configuration to Modify Available Ciphers","path":"/lrsiem/7.17.0/change-the-web-console-nginx-configuration-to-modify-available-ciphers","children":[]},{"id":"ci_b6703c26f3ef0bfc4fd4431a7796f1500b537ac49dc40e6c01415f6eb5afef88","title":"Change Web Console Password","path":"/lrsiem/7.17.0/change-web-console-password","children":[]},{"id":"ci_8b12a68fd6a997db9c99d76e4c76e0995ac4672bd0740db557f24e0e5160f094","title":"Configure Navigation Warning","path":"/lrsiem/7.17.0/configure-navigation-warning","children":[]},{"id":"ci_3acec07cc44c6650a520800eedc04ffcfe42a198452922308d0100331594f0a7","title":"Configure Search Results","path":"/lrsiem/7.17.0/configure-search-results","children":[]},{"id":"ci_9ccd45998b987875b56b6ff39becf09f8f45c23c45d20e4fdd7c464487f2dc59","title":"Select Query Location","path":"/lrsiem/7.17.0/select-query-location","children":[]},{"id":"ci_5cc299c2ed159809214bc9efd5743f2927a1ea9cee07b0b7e112b95086a2b807","title":"Set the Date Time Format","path":"/lrsiem/7.17.0/set-the-date-time-format","children":[]},{"id":"ci_d1de698dacb8baee9faee92156571333f6d95cb93dba5dec4857084e22f96f70","title":"Set Your Drilldown Preference","path":"/lrsiem/7.17.0/set-your-drilldown-preference","children":[]},{"id":"ci_f4ee897d911abde7d71e7350c3420cdcd1f666466ab7a085721d4dded9c45764","title":"Switch Between Day and Night Modes","path":"/lrsiem/7.17.0/switch-between-day-and-night-modes","children":[]}]},{"id":"ci_726dcbb92214d3e2e051a2c799a12f8a6f668473b822e9bb72a2110bb816ac2c","title":"Widgets","path":"/lrsiem/7.17.0/widgets","children":[{"id":"ci_2ca7f846fb31becaecd2a8fda1f89e441d18f163f3fb5924cdd6ebc2ddb16c9a","title":"Customize Dashboard Widgets","path":"/lrsiem/7.17.0/customize-dashboard-widgets","children":[{"id":"ci_b1b3b8a1229819090f64a18d5bd96b08f6b51980e16cad3ada00cde31fa4b987","title":"Add Widgets","path":"/lrsiem/7.17.0/add-widgets","children":[]},{"id":"ci_58bb9aba5a5347b93775ecb16c4d7a2ecca3da004ac234f91f1e3275e41cb32b","title":"Configure Widget Settings","path":"/lrsiem/7.17.0/configure-widget-settings","children":[]},{"id":"ci_9060c596ca4cf3e5d864284f50b84766d452452c9442710dafdaf3c4808ab43c","title":"Copy Widgets","path":"/lrsiem/7.17.0/copy-widgets","children":[]},{"id":"ci_33876dd2b14d7068ebbccccec1c0c3f1aa5ef30a4122d6ac1c6049cb94d9c2bb","title":"Delete Widgets from a Dashboard Layout","path":"/lrsiem/7.17.0/delete-widgets-from-a-dashboard-layout","children":[]},{"id":"ci_02b617d99d08edac090ffc24bd4c460a66668f649cf1a02a8fb40ef4a8acd453","title":"Move Widgets","path":"/lrsiem/7.17.0/move-widgets","children":[]},{"id":"ci_2d49d4a9d3c2ec36ff291f7a2cad342443e5c993d31039ea57fb8d41f0f4b6c5","title":"Rename Widgets","path":"/lrsiem/7.17.0/rename-widgets","children":[]},{"id":"ci_2d9c5ab0f00c8dba515212fc733ebac00fe578e42470ec6d0c50e897e173260e","title":"Resize Widgets","path":"/lrsiem/7.17.0/resize-widgets","children":[]}]},{"id":"ci_b1e53c3bbed34f8a5f8a410f7f43889b9dfcd618489f9552c515f874308f99a4","title":"Component Status Widget","path":"/lrsiem/7.17.0/component-status-widget","children":[]},{"id":"ci_2d48d90ff137be9834ce8501275d404174693996f61bea59f7c6454c3e770e33","title":"Current Processing Rate Widgets","path":"/lrsiem/7.17.0/current-processing-rate-widgets","children":[]},{"id":"ci_01279fb95d21c51ac067d857499df6ddb9b614e16f56db0ccdb8a7fdbc48b883","title":"Data Processing Trend Widgets","path":"/lrsiem/7.17.0/data-processing-trend-widgets","children":[]},{"id":"ci_dbb439177a4522daf89c098eb57fe2e21b0ce9fbe45e6a42892ef50e60a6dc9e","title":"Node-Link Graph Widgets","path":"/lrsiem/7.17.0/node-link-graph-widgets","children":[]},{"id":"ci_c8be35822b66da0694895b37b59b2dc02299492cd38aa6a8bb22696a384aa110","title":"System Database Usage Widget","path":"/lrsiem/7.17.0/system-database-usage-widget","children":[]},{"id":"ci_ab13b128e11f570292b436e7936282c9ca90fd18f9d2e8e76c081556d1b30747","title":"Threat Activity Map","path":"/lrsiem/7.17.0/threat-activity-map","children":[{"id":"ci_0a8fdfc92f4208b58a51dc39bd4d5481883e3f7a9e10c0eaba18fa06058b5f34","title":"Configure Threat Activity Map Widget Settings","path":"/lrsiem/7.17.0/configure-threat-activity-map-widget-settings","children":[]},{"id":"ci_70a23bd1627468144d3ec24f21fee73312d498cc2b7d5b89ab2ee89ce1879ef7","title":"Drill