[{"id":"ci_a835697d463d1534d4ed660dc5b8ebc15a2ad95a07b1aa58ce3510ffb5cf8802","title":"LogRhythm Release Notes","path":"/lrsiem/docs/logrhythm-release-notes","children":[{"id":"ci_196d7fed3821071c09eb1442c8cf7702dd2dbab2bb4c4f0bd5ca1bcb1430103e","title":"7.24.0 GA Release Notes - 1 April 2026","path":"/lrsiem/docs/7-24-0-ga-release-notes-1-april-2026","children":[]},{"id":"ci_d01f6e44d35e7791a5752abda983e18173aba936d4637188df5ed6c588f5619a","title":"7.23.0.119 Release Notes - 29 January 2026","path":"/lrsiem/docs/7-23-0-119-release-notes-29-january-2026","children":[]},{"id":"ci_f000681a3bd7b0119f6562d48bcb9f68ebb6828fdf0dc38f0abaeb7158b082bc","title":"7.23.0 GA Release Notes - 6 January 2026","path":"/lrsiem/docs/7-23-0-ga-release-notes-6-january-2026","children":[]},{"id":"ci_2edd327da567b3916d827d6ca87810bd463ccacc3daef02be59006dcb73af34e","title":"7.22.0 GA Release Notes - 1 October 2025","path":"/lrsiem/docs/7-22-0-ga-release-notes-1-october-2025","children":[]},{"id":"ci_6b46866978dc29fca854b0ba73ecb3ec4eab20cbdb59bdce4181f10e24b5bc71","title":"7.21.0.97 Release Notes - 6 August 2025","path":"/lrsiem/docs/7-21-0-97-release-notes-6-august-2025","children":[]},{"id":"ci_1256a9da36a524c17dc5217896ea1a1fd064508e02291000adb61802a99fe471","title":"7.21.0 GA Release Notes - 1 July 2025","path":"/lrsiem/docs/7-21-0-ga-release-notes-1-july-2025","children":[]},{"id":"ci_a8c9886a6c99f55033a638de2710898e0133724113a796f771eb598ab1cf1311","title":"7.20.0.71 Release Notes - 23 April 2025","path":"/lrsiem/docs/7-20-0-71-release-notes-23-april-2025","children":[]},{"id":"ci_f0afff5dd06f8610a8a0e99102cc09268db8493aa43fc5df7ed93d9e94870a37","title":"7.20.0 GA Release Notes - 1 April 2025","path":"/lrsiem/docs/7-20-0-ga-release-notes-1-april-2025","children":[]},{"id":"ci_cc10176f45310ff54387dbdc9f4381a4251f075fa883eddd12484d14d66c30b3","title":"7.19.0.54 Release Notes - 3 February 2025","path":"/lrsiem/docs/7-19-0-54-release-notes-3-february-2025","children":[]},{"id":"ci_20a500f3bbdd4acef664d9bc0b2a7351b788cc7203718861dd2024b3a812f691","title":"7.19.0 GA Release Notes - 7 January 2025","path":"/lrsiem/docs/7-19-0-ga-release-notes-7-january-2025","children":[]},{"id":"ci_7a80c545f7a820e067b8d41705367ab0ccbb2531ca8f8b1423634a33c827c484","title":"7.18.0.48 Release Notes - 7 November 2024","path":"/lrsiem/docs/7-18-0-48-release-notes-7-november-2024","children":[]},{"id":"ci_a236e5eca5625bebed7921cf242cc2e116bd912f8496931bb166b11e673ef148","title":"7.18.0.46 Release Notes - 31 October 2024","path":"/lrsiem/docs/7-18-0-46-release-notes-31-october-2024","children":[]},{"id":"ci_e284daff9e01e0312e0a56de3f166973fffaf3c8f35c3df809641051813c7176","title":"7.18.0 GA Release Notes - 1 October 2024","path":"/lrsiem/docs/7-18-0-ga-release-notes-1-october-2024","children":[]},{"id":"ci_58cf0b0059602ff335a9c6698d0d029fbc89ebe759cd8130f5c6990bf620e7f1","title":"7.17.0.55 