7.18.0 GA Release Notes - 1 October 2024

• MS Windows Event Logging XML – DNS

• Syslog – Akamai CEF

• Syslog – Anomali Threatstream

• Syslog – Aviatrix

• Syslog – F5 Big-IP ASM CEF

• Syslog – Fortinet FortiADC

• Syslog – Guardium CEF

• Syslog – ManageEngine AD Self Service Plus

• Syslog – Open Collector – Exabeam Cases

• Syslog – PowerTech CEF

• Syslog – Pure Storage

• Syslog – Rubrik

• Syslog – Sysmon for Linux

• API – AWS CloudWatch Alarm

• Flat file – JBoss Log File

• Flat File – Linux Host Secure Log

• Flat File – Microsoft IIS W3C File

• MS Windows Event Logging – DNS

• MS Windows Event Logging XML – Application

• MS Windows Event Logging XML – PowerShell

• MS Windows Event Logging XML – Security

• MS Windows Event Logging XML – System

• Syslog – Fortinet FortiGate

• Syslog – SonicWall

• Syslog – Check Point Log Exporter

• Syslog – Cisco APIC

• Syslog – Cisco ASA

• Syslog – Cisco FirePOWER

• Syslog – Cisco Meraki

• Syslog – Cisco Web Security

• Syslog – Citrix NetScaler

• Syslog – Citrix XenServer

• Syslog – Dell PowerConnect Switch

• Syslog – F5 Big-IP ASM

• Syslog – FireEye MPS

• Syslog – Fortinet FortiMail

• Syslog – Generic Linux OS

• Syslog – InfoBlox

• Syslog – Imperva SecureSphere

• Syslog – Juniper Switch

• Syslog – Lancope StealthWatch CEF

• Syslog – Linux Audit

• Syslog – Linux Host

• Syslog – LOGbinder SQL

• Syslog – Open Collector – Azure Event Hub

• Syslog – Oracle 10g Audit Trail

• Syslog – Oracle 11g Audit Trail

• Syslog – Palo Alto Networks Cortex Data Lake CEF

• Syslog – Palo Alto Firewall

• Syslog – SentinelOne CEF

• Syslog – Snort IDS

• Syslog – SonicWall

• Syslog – Sourcefire IDS 3D

• Syslog – Sophos XG Firewall

• Syslog – Symantec ATP CEF

• Syslog – Tenable.ot Security

• Syslog – Thycotic Secret Server

• Syslog – Trend Micro Apex One

• Syslog – Trend Micro Deep Security CEF

• Syslog – Tufin

• Syslog – VMWare ESX/ESXi Server

• Syslog – VMWare NSX/NSX-T

• Syslog – VMWare vCenter Server

• Syslog – VMWare vRealize Operations

• Syslog – Watchguard FireBox

• Syslog – Zscaler Nano Streaming

ENG-11163

Documentation: Search

The Basic Queries documentation has been updated to be clearer regarding Lucene filters.

ENG-11184

Smart Response Plugins

The CrowdStrike Smart Response Plugin (SRP) has been updated to resolve an error relating to the API base URL.

ENG-24428

Client Console: Log Sources Grid

The Log Sources grid has been enhanced in a number of ways to improve performance. Refer to the Client Console Improvements to Log Sources Grid section of the release notes for more information.

ENG-36433

Reporting

An issue with the “Case Details” report under the Case Management class of reports not providing results limited to the specified timeframe has been resolved.

ENG-38427

Client Console: Lists

When editing a list, the TTL Expiring Items option can now be unchecked as expected.

ENG-39760

APIs

The API workflow UI has been updated to be clearer regarding modification of the API key’s expiration date.

ENG-50328

APIs

The LR Metrics API Log Volume endpoint search now returns consistent and correct values.

ENG-52744

Metrics

The AIE Metrics Dashboard in Grafana now correctly auto-refreshes and updates when changing the Host value.

ENG-53808

User Profiles

Changes made in User Profile Manager now correctly update after a sync.

ENG-53846

AI Engine

An issue with the “Notify the following groups” section of the AIE Notify tab sending notifications regardless of whether the options “Is Silent” or “Can Batch” are checked has been resolved.

ENG-54557

Reporting

The “Normal Date” field can now correctly be saved as a top-level group field in a custom report template.

ENG-54671

Reporting

When exporting the Investigation report to a .csv file, the “Direction” field now correctly displays “Unknown” instead of a blank field.

ENG-58107

Metrics

Grafana has been updated to version 10.3.7 for Centralized Metrics.

ENG-58299

APIs

The Admin API can now correctly be used to create new syslog log sources with virtual identifiers enabled and assigned.

ENG-58413

Log Parsing

The JSON System Monitor Agent Okta parser has been updated so that “alternateID” is used for account/login parsing instead of “id”.

ENG-58812

Web Console

Custom filters on a Web Console Dashboard are now correctly maintained when drilling down on a Dashboard item.