into Threat Activity Map Node Data","path":"/lrsiem/7.17.0/drill-into-threat-activity-map-node-data","children":[]},{"id":"ci_f91d675dbb90aeeac8bd75221c838fd036b8a95a0fb652a6ee0c233a00338770","title":"Troubleshoot Threat Activity Map","path":"/lrsiem/7.17.0/troubleshoot-threat-activity-map","children":[]},{"id":"ci_a0088fee2d257cbe7b556f4cf2ac5eda809e3452a4117755c23b7adf43640a74","title":"Zoom In and Out on the Map","path":"/lrsiem/7.17.0/zoom-in-and-out-on-the-map","children":[]}]},{"id":"ci_0ea1143f2c620fc59591221e4276edb7de97998da34aec4f1d670774e7c808e9","title":"Timeline Widget","path":"/lrsiem/7.17.0/timeline-widget","children":[]},{"id":"ci_113dd4252846997ae9b3be57f6e5ab44c0dc984fceb0c95d0e7e6f626f8e2842","title":"TopX Widgets","path":"/lrsiem/7.17.0/topx-widgets","children":[{"id":"ci_a1a0b0e2b324406000d1d055164d2ee236ab1f7f5fdb2b86dd9f58848710ae83","title":"Configure TopX Widget Data Settings","path":"/lrsiem/7.17.0/configure-topx-widget-data-settings","children":[]},{"id":"ci_0b34c670bf74e02c5f9e98934d1879858c4913542dbc5b8bf3a541284aae9c45","title":"Configure TopX Widget Graph & Options Settings","path":"/lrsiem/7.17.0/configure-topx-widget-graph-options-settings","children":[]},{"id":"ci_5c3f97e3d9a5393132508982304e3502a9ccce573210640a9248099ef2bbd149","title":"Drill into Chart Metadata from the Dashboards","path":"/lrsiem/7.17.0/drill-into-chart-metadata-from-the-dashboards","children":[]},{"id":"ci_0e11ecd9c39bd42204732615c1352867ffdc5092b632c7e906554a3cf234f009","title":"Filter Data by Time Range on the Dashboards and Analyze Pages","path":"/lrsiem/7.17.0/filter-data-by-time-range-on-the-dashboards-and-analyze-pages","children":[]},{"id":"ci_e9e055eba9a1d549b3b05e012f2379b2624657c327f26ab6c3ac323f866c0362","title":"Resize TopX Data Labels on Bar Charts","path":"/lrsiem/7.17.0/resize-topx-data-labels-on-bar-charts","children":[]}]}]}]},{"id":"ci_665d904339ec9a5c2b747361509ed383e3dcdbacd6e75d97a54b7aa68e693cee","title":"LogRhythm Schema Dictionary and Guide","path":"/lrsiem/7.17.0/logrhythm-schema-dictionary-and-guide","children":[{"id":"ci_868eb56812821bde8cf5bd4c0d294155ed6a02e6b4306da7761896c9633b0acc","title":"Application Tab","path":"/lrsiem/7.17.0/application-tab","children":[{"id":"ci_01388d31437410127e852cc2c5913ab3570c9777c16a65a4e0733aebb7d147a3","title":"Action [7.2]","path":"/lrsiem/7.17.0/action-7-2","children":[]},{"id":"ci_49e7f4689674420f232fc284add0d0198fc29b6d1b16557d4435d623f39c850d","title":"Amount","path":"/lrsiem/7.17.0/amount","children":[]},{"id":"ci_a1b19e7ccd25df773e543024b8f2655d7f4823c1509103128e88b8968b606f46","title":"Command","path":"/lrsiem/7.17.0/command","children":[]},{"id":"ci_4ffe9ac8ccb1b5654005db49a5799b31b173fdc3646672e5e79ffc923d552750","title":"Hash [7.2]","path":"/lrsiem/7.17.0/hash-7-2","children":[]},{"id":"ci_eee6f66e992e07127c9d56b2a26dbad70819c7519c525e8a6b47e072898ced5f","title":"IANA Protocol Name","path":"/lrsiem/7.17.0/iana-protocol-name","children":[]},{"id":"ci_5626c1da0d24d35527a2710cb98687dec0c5b007e3f7dd0678213f35aaf6c8a0","title":"IANA Protocol Number","path":"/lrsiem/7.17.0/iana-protocol-number","children":[]},{"id":"ci_21d0a0cf8af6a3cc18be9ff7b902fca16ab6d09dd9e7ff1722c9e55182454236","title":"Object","path":"/lrsiem/7.17.0/object","children":[]},{"id":"ci_9e77d3fc06a582fd7abd7fb163468b366136fdaef59b3e00c200f653cd891880","title":"Object Name","path":"/lrsiem/7.17.0/object-name","children":[]},{"id":"ci_097fd3acb59b2f589f86e36f430b00f886a2101599e44a341ba7db3e0ab21814","title":"Object Type [7.2]","path":"/lrsiem/7.17.0/object-type-7-2","children":[]},{"id":"ci_bad804bab8538eb5d0ad591e53f54a5b537074ca9e8d8b5d25295549044467d6","title":"Parent Process ID [7.2]","path":"/lrsiem/7.17.0/parent-process-id-7-2","children":[]},{"id":"ci_b6dfc28d48c4cd0ab63d0f9374e59c5806cbda15cd6760454f2ed834562e93fb","title":"Parent Process Name [7.2]","path":"/lrsiem/7.17.0/parent-process-name-7-2","children":[]},{"id":"ci_247193eb6fa56b7a603b91d6abcc37c167515592cfe7fa9724708ca074f3374b","title":"Parent Process Path [7.2]","path":"/lrsiem/7.17.0/parent-process-path-7-2","children":[]},{"id":"ci_d4d1a7173d0317af056b901a92fc959a3e29d82274a5edc0027913779403c8e9","title":"Policy [7.2]","path":"/lrsiem/7.17.0/policy-7-2","children":[]},{"id":"ci_79b91ff72d80e25ef9ef2cf8c29b3f0f00b12c684ba3c6a41706d9ff861980e3","title":"Process ID","path":"/lrsiem/7.17.0/process-id","children":[]},{"id":"ci_0564fb2bd098a227c442f98209b38d371e17e73f0d7cf63340753b7e746d2bfb","title":"Process Name","path":"/lrsiem/7.17.0/process-name","children":[]},{"id":"ci_789199f2f6908b144c3122308a818d43a148581ba7d0575a575e7f1da61915de","title":"Quantity","path":"/lrsiem/7.17.0/quantity","children":[]},{"id":"ci_985066fc3f588fa800121f131fa3deec8459d3fcfce3782b52da7b35f8fa7da6","title":"Rate","path":"/lrsiem/7.17.0/rate","children":[]},{"id":"ci_5b2f38694ae7ca7cd4a18ba31f87426843aa0a3d0ba673c94ed70ae43f230080","title":"Reason [7.2]","path":"/lrsiem/7.17.0/reason-7-2","children":[]},{"id":"ci_c861b60b8c8518b352ca4de87d7d572d99ff0fb13bae0b20b4105009c2ba6335","title":"Response Code [7.2]","path":"/lrsiem/7.17.0/response-code-7-2","children":[]},{"id":"ci_da40d975b7d1a0d3ae24ba812fec7f68efc744e91cb810bec698784757811845","title":"Result [7.2]","path":"/lrsiem/7.17.0/result-7-2","children":[]},{"id":"ci_08d0c489effdbd8a3205b90a41c5d942257cb0e20763cc1accdac8eed87fbb3f","title":"Session","path":"/lrsiem/7.17.0/session","children":[]},{"id":"ci_f54f6f34ad3487f61673ae16cf859257fd5c3cf3c2361578bd45747101dc2e28","title":"Session Type [7.2]","path":"/lrsiem/7.17.0/session-type-7-2","children":[]},{"id":"ci_2cbf173aa0ffd40d4f5146e2a23f7122d586eedf1e8253366a04cfa286bd0fe3","title":"Size","path":"/lrsiem/7.17.0/size","children":[]},{"id":"ci_cc3fd8e65ee020c48722f8dd46d8a0b3192dd2d7196a3d734e349de3489f7c42","title":"Status [7.2]","path":"/lrsiem/7.17.0/status-7-2","children":[]},{"id":"ci_74ba780ac5ac3c0815f061f43e67a5138dda8b20476b42531c22f94fa4faafb5","title":"Subject","path":"/lrsiem/7.17.0/subject","children":[]},{"id":"ci_e5698c473c031e0b461df0469b21fb89257473cc5c42ce4500f54fdd20c434d1","title":"URL","path":"/lrsiem/7.17.0/url","children":[]},{"id":"ci_cc0ec61f26cb15adce9e2eaaf65ab13bf56ea48bb30d03a5bdbd0254163eb2ec","title":"User Agent [7.2]","path":"/lrsiem/7.17.0/user-agent-7-2","children":[]},{"id":"ci_12eff1c9ffb1602088031a5ef286f00af1599c0050540f8a16849b83b28768ac","title":"Version","path":"/lrsiem/7.17.0/version","children":[]}]},{"id":"ci_a2722409606f7e93ca48020ecd6fb54f11e61936540a1f233db83f8dfb97d6fd","title":"Kbytes/Packets Tab","path":"/lrsiem/7.17.0/kbytes-packets-tab","children":[{"id":"ci_d6bfe849d4cf85bf6c76888b7260fc94b79a177b917698943710359741edcc94","title":"[prefix] [Bits/Bytes] [blank/In/Out]","path":"/lrsiem/7.17.0/prefix-bits-bytes-blank-in-out","children":[]},{"id":"ci_aabf0091b7b158df3fb8e3851f0b146370e7ba692ba4a3265f757be6c1d87f33","title":"Packets [Total/In/Out]","path":"/lrsiem/7.17.0/packets-total-in-out","children":[]}]},{"id":"ci_f644dbaf04f6be321627ea29c683f1be9c6f39cce77c9ba7d4a98503147c33d6","title":"Classification Tab","path":"/lrsiem/7.17.0/classification-tab","children":[{"id":"ci_2d6c68f3f5a61e6e9a0306e0f5c0456b929fcbea0d80eef93e420dc3fff24972","title":"CVE [7.2]","path":"/lrsiem/7.17.0/cve-7-2","children":[]},{"id":"ci_2246ec17dd8602e39cc9ef257cd8af11d59ac5c5bab208584e1e2adea43f279f","title":"Severity","path":"/lrsiem/7.17.0/severity","children":[]},{"id":"ci_91c8d6a9241d69ee3e27419061545d06c8d9910bc9db2045edbb5541e4b4b3a2","title":"Threat ID [7.2]","path":"/lrsiem/7.17.0/threat-id-7-2","children":[]},{"id":"ci_bd51546309832a50935c653527ce2f4358b99d723b82d1c9a8a2562b24901a9e","title":"Threat Name [7.2]","path":"/lrsiem/7.17.0/threat-name-7-2","children":[]},{"id":"ci_34b86f022c323e852081b2a7464d904c33ca1a314cae8dff78accdb368ab49c6","title":"Vendor Info [7.2]","path":"/lrsiem/7.17.0/vendor-info-7-2","children":[]},{"id":"ci_6e2d1133aeb0f2f810ab1c9aae3b5800db52f127ec2db15df73596f30cccc008","title":"Vendor Message ID","path":"/lrsiem/7.17.0/vendor-message-id","children":[]}]},{"id":"ci_854566e7d91546e1738e0a4eb59d340fe837e46dc2abbae539ce0f46e2277c6e","title":"Host Tab","path":"/lrsiem/7.17.0/host-tab","children":[{"id":"ci_7551baafd0adcde2eef0326f3f5e235f4c96304cd8656d84a54359665c10a514","title":"DIP/DestinationIP/Impacted