Skip to main content
Skip table of contents

7.15.0 GA Release Notes - 4 January 2024

Getting data into your LogRhythm instance is crucial, and LogRhythm is intensely focused on making that easy to do. LogRhythm SIEM 7.15 builds on the innovation we delivered in the previous releases.

What’s new in SIEM 7.15:

  • Simplified onboarding for Windows Event logs

  • Improved analyst workflow when reviewing alarm notifications

  • New LogRhythm SIEM in-app tutorials

  • Additional Beats supported in the Web Console

  • New and updated log sources

Key Highlights


Onboard New Log Sources in the Web Console

Onboarding new log sources should be easy. That’s why we’ve expanded the number of Beats LogRhythm Administrators can manage from the Web Console. By onboarding log sources in the Web Console, you can save time and cut your Beat Administration workload in half. In this latest release, LogRhythm now supports management for six additional Beats including:

  • Gmail Message Tracking

  • GSuite

  • Okta

  • Darktrace

  • Sophos

  • Qualys FIM


Platform Enhancements

Managing a SIEM platform isn’t always easy, so our team has made your experience even better. LogRhythm 7.15 features platform improvements that enhance your workflows, save you time, and reduce the number of steps your team takes to complete a task. 

Migration Path to Rocky Linux  

As CentOS 7 reaches the end of life from the Red Hat organization, we understand the importance of providing an alternative operating system to migrate Data Indexer (DX) and Open Collector (OC) machines. That’s why LogRhythm created a detailed guide for migrating to Rocky Linux. This migration path offers customers continued support from the OS vendor to address security and bug fixes.  

Automatic Flat File Path Population for Windows Event Logs 

To make the workflow and tasks easier for LogRhythm SIEM users, we’ve changed a setting to auto-populate the flat file path for Windows Event Log-based log sources. For example, when users add Windows PowerShell or Windows SysMon Event logs, LogRhythm SIEM now auto-updates that field. This update saves users time and provides a more streamlined experience. 


Web Console Log Export in Users’ Local Time 

LogRhythm has made it easier to convert time zones when exporting logs from the Web Console to a CSV file. Customers can now export CSV files in their local time zone versus having to convert from the Coordinated Universal Time (UTC) time zone. Now users don’t have to go through the cumbersome conversion process to identify the correct time, improving their experience with the SIEM platform. 


URL Links in Alarm Notifications 

Navigating to an alarm from a notification is easier than ever. Our team improved the experience to direct you to alarm details even if you previously weren’t logged into the Web Console. After clicking a URL in a notification and logging into the Web Console, LogRhythm now automatically routes you to the correct alarm. This update saves you time and removes the hassle of searching for important notifications. 

In-Platform Resource Center Tutorials

In SIEM 7.15, we’re continuing to improve the Resource Center. We’ve added in-app tutorials to help new users quickly understand how to leverage the power of LogRhythm. Our newest tutorials are listed in the Onboarding section of the Resource Center. Onboarding topics include Dashboards, Searches, Case Management, Alarm Management, and Beat Management. These topics will help a new LogRhythm SIEM Analyst or Administrator understand the key principles of LogRhythm SIEM. With the Resource Center, users can quickly view in-app Announcements and Onboarding tutorials and easily access Documentation, Community, and Support.

Log Source Enhancements

We are constantly enhancing our ability to help our customers collect and receive value from log sources in their environment. A big part of that is constantly making updates to our parsing policies via KB updates.  

We get it, technology changes at a rapid pace. This often means LogRhythm needs to revisit log sources we already support and help customers derive more value by accounting for changes and quickly evolving. 

LogRhythm is continuing to review our supported log sources and make updates to strengthen our correlation and analysis. Our new and enhanced methods of ingestion include:    


LogRhythm Enhancement

Fortinet FortiNAC

New log support for FortiNAC, which protects against IoT threats, extends control to third-party devices, and orchestrates automatic responses to a wide range of networking events.

strongSwan VPN

New log support for strongSwan, which is a complete IPsec solution providing encryption and authentication to servers and clients.

F5 BIG-IP System

New log support for BIG-IP System, which is a set of application delivery products that work together to ensure high availability, improved performance, application security, and access control.

Tenable OT

New policies help prevent classification errors and provide more consistent parsing of log source data for Tenable Operational Technology (OT). And new MPE rules parse log metadata to the correct schema fields and classify highly complex log source data.


New log support for QRadar Network Security, which is used to detect hidden threats on your networks with deep, broad visibility and advanced analytics.


Updated policies and workflow for collecting logs from Mimecast.

Imperva Database Activity Monitor (DAM)

Updated policies help prevent classification errors and provide more consistent parsing of log source data for Imperva Database Activity Monitor (DAM). Andd new MPE rules parse log metadata to the correct schema fields and classify highly complex log source data.

Palo Alto Cortex Data Lake

Updated policies for schema changes to help prevent classification errors and provide more consistent parsing of log source data for Palo Alto Networks® Cortex Data Lake, which provides cloud-based, centralized log storage and aggregation for your on-premise, virtual (private cloud and public cloud) firewalls, for Prisma Access, and for cloud-delivered services such as Cortex XDR.

Enhancements & Resolved Issues

Bug #




Active Directory

SQL script was updated to delete duplicate AD users.