ENG-59097

AI Engine

Two new optional parameters have been added to the LRAIEngine.ini file that can control the processing of AIE Stats:

DiagnosticsEngineStatsWritingInterval=1 [Default - 1, Min - 1, Max 60]
DiagnosticsBlockRuleStatsWritingInterval=20 [Default - 20, Min - 20, Max 120]

ENG-59183

Web Console

The Log Sources list now displays properly in the Web Console UI.

ENG-59310

Search

An issue where finding a log exception during a search caused the search to halt completely has been resolved. Now, the log exception is marked as missed and the search loop continues as expected.

ENG-59388

Log Parsing

Additional parsing fields have been added to the Cisco Duo log source type.

ENG-59427

AI Engine

AI Engine Data Provider statistics are now correctly logged in the lraiedp.log file.

ENG-60405

AI Engine

An issue with incorrect Data Provider values being displayed within the AIE Communication Manager has been resolved.

ENG-60768

Log Parsing

Additional parsing fields have been added to the Proofpoint log source type.

ENG-61115

Documentation: FIPS

The LogRhythm FIPS package located on the Community has been updated for versions 7.17 and 7.18, and the documentation for Configure LogRhythm DX has been updated with additional steps to ensure the FIPS package is successfully implemented.

ENG-61136

Reporting

The Log Volume by Day report now correctly gives consistent results, including no longer dropping days from selected timeframes.

ENG-61182

System Monitor: Mediator

The Mediator now reloads its System Monitor configuration cache once per minute as opposed to every time a System Monitor connects. This prevents the SQL server from being overwhelmed by config cache updates.

ENG-61277

Log Parsing

The JSON System Monitor MSGraphBeat parser has been updated with additional fields.

ENG-61359

Log Parsing

Resolves various parsing issues with the Data Processor parser.

ENG-61401

Documentation: APIs

The documentation for the LR Admin API endpoint UpdateLogSource has been updated to correctly state the required fields.

ENG-61737

Log Parsing

The JSON System Monitor Azure Event Hub parser has been updated with additional fields.

ENG-41651

7.12

Web Console

After upgrading to 7.12 or newer, the CAC authorization used to log in to the Web Console stops working.

Expected Results: The CAC authorization should work when logging in to the Web Console.

Workaround: There is currently no workaround for this issue.

ENG-62271

7.18

Data Indexer

After upgrading to 7.18, LogRhythm has bundled an upgrade to Elasticsearch OSS 7.10.2 which uses log4J version 2.11.1 and may flag on scanners as being affected by a remote code execution vulnerability in the JNDI parser.

LogRhythm bundled in the jvm options of the 7.18 release mitigations for the log4J vulnerabilities by setting the “-Dlog4j2.formatMsgNoLookups=true”. This is present on both the Windows and Linux build of the Data Indexer. Scanner findings can be considered a false positive.

The log4J version will be updated in a future release as part of the DX Update roadmap in 2025.

ENG-62275

7.18

Data Indexer

Searches containing more than 65k fields/terms in the query may fail. This includes searches using lists with >65k items in them.

Workaround:

1. Adjust the default terms limit to all existing indexes in the cluster. This will allow large term searches to existing indexes. LogRhythm limits list sizes to 2M, so searches should never exceed 4M. This command only needs to be run once per cluster:

   CODE

   curl -X PUT "localhost:9200/_all/_settings?pretty" -H 'Content-Type: application/json' -d'
   {
     "index" : {
       "max_terms_count":4096000
       }
   }'

2. Modify the transporter logs.json and restart the transporter service on all nodes. This will implement the setting in future indexes when created. Do not copy this file from another cluster/deployment, as there are other values in this that are dynamically set upon installation. Overriding these values with incorrect settings could have a detrimental and irreversible impact to the cluster.

Linux systems must update all nodes in the cluster - /usr/local/logrhythm/transporter/logs.json
Windows systems - C:\Program Files\LogRhythm\Data Indexer\Transporter\logs.json

1. Add the line "max_terms_count": "4096000", under the Index settings section:

   CODE

   {
      "logs": {
         "index_patterns": ["logs*"],
         "order": 0,
         "settings": {
            "index": {
               "max_terms_count": "4096000",
   

After modification to the transporter template, restart the service.

ENG-62332

7.18

Data Indexer

Clusters Containing >600 days of Hot TTL fail to create new indexes due to Shards Per Node limit

Workaround:

• Adjust GoMaintain TTL from -1 to 365days or less.

  • Clear restore archive indexes using “curl -xdelete localhost:9200/logsar-*”

ENG-62339

7.18

Client Console

Some customers may experience issues with displaying “Last Log Messages” under the Deployment Manager > Log Sources tab. This appears to be isolated to conditions where the OS region does not match the region configured in client console, but the languages are the same. (OS = US/English, Client Console = Indonesia/English)

Workaround:

• Use the Deployment Monitor tab to observe last log message values.

• Modify the Region and Language settings to match between client console and on your Platform Manager.