IP","path":"/lrsiem/7.17.0/dip-destinationip-impacted-ip","children":[]},{"id":"ci_23273a8d7428aa19ed9f1d6f243ebd370e2024f81788941f7cc40f29e442f0da","title":"DIPv4","path":"/lrsiem/7.17.0/dipv4","children":[]},{"id":"ci_a24e17a5aa443b01a3dc3688a0a838bfe3ed2dab92ff0e9f16b28f9321d7f6a3","title":"DIPv6","path":"/lrsiem/7.17.0/dipv6","children":[]},{"id":"ci_9f1fdf4fec32bdcef415d3479e1e65f04b062baee0ef1610f319d80abdce3b3a","title":"DIPv6E","path":"/lrsiem/7.17.0/dipv6e","children":[]},{"id":"ci_f58078db161a690caa36aa8096b17ef9a2934d498111004d017d1db6b92caad1","title":"Impacted Hostname","path":"/lrsiem/7.17.0/impacted-hostname","children":[]},{"id":"ci_b7f6f21c9ab9b7e2480fcd9babb13bb66cf84f38793bf1dd6f4d212314bd5a3a","title":"Impacted Hostname or IP","path":"/lrsiem/7.17.0/impacted-hostname-or-ip","children":[]},{"id":"ci_b59eccf08990ddc4b695a49ec8a57c9b8b16252d6e007fafa5efaf9c1342d868","title":"Impacted Interface","path":"/lrsiem/7.17.0/impacted-interface","children":[]},{"id":"ci_1f0804a39a4c3850526b610c3bc07f47c90b68e887a415a6cebf4fcfa039487d","title":"Impacted MAC Address","path":"/lrsiem/7.17.0/impacted-mac-address","children":[]},{"id":"ci_edb96871d6d60cda49e225f4c940a0f00db10e4e2049ff84419bbfadc9031781","title":"Impacted NAT IP","path":"/lrsiem/7.17.0/impacted-nat-ip","children":[]},{"id":"ci_1cf6c1e1df4608cc4d4176d031c2fba83b7a2deec3704b8dba62a86f7e56ddca","title":"IP Address (Origin)","path":"/lrsiem/7.17.0/ip-address-origin","children":[]},{"id":"ci_1604ba8eca02ff39f6f47267aff0cd45b8fb3de7edb7e5f1e423ae6c02ddc15a","title":"Origin Hostname","path":"/lrsiem/7.17.0/origin-hostname","children":[]},{"id":"ci_290d31c5150ba23042ac8311ab3d020cd0230c2021325cd966dd4eeb31bdd4b6","title":"Origin Hostname or IP","path":"/lrsiem/7.17.0/origin-hostname-or-ip","children":[]},{"id":"ci_c1ee3b86b202c366af7306d36b52c416cfe079cb1942349b88f1bd18213d7937","title":"Origin Interface","path":"/lrsiem/7.17.0/origin-interface","children":[]},{"id":"ci_8afe9039b8cf3808b175f149cc7b1347659b660ad9d02c4c60248bec92eae5ce","title":"Origin MAC Address","path":"/lrsiem/7.17.0/origin-mac-address","children":[]},{"id":"ci_ac0cc781e09f9433ae9e1c31729a237ab4f6ed3c5ee19391f0af466f4a919dfd","title":"Origin NAT IP","path":"/lrsiem/7.17.0/origin-nat-ip","children":[]},{"id":"ci_7abf3f68b34a9f86ad9d8c8eb843792bb7dc84af79b0f0bd157366357dc875f9","title":"Serial Number [7.2]","path":"/lrsiem/7.17.0/serial-number-7-2","children":[]},{"id":"ci_7c716727ddb17469754795e5e92a2060e1580675fcf079b5545b2636dc5cdc8b","title":"SIPv4","path":"/lrsiem/7.17.0/sipv4","children":[]},{"id":"ci_293dc4363b0f79803320b41a48d0d238c1cb88cc7c158c9ae5b61eace3c2974d","title":"SIPv6","path":"/lrsiem/7.17.0/sipv6","children":[]},{"id":"ci_d7d086add2f1008b7052661ff90e133ba50c0200339f12e63bba8757e0abf10a","title":"SIPv6E","path":"/lrsiem/7.17.0/sipv6e","children":[]}]},{"id":"ci_c9ad938aff97040a662cfdef44dddb6c573d68bb20095bcb4837cdf761ece26b","title":"Identity Tab","path":"/lrsiem/7.17.0/identity-tab","children":[{"id":"ci_a9c4ce4d39ba7f25c06d9335f27c3a5e0657f417c0be178f5e0bae35340fc1b3","title":"Account > User (Impacted)","path":"/lrsiem/7.17.0/account-user-impacted","children":[]},{"id":"ci_563e21c694aa990bdc7ff237a32a4d868bac3fb839ff9eba2a8010cdb467d1b2","title":"Group","path":"/lrsiem/7.17.0/group","children":[]},{"id":"ci_a6f9c4aa4bf1d84e42dc9b08411806c2c9bea798827e76f8f17fed7b94f9f873","title":"Login > User (Origin)","path":"/lrsiem/7.17.0/login-user-origin","children":[]},{"id":"ci_9bae74c18af2dc2e1ea54581b1cad35722d3057a3895a3fb5b87c8ed66a298ed","title":"Recipient","path":"/lrsiem/7.17.0/recipient","children":[]},{"id":"ci_0c211470af787773736bc8fd712e09b36d9b26842360a7cbffee970837f4feb5","title":"Sender","path":"/lrsiem/7.17.0/sender","children":[]}]},{"id":"ci_6ac7f50213c791a80235dae4fd689f1bbf643afb9aad92a62d834f5c0ff45873","title":"Location Tab","path":"/lrsiem/7.17.0/location-tab","children":[]},{"id":"ci_6598ceed8491e151f09b05a529d57c13fb7d54b68df6731740e9708ac56fa5fe","title":"Log Tab","path":"/lrsiem/7.17.0/log-tab","children":[]},{"id":"ci_b917e2b751780efc8fbc221ffbf678b51e81a45d7ff8ca254a4b86018839164b","title":"Network