Release Notes - 12 August 2024","path":"/lrsiem/docs/7-17-0-55-release-notes-12-august-2024","children":[]},{"id":"ci_fe1e2f928087a2948a537fa432f750e28eae3e372abd8cc9b8b121c82f825b63","title":"7.17.0 GA Release Notes - 1 July 2024","path":"/lrsiem/docs/7-17-0-ga-release-notes-1-july-2024","children":[]},{"id":"ci_6b5a3ade5740c31b786f869ec60f7300a65e09b4b004b0ff9082790f529d3a59","title":"7.16.0.45 Release Notes - 24 April 2024","path":"/lrsiem/docs/7-16-0-45-release-notes-24-april-2024","children":[]},{"id":"ci_8247a81cd9c3bdad2716926e5bb45d8e4c83fb1bd2a3901271d1a35de1cee3a1","title":"7.16.0 GA Release Notes - 1 April 2024","path":"/lrsiem/docs/7-16-0-ga-release-notes-1-april-2024","children":[]}]},{"id":"ci_b29eb0beb580bfb4cf80ee5268437f85edb3080e40101cb47659ff59868278a0","title":"Get Started with LogRhythm SIEM","path":"/lrsiem/docs/get-started-with-logrhythm-siem","children":[{"id":"ci_7378f5036518dbacb10cd7979ddd9021d19ba3e4ecea000453ea98d17497b5a8","title":"Log in to the Client Console","path":"/lrsiem/docs/log-in-to-the-client-console","children":[]},{"id":"ci_8d0a812bebe992c2c291884e18d56bdb008426bd0abc0d15bc7d66acb04b804d","title":"Complete the New Deployment Wizard","path":"/lrsiem/docs/complete-the-new-deployment-wizard","children":[]},{"id":"ci_5ed6822474fd34cd446d647fd45d6c500daf394b7ebbae0e3545b05651471a7b","title":"Assign LogRhythm Licenses","path":"/lrsiem/docs/assign-logrhythm-licenses","children":[]},{"id":"ci_c4598fa242a1dd796a1b44fbfd7fcb387661220a237c782e825fb90366b1cb8f","title":"Log in to the Web Console","path":"/lrsiem/docs/log-in-to-the-web-console","children":[]},{"id":"ci_c57219bfd0a67ea3eade3121265ed2fc329de1f8c801621b1926a421fc69cc5b","title":"Verify the Web Console Connection Status","path":"/lrsiem/docs/verify-the-web-console-connection-status","children":[]},{"id":"ci_11fabdec1052cb710abc481d9aa9d9887aa7f294f34ef65f196daeceaae1be9e","title":"Configure NetMon to Integrate with the Web Console","path":"/lrsiem/docs/configure-netmon-to-integrate-with-the-web-console","children":[]}]},{"id":"ci_23fce432f70b374f3501674317559b95057599e30e5f66c217e058e04407c504","title":"Client Console Administrator Guide","path":"/lrsiem/docs/client-console-administrator-guide","children":[{"id":"ci_b867d932c256fac7b7ab53a4f9946295795762a5f51794262979740782c0b5af","title":"Advanced Intelligence Engine","path":"/lrsiem/docs/advanced-intelligence-engine","children":[{"id":"ci_34757f6273cfda2b725e090eaab0d9cd1d65b5aef6eb0c543fa8cacad1e5867b","title":"Add AI Engine Servers","path":"/lrsiem/docs/add-ai-engine-servers","children":[]},{"id":"ci_63a6f2adf0811d02cfbd0fd23f541fb425526a0a77cf51f1cee213cb2b8f9758","title":"Apply Recommended Values to an AI Engine Server","path":"/lrsiem/docs/apply-recommended-values-to-an-ai-engine-server","children":[]},{"id":"ci_24109791a0bfa2f81c2b9596c5f3892a9cae6ef47e20b5943f2b7d03cfc78b5b","title":"Configure