Transparent framing logs are now processed as expected.



Log collection works as expected without establishing multiple connections to each beat, and scsm.ini files are no longer becoming corrupt on Agents.


Agents: Beats Collection

Log collection works as expected without establishing multiple connections to each beat.


Agents: GCP SCC Log Collection

Agent hostname is no longer parsed into sname.


Agents: Licenses

After purchasing and importing new licenses into SIEM, customers can now view their new licenses after they have been installed.


Agents: Linux

Linux agents are now working as intended.


Agents: MSGraph API Log Collection

Parsing improvement for logs ingested via the MSGraph API Beat.


Agents: Office 365 Log Collection

When multiple O365 Message Tracking log sources are configured on a single System Monitor Agent, the logs are now organized under the correct log source.


Agents: Qualys Log Collection

Log collection from a Qualys log source now works as expected.


Agents: Windows Event Log Collection

When adding a Windows Event Log source manually or when using the Windows Host Wizard, the target file path automatically populates. If a path cannot be populated, the user is prompted to populate it and is given the proper format.


AI Engine

When evaluation frequency is set to 20 minutes or longer, AIE rules are now reliably triggering alarms.


AI Engine: MPE Rules

The MPE Rule Builder no longer hyperlinks text.


AI Engine: MPE Rules

Users no longer get an error when sorting custom MPE Rules with Rule Sorter.


AI Engine: MPE Rules

Users no longer get an error when sorting custom MPE Rules with Rule Sorter.


Client Console

When users click “Compare With” in SysMon Version History, they no longer receive an error.


Client Console

Users can now create a new root entity without receiving timeout errors.


Configuration Manager

The Configuration Manager now correctly references UEBA settings instead of CloudAI.


DP Pooling

Logs are now spread more evenly among Data Processors within a DP Pool.



Added callout to REST API docs confirming that only Global Admins can access third-party applications.



Updated the first line of Deployment Monitor documentation to specify Global Admins.



Updated documentation covering how to upgrade the Data Indexer to mitigate upgrade failures.


Infrastructure: Database Scripts and Upgrade Scripts

Running LRII to upgrade a deployment no longer fails or returns errors when overwriting a backup file.



The Mediator cache refresh logic was adjusted in large LRCloud deployments with many System Monitor Agents and Data Processors. The new logic mitigates overloading the deployment with too many cache refreshes.


Search API

The Search API no longer fails when the LogRhythmWebUI account password is changed to a non-default password.


Search API

The Search API no longer fails when the LogRhythmWebUI account password is changed to a non-default password.



When a SecondLook search is executed on the Web Console, the saved search now shows the correct owner name.



Windows agents no longer stop sending heartbeats or logs after a Mediator reconnection.



Multiple enhancements have been made to improve the performance of the Linux Agent.



Memory issue in Windows agent is now fixed by reducing the TCP and TLS file sizes in the suspense folder.



Setting the Host EntityID to 0 in the System Monitor Agent configuration no longer keeps the Agent from connecting to the Data Processor. Instead, the setting reverts back to the original EntityID.



Log collection works as expected without establishing multiple connections to each beat.



The LogRhythm Diagnostics Agent no longer consumes memory when it has not been configured.


Web Indexer

On high log volume systems, the Web Indexer no longer fails with “Out of Memory heap” exception.


Web Console

The Log Sources list now displays properly in the Web Console UI.


Web Console

On systems with a large number of log sources, the Web Console dashboard now loads without displaying errors.


Web Console

The Web Console Analyzer no longer displays a deleted set of logs, nor does it display blank values when logs are present.


Web Console

When performing a search or AIE drill down in the Web Console, users no longer need to refresh the page to view the results.


Web Console

After users make changes to the Web Console Settings, the updated settings now persist when navigating throughout the user interface.


Web Console

The "Component Status" widget now correctly shows the component name along with other values in the "Component Widget" status in version 7.9.


Web Console

When users click on an alarm link in an external application like an email notification, the link now opens the alarm page after required credentials have been verified.


Web Console

When a Restricted Admin has permissions to manage an Entity in management settings, they can now create a dashboard for that Entity in the Web Console.

Resolved Issues - Security

Security-related issues resolved with this release are available for customers to view in the Community.

Known Issues

The following issues have each been found and reported by multiple users.

Bug #

Found In Version



Release Notes



Alarm API

When using the XSOAR integration with Alarm API, requests periodically return a 500 internal server error.

Expected Results: The integration should work without returning an error.

Workaround: Retry the request until it succeeds.



Knowledge Base

When parsing logs associated with Syslog Linux Host, the Mediator returns the following error message:

“Regex rule match timed out.”

Expected Results: The regex rule should parse successfully without timing out.

Workaround: There is currently no workaround for this issue.



SmartResponse Plugins

When SmartResponse Plugin scripts are modified but not triggered for 7 days, the custom changes are deleted and the SRP reverts to default settings.

Expected Results: When SRP scripts are modified, the changes should be retained.

Workaround: There is currently no workaround for this issue.




Web Console

After upgrading to 7.12 or 7.13, the CAC authorization used to log in to the Web Console stops working.

Expected Results: The CAC authorization should work when logging in to the Web Console.

Workaround: There is currently no workaround for this issue.

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.