Tab","path":"/lrsiem/7.17.0/network-tab","children":[{"id":"ci_7de3e6a4a501a40926a1211d5a47f798bb9cfbe775f07c6e00acc06a06c6f392","title":"Domain (Origin) [7.4]","path":"/lrsiem/7.17.0/domain-origin-7-4","children":[]},{"id":"ci_902b605d2c2cf711698cc44cdf60339535e825be515127bd3b1673af86572bf8","title":"Domain [7.2] (Domain (Impacted))","path":"/lrsiem/7.17.0/domain-7-2-domain-impacted","children":[]},{"id":"ci_52b37ceddb0b67b0569ba97aba0a51c887a1e9b5060a47f25f79e9916afccd0b","title":"Impacted NAT Port","path":"/lrsiem/7.17.0/impacted-nat-port","children":[]},{"id":"ci_738487904b6f10c40acedd2c83ed15ac5f0d7563bdb64afe81bc23d2e285145e","title":"Impacted Port","path":"/lrsiem/7.17.0/impacted-port","children":[]},{"id":"ci_267df35e6d04b50d9d2dac05f4a4929eb3a677ce4d66f3378f2a65b7f92e6a34","title":"Origin NAT Port","path":"/lrsiem/7.17.0/origin-nat-port","children":[]},{"id":"ci_9ee73b31793795f60a6223c1e08c80caceec2dd8191ed8324a88fbabdf64652f","title":"Origin Port","path":"/lrsiem/7.17.0/origin-port","children":[]}]},{"id":"ci_e5e956a2148bf005466d94b5b58322cf2d2513f957f071c104be6f14095e6f21","title":"Other MPE Fields","path":"/lrsiem/7.17.0/other-mpe-fields","children":[{"id":"ci_87da71c7be3c56037b3d42e2868ecaac164e267fa9862cc5a24e22fd0f415a92","title":"[Tag1-Tag5]","path":"/lrsiem/7.17.0/tag1-tag5","children":[]},{"id":"ci_d9160364ee499b933f142a782280289f014a615734931d6302217ac4de1f8b3f","title":"Items In","path":"/lrsiem/7.17.0/items-in","children":[]},{"id":"ci_28e733d9ed7b60fd29625ad408eb2b029267168bc3530d1b58d2688693f08513","title":"Items Out","path":"/lrsiem/7.17.0/items-out","children":[]}]},{"id":"ci_b5d43605f216454861297bbd36e647a039908575820809251c1e924eb3093d81","title":"Derived Data","path":"/lrsiem/7.17.0/derived-data","children":[{"id":"ci_c5c765f4188acd6568340298f2d3629d33ddc37b54f715f7e0f7f66064146b10","title":"Identity-Derived Data","path":"/lrsiem/7.17.0/identity-derived-data","children":[]},{"id":"ci_4a7a14c732e316f1e377ab26cdd941077a13ce61b3653d0196ed9e48ec4f078c","title":"Log-Derived Data","path":"/lrsiem/7.17.0/log-derived-data","children":[]}]}]},{"id":"ci_17bf951eb8e095a7f8fd17048e934bf8bb33230be36c3417df1ced9efc5b955b","title":"Other LogRhythm Applications","path":"/lrsiem/7.17.0/other-logrhythm-applications","children":[{"id":"ci_144e42f4fcf0a85c03582299017af175f5d28aee12211b5b5a7e78ac76263546","title":"Threat Intelligence Service","path":"/lrsiem/7.17.0/threat-intelligence-service","children":[{"id":"ci_5ef60c403ddee0525552d66132938ca9cfc543a609d1eb27aac6887c5008c9a6","title":"Install and Deploy the Threat Intelligence Service","path":"/lrsiem/7.17.0/install-and-deploy-the-threat-intelligence-service","children":[{"id":"ci_1ceddd055860e162442ff7f8b191d93252f1baba4d677ab2c90361c1f916192f","title":"Run the Threat Intelligence Service Installer","path":"/lrsiem/7.17.0/run-the-threat-intelligence-service-installer","children":[]},{"id":"ci_da8274e909144eb8e52e89b26e427b551625ca9c2ccc81655d078bb349641753","title":"Modify, Repair, or Remove the Threat Intelligence Service","path":"/lrsiem/7.17.0/modify-repair-or-remove-the-threat-intelligence-service","children":[]},{"id":"ci_3b5c5f7b356583992b2f0e6a74a56151afce0825067b6c3b231a72d845773636","title":"Enable and Import the Threat Intelligence Service Modules","path":"/lrsiem/7.17.0/enable-and-import-the-threat-intelligence-service-modules","children":[]},{"id":"ci_e5b83e13449603e035986be3adb7e991790546d937e21cbc40f22d740675bd8e","title":"Associate Vendor Lists with LogRhythm Lists","path":"/lrsiem/7.17.0/associate-vendor-lists-with-logrhythm-lists","children":[]},{"id":"ci_80427216825bee41d77e53fc8f6b86295410ec8fc12cf7901f9ea8ba81f078b8","title":"Enable Threat List AIE Rules","path":"/lrsiem/7.17.0/enable-threat-list-aie-rules","children":[]},{"id":"ci_71611ef60950e97054f5e1194fc4f56ddc5275aaf08da6257efd2e387240b960","title":"Start the LogRhythm Threat Intelligence Service","path":"/lrsiem/7.17.0/start-the-logrhythm-threat-intelligence-service","children":[]},{"id":"ci_0bad947bc50f06b21f076f5cca32f033c552b90d9814ff291eb6a9da546b53ef","title":"Vendor