Breadcrumbs

Configure the Advanced Intelligence Engine


  1. On the main toolbar, click Deployment Manager.

  2. Click the AI Engine tab.

  3. Click the Servers tab at the bottom.

  4. Double-click the server name.
    The AI Engine Server Properties dialog box appears.

  5. Configure the AI Engine Server Properties.

    1. Host

    2. Name

    3. Workload (default is Global Workload)

    4. IPv4 Address

    5. (Optional) IPv6 Address

    6. (Optional) IPv6 Address

    7. (Optional) Primary DX Cluster

    8. (Optional) Secondary DX Cluster

Starting with LogRhythm SIEM version 7.23.0, AI Engine events are able to be duplicated into the Data Indexer. Select a Primary (and, optionally, a Secondary) DX Cluster to choose where these AI Engine events are duplicated.

You must select at least a Primary DX Cluster if you want your Data Indexer (DX) Dashboards in the LogRhythm Web Console to access AI Engine event information.

  1. (Optional) Click Advanced. 
    The AI Engine Server Advanced Properties dialog box appears.

  2. Change any property values you need to, and then click OK.

    Only make changes to the AI Engine Server Advanced Properties with the assistance of LogRhythm Support.

    If you have a firewall turned on in the system that has either the Mediator or the AI Engine, you must change the ServerMgmtPort value to 30000 and the ServerDataPort value to 30001.

  3. Click OK.

  4. Click the Data Processors tab.

  5. Double-click on the server name or right-click and then click Properties.
    The Data Processor Properties dialog box appears.

  6. Click the AI Engine tab.

  7. Click Properties.
    The Data Processor to AI Engine Server Advanced Properties dialog box appears.

  8. Edit the Properties.

    1. Select the Enable communication to this AI Engine Server check box.
      The Data Processor automatically sends logs to the Server based on the assigned workload.

    2. (Optional) Enter the Client Management Port.Specify the Sending Port. Management and Data must use distinct ports.
      Default = 0 for a random sending port (recommended)

      If you have a firewall turned on in the system that has either the Mediator or the AI Engine, you must change the Client Management Port to 3334.

    3. (Optional) Enter the Client Data Port.Specify the Sending Port. Management and Data must use distinct ports.
      Default = 0 for random sending port (recommended)

      If you have a firewall turned on in the system that has either the Mediator or the AI Engine, you must change the Client Data Port to 3335.

    4. (Optional) Select the Client (sending) Address Override check box.Enter a valid IPv4 or IPv6 address on the Data Processor.

    5. (Optional) Select the Server Address/DNS Name Override check box.Enter a valid IPv4 or IPv6 address on the AI Engine Server Communication Manager.

    6. (Optional) If this check box is selected, the AIE Communication Manager skips the validation check on the IP address and Port. As a result, the AIE Communication Manager starts working for environments in which the IP address or port is not predictable, for example, with Network Address Translation.

  9. Click OK.

  10. Click OK. 
    The Restart Component dialog box appears if a setting has been modified. A restart is required for changes to take effect.

  11. Click OK.