Lists","path":"/lrsiem/7.17.0/vendor-lists","children":[{"id":"ci_360a375157ae36e63a9e9cb31f13b93ff2de55fc3fbbd0793f43b0eb03bbdd34","title":"BrightCloud","path":"/lrsiem/7.17.0/brightcloud","children":[]},{"id":"ci_d3c1cf70276588a750cc60117cd94dcfee4d1a981f61fa292948a890fa5f8ef4","title":"CrowdStrike","path":"/lrsiem/7.17.0/crowdstrike","children":[]},{"id":"ci_2471619e8444c5a77dd7eecdebb73edeadb3c961e4f85d038b999eae1cad047e","title":"Cisco AMP Threat Grid","path":"/lrsiem/7.17.0/cisco-amp-threat-grid","children":[]},{"id":"ci_e88ab8d7bd2f231a424185bd17dd5b5f4457b15ad9d014490acb1b83164cd43f","title":"Symantec","path":"/lrsiem/7.17.0/symantec","children":[]},{"id":"ci_8a3d1fc0e090ae213981ff68dbade199210b3fde4456f53fe0a247dca8fdb26a","title":"Open Source","path":"/lrsiem/7.17.0/open-source","children":[]},{"id":"ci_256a2890242cdf3c9c090c6a937662caa7ad2ff723dd629acb91fb40f95b54de","title":"Custom Providers","path":"/lrsiem/7.17.0/custom-providers","children":[]}]}]},{"id":"ci_f46a9086e8f7552ae239ac1ce32440347aaf7c9b57bc222644a12e5260cdc7f3","title":"Threat Intelligence Service User Guide","path":"/lrsiem/7.17.0/threat-intelligence-service-user-guide","children":[{"id":"ci_3ab9ac4caf68304b3b1416d617b3781f05cd2791e54d9f18271cf5abf5751d6a","title":"Launch the Service Manager","path":"/lrsiem/7.17.0/launch-the-service-manager","children":[]},{"id":"ci_125e652ca78701033cb0770e0b580d00579b9af3aeccf90a224badebe5735674","title":"Configure the Connection to LogRhythm","path":"/lrsiem/7.17.0/configure-the-connection-to-logrhythm","children":[]},{"id":"ci_4bf0eb8a43524201e4ec561f0deeef511dd1db3b1c946e7e3d4883cfa20ce770","title":"Configure Proxy Settings","path":"/lrsiem/7.17.0/configure-proxy-settings","children":[]},{"id":"ci_1be6d2f125ba3ab5a2cf151445b672334516a3930d35484344d84e2cccfe3aa6","title":"Configure Vendor Threat Feeds","path":"/lrsiem/7.17.0/configure-vendor-threat-feeds","children":[]},{"id":"ci_fc1521be9ae3f5561a870f8b44009e3970a87ca668132c041788ab004e29a6a8","title":"Add a Custom STIX/TAXII Provider","path":"/lrsiem/7.17.0/add-a-custom-stix-taxii-provider","children":[{"id":"ci_af5edd6301f6bbc1ac41c66d9587cc953f4608cc63e3fd5f16591810be593a32","title":"Add a STIX Feed in TIS","path":"/lrsiem/7.17.0/add-a-stix-feed-in-tis","children":[]},{"id":"ci_1b6cd633be5baa887796ea2406d4b9709ff083c86adfaa9ea51e084abbcc38d5","title":"Configure CustomObjectType in STIX/TAXII Feeds in TIS","path":"/lrsiem/7.17.0/configure-customobjecttype-in-stix-taxii-feeds-in-tis","children":[]}]},{"id":"ci_f6ed909cc298b3723c1db5b4872e93d4bf87585eb05ff88c7a041c7b4c8377e0","title":"Start and Stop the Service","path":"/lrsiem/7.17.0/start-and-stop-the-service","children":[]},{"id":"ci_e25a610014cb66e9f19ab809f2acae0965b5eda04a8bc6b698cf01bc1d00f3bb","title":"Configure the Threat Intelligence Service Whitelist","path":"/lrsiem/7.17.0/configure-the-threat-intelligence-service-whitelist","children":[]},{"id":"ci_7d4784d3717af4858094cda40ec275ff868fdeac30164ff54054086bbd6cd17d","title":"URL Normalization","path":"/lrsiem/7.17.0/url-normalization","children":[]},{"id":"ci_2f72e1b87f170cf4d7919357f148e3f395da920d12bc3444de2a4562ce5a25e0","title":"Request Response Logging","path":"/lrsiem/7.17.0/request-response-logging","children":[]},{"id":"ci_edeef374de8a092f918a199a85e9d255cb772ba0493db6a343549f8c14488c58","title":"View Log Files","path":"/lrsiem/7.17.0/view-log-files","children":[]},{"id":"ci_4b5fa44c50f2211456b2c5ef6c36915c8033f991c15d2519e60929b18e0345a8","title":"Troubleshoot the Threat Intelligence Service","path":"/lrsiem/7.17.0/troubleshoot-the-threat-intelligence-service","children":[{"id":"ci_09e3b894950ee87a352c99d91ecba13ee0c1799e81f6fc8871d4349cc6bd3367","title":"Firewall Blocking Open Source URLs in TIS","path":"/lrsiem/7.17.0/firewall-blocking-open-source-urls-in-tis","children":[]},{"id":"ci_cf1174e692f344fe08ecda9e534db84e7d183c2cdd38f0c4e8005cacd9353871","title":"Log Files in TIS","path":"/lrsiem/7.17.0/log-files-in-tis","children":[]},{"id":"ci_78007482429f8f02cd2f58e7db172118d401b5a2f7f72e640d947278cf6846ae","title":"Resource Utilization in TIS","path":"/lrsiem/7.17.0/resource-utilization-in-tis","children":[]},{"id":"ci_a7642f646992604017a5b8e2ecd2f98e480d509be255f63c6fb254ff206fd560","title":"Threat Intelligence Service Will Not Start","path":"/lrsiem/7.17.0/threat-intelligence-service-will-not-start","children":[]}]}]}]},{"id":"ci_e5272fdc92d625856b28ad233490613b60074a6ba03b38389ed582c92c6ce5e8","title":"LogRhythm Diagnostics Tool","path":"/lrsiem/7.17.0/logrhythm-diagnostics-tool","children":[{"id":"ci_46567d76b71486b8c14b650fad4461d8bd554bd85e66c415d2c4d32e67b90151","title":"Install the Diagnostics Agent and Diagnostics Tool","path":"/lrsiem/7.17.0/install-the-diagnostics-agent-and-diagnostics-tool","children":[]},{"id":"ci_84cbfdfdd95ee470c444bf34cd433fe8f331e6a9c8aa63cbe555b2766e75711f","title":"Configure Collection on the Diagnostics Tool","path":"/lrsiem/7.17.0/configure-collection-on-the-diagnostics-tool","children":[]},{"id":"ci_58ee1d0186d8d3e80c19a0fa7e36a704c932d502e02717ba1ef5c1b151aa3c5b","title":"Tabs in the Diagnostic Tool","path":"/lrsiem/7.17.0/tabs-in-the-diagnostic-tool","children":[]},{"id":"ci_c1fc149e13d3c34abec9c6d5d0528bde4fa9afdd7f4c5a630d946e434ade9757","title":"Log Files and Data Collected by the Diagnostic Tool","path":"/lrsiem/7.17.0/log-files-and-data-collected-by-the-diagnostic-tool","children":[]},{"id":"ci_d8ee5159e00d7d926216b5ed15927d0ed0cbb9dfe106febcabc1ce4df458b668","title":"Detailed .zip File Contents From the Diagnostics Tool","path":"/lrsiem/7.17.0/detailed-zip-file-contents-from-the-diagnostics-tool","children":[]}]},{"id":"ci_fc611c2c8fd7d2e818c5fb9cab79770a9d4e47b3659a73814e6950282a43a3aa","title":"LogRhythm Echo","path":"/lrsiem/7.17.0/logrhythm-echo","children":[{"id":"ci_f11b02c017cac4a2436336da78cfa4c9e554f2ca4ae42837d6c0571953fe0999","title":"Install or Upgrade LogRhythm Echo","path":"/lrsiem/7.17.0/install-or-upgrade-logrhythm-echo","children":[]},{"id":"ci_516452cc25603c3fa08e43c5f49429432ba7b3dfa159dc8d24491c53d474681b","title":"Configure LogRhythm Echo","path":"/lrsiem/7.17.0/configure-logrhythm-echo","children":[]},{"id":"ci_a178d4ff326a395551103b3e226505500fc18715424ed615e0602ed4766f36ca","title":"Manage LogRhythm Echo Use Cases","path":"/lrsiem/7.17.0/manage-logrhythm-echo-use-cases","children":[]},{"id":"ci_e2bb4e88c19b78015584ab1d134813a0d512ed7029ac0ee4f33dd934e8615322","title":"Run LogRhythm Echo Use Cases","path":"/lrsiem/7.17.0/run-logrhythm-echo-use-cases","children":[]},{"id":"ci_e5621bdb5a13d2f8b60472ffc767e6836835d3137dd040c39dfc9b490c88e0cf","title":"Schedule LogRhythm Echo Use Cases","path":"/lrsiem/7.17.0/schedule-logrhythm-echo-use-cases","children":[]},{"id":"ci_131e47c6ee630cefe57eda3d2ac71b26b4dc884356a4395f852a29de3717ea33","title":"LogRhythm Echo API","path":"/lrsiem/7.17.0/logrhythm-echo-api","children":[]},{"id":"ci_4c7c2ef332924c51a3ca8a6c840049efbe8af1f7d8d098b370025a13a1f1fb6c","title":"LogRhythm Echo Troubleshooting","path":"/lrsiem/7.17.0/logrhythm-echo-troubleshooting","children":[]},{"id":"ci_55d1522659d22a62ea062f31274bc0f6a8551b20203cf32fcbbe42369df34a75","title":"LogRhythm Echo Use Case DB","path":"/lrsiem/7.17.0/logrhythm-echo-use-case-db","children":[]},{"id":"ci_72adfde7eff9660c3f5488b5e9e60eb4c63f546c2408036589063386e76a2529","title":"LogRhythm Echo Use Cases and Their AIE Rules, Lists, and SmartResponses","path":"/lrsiem/7.17.0/logrhythm-echo-use-cases-and-their-aie-rules-lists-and-smartresponses","children":[]}]},{"id":"ci_6f8e237ae8ca74efb8585e2520eeb4e8345e1f5309e59ce2fba07c8cc8364b04","title":"TrueIdentity Sync Client User Guide","path":"/lrsiem/7.17.0/trueidentity-sync-client-user-guide","children":[{"id":"ci_bf68e1e566199da1b25ab88e45e9a1bd9dbb751b1a4a689a8116847df9f4f92b","title":"TrueIdentity Sync Client Release Notes","path":"/lrsiem/7.17.0/trueidentity-sync-client-release-notes","children":[]},{"id":"ci_2068bef66b8249b8b553ca4497b78de8263387fdc8a363cb1d7841571c5cb89f","title":"Install the TrueIdentity Sync Client","path":"/lrsiem/7.17.0/install-the-trueidentity-sync-client","children":[]},{"id":"ci_0fcc467d006a78fcc943accfbd042d918b6ba9578f96b2962d8aa3773019ef46","title":"Create Custom Certificates","path":"/lrsiem/7.17.0/create-custom-certificates","children":[]},{"id":"ci_6152c8f1d223d2d612060ad5aa8488bd69c7097f90aeddf65f3cbffe2c30a800","title":"Generate LR API Token","path":"/lrsiem/7.17.0/generate-lr-api-token","children":[]},{"id":"ci_dd3cffa753fc46c30c2f04352fe7b961b1270f4d9aaa50d9511c5a6b7a0ff5cd","title":"Launch the TrueIdentity Sync Client","path":"/lrsiem/7.17.0/launch-the-trueidentity-sync-client","children":[]},{"id":"ci_bccab436aadce8caa1f77f8b0a63f65fa30e62df996b32834459087814399793","title":"Add a TrueIdentity Sync Job","path":"/lrsiem/7.17.0/add-a-trueidentity-sync-job","children":[]},{"id":"ci_2fa0f7e10a5345ecb0c63d8e20b745db30f001fad38b92068d0996f303f92651","title":"View Synchronized TrueIdentities","path":"/lrsiem/7.17.0/view-synchronized-trueidentities","children":[]},{"id":"ci_231513ab61f21f733988452ec21d557db0ffe0a4c3e3d1cf994e8be60506d1ca","title":"Troubleshoot the TrueIdentity Sync Client","path":"/lrsiem/7.17.0/troubleshoot-the-trueidentity-sync-client","children":[]}]},{"id":"ci_69759f4ea004e60b42a09daf81666e5a9b65084cfa70013877d1ce8a06323fc2","title":"Using Kibana with LogRhythm SIEM","path":"/lrsiem/7.17.0/using-kibana-with-logrhythm-siem","children":[]}]},{"id":"ci_67d2938ccaaeab88d780f0927a96499da80aa36b168128edadf0bfd218f3c262","title":"Understand the LogRhythm Architecture","path":"/lrsiem/7.17.0/understand-the-logrhythm-architecture","children":[{"id":"ci_68df8b4217dd17204df88de3a2b4710656df290a650718f567e3219d2c59836a","title":"Licensing","path":"/lrsiem/7.17.0/licensing","children":[]},{"id":"ci_f7c7efed09d621998da70556abafe98648c259750545377037d1dc0f84b7f409","title":"Log Processing","path":"/lrsiem/7.17.0/log-processing","children":[{"id":"ci_bcf75445d028ab745cb36c4c6a6d3eb4121970383b450e21a6e9f5b67dd83ab4","title":"Audit Classifications","path":"/lrsiem/7.17.0/audit-classifications","children":[]},{"id":"ci_740c9bf36b97d96548fa409aa8386f1ef5c15655567e626e3300f01b23fd0ab8","title":"Configuration and Log Processing","path":"/lrsiem/7.17.0/configuration-and-log-processing","children":[]},{"id":"ci_f03e8d2e5e6950dc965b39edc4c99447a155c2b2ff2282798ea7aa6fa0640479","title":"Operations Classifications","path":"/lrsiem/7.17.0/operations-classifications","children":[]},{"id":"ci_c527f7688877b01e86e516f3854ea1372bb20935220ffbcc433d0be798223af7","title":"Security Classifications","path":"/lrsiem/7.17.0/security-classifications","children":[]}]},{"id":"ci_0e9ef0c0717a963fcada37c592a4429b1301c4244deb1f8f03b535f402a42a2d","title":"LogRhythm SIEM Databases","path":"/lrsiem/7.17.0/logrhythm-siem-databases","children":[]},{"id":"ci_a4f259a1cf7386e0982132c7940b2a89ef9f369c1c3baa0cec4ff383804b49c6","title":"Logs, Events, and Alarms","path":"/lrsiem/7.17.0/logs-events-and-alarms","children":[]},{"id":"ci_b413ff49e193675b3e95448d736a6a22f2f2174a20d8176d32c19278d505b151","title":"Networking and Communication","path":"/lrsiem/7.17.0/networking-and-communication","children":[]},{"id":"ci_545c009b30bc2f4c91689edd6421cb973b816fcd7b0aaa52de591f92f10cacfd","title":"Component Reference","path":"/lrsiem/7.17.0/component-reference","children":[]}]},{"id":"ci_7c6844e7628e4947a82a87300807e87694ea8ec080f59e035aa724800d649b79","title":"Find More Information","path":"/lrsiem/7.17.0/find-more-information","children":[{"id":"ci_b3b661e2e47832c2b1dc3bb5f58717778669df138f18aaf560a7045b9f614d8a","title":"Customer Support Guide","path":"/lrsiem/7.17.0/customer-support-guide","children":[]},{"id":"ci_7e83ecfed13d0fb3f3d8a84b06814384d53de28d29f2f62af568b6c97f2b49c8","title":"End of Life Policies for Software and Hardware","path":"/lrsiem/7.17.0/end-of-life-policies-for-software-and-hardware","children":[]},{"id":"ci_173b200c8b1e8f79ca7db229a0494245301089c6594372f920ebeb264dd50dac","title":"Glossary of LogRhythm Products and Components","path":"/lrsiem/7.17.0/glossary-of-logrhythm-products-and-components","children":[]},{"id":"ci_6044c33c636e6abea44cdec4bf5c38fbc14ed03f2b944a77fed6cd449ea2873f","title":"Open Source License Acknowledgements","path":"/lrsiem/7.17.0/open-source-license-acknowledgements","children":[]},{"id":"ci_8c705d04ead123a795c7aec240dcdd9326912d0c70c04fe9dd3f6b28bd4581c8","title":"Upgrade FAQ and Determining the Correct Upgrade Path","path":"/lrsiem/7.17.0/upgrade-faq-and-determining-the-correct-upgrade-path","children":[]}]},{"id":"ci_a64643ad9368126e65f3bbbfbe559d3162fd5b993591386b8e3ed3db75c8ee54","title":"Download PDFs","path":"/lrsiem/7.17.0/download-pdfs","children":[]}]