the Advanced Intelligence Engine","path":"/lrsiem/docs/configure-the-advanced-intelligence-engine","children":[]},{"id":"ci_3ceefcd2b4c0e28cc09ead1b2d4e5e1e025f3a07cb9006633cdd0a137f16f68b","title":"Create New AI Engine Rules","path":"/lrsiem/docs/create-new-ai-engine-rules","children":[]},{"id":"ci_547f6a243e98e5d289c13dde7da5b2632e3d3b9b370c0f1af699b454c0c2437a","title":"Define AI Engine Linked Data Block Relationships","path":"/lrsiem/docs/define-ai-engine-linked-data-block-relationships","children":[]},{"id":"ci_5aba714d9976defe0c74f673b895ad4b413ed0fffd1ab37c3f166a10d5fa0208","title":"Define AI Engine Rule Block Relationships","path":"/lrsiem/docs/define-ai-engine-rule-block-relationships","children":[]},{"id":"ci_c079c366b493a168de27bc89735f32f9d050c372b77e0d4efe3385b79cef80fd","title":"Drill Down on AI Engine Results","path":"/lrsiem/docs/drill-down-on-ai-engine-results","children":[]},{"id":"ci_683b6f4ad710c592a58b67f1a0fa6a18de9473e27cd0daeeaab77ed04854c5e5","title":"Import or Export AI Engine Rules from the Grid","path":"/lrsiem/docs/import-or-export-ai-engine-rules-from-the-grid","children":[]},{"id":"ci_e6c6bbc60f4841887e7b4946be15d6cb537f25f7925aab67ae13ebc6b7916410","title":"Modify AI Engine Rules","path":"/lrsiem/docs/modify-ai-engine-rules","children":[]},{"id":"ci_1a7b3c210668e00db9f01f26688829ff64ce74efa134e247c3084babd2643ce6","title":"Restart AI Engine Servers","path":"/lrsiem/docs/restart-ai-engine-servers","children":[]},{"id":"ci_840b5ad6a1a0b0f1034c1dffd920472cc130b8f53d7469a1ecafeac8ab6c06d8","title":"Revert an AI Engine Server to a Previous Configuration","path":"/lrsiem/docs/revert-an-ai-engine-server-to-a-previous-configuration","children":[]},{"id":"ci_104d3a4b3dcb4ec7a1fed065034e76338eb085557e61fcae8038f14971b6baa6","title":"Update the IP Address of an AI Engine","path":"/lrsiem/docs/update-the-ip-address-of-an-ai-engine","children":[]},{"id":"ci_e9c15ea1c85852d1e6899343ab16c1104abf05643420a756db52c44fbd3b4cb6","title":"Use AI Engine Rule Sets","path":"/lrsiem/docs/use-ai-engine-rule-sets","children":[]},{"id":"ci_d5a34f4519dc8d8db57e8facd622b4b76fbeede8cef83635322774fc94f16aec","title":"Use AI Engine Workloads","path":"/lrsiem/docs/use-ai-engine-workloads","children":[]},{"id":"ci_487c624b92712685fbedf269d8b42f5d9492a45ebe242fae11f12f97c5c00273","title":"Use Saved AI Engine Filters","path":"/lrsiem/docs/use-saved-ai-engine-filters","children":[]},{"id":"ci_25fea2e2a40308ee06b54a49b42dff8361841b23e6514c4c4ac49b7ffeb8a714","title":"Use the AI Engine Local Configuration Manager","path":"/lrsiem/docs/use-the-ai-engine-local-configuration-manager","children":[]},{"id":"ci_e77bf29e5b551d24900266701d9975dd9b844907f60a7f455fc09918590f7c05","title":"View AI Engine Generated Alarms","path":"/lrsiem/docs/view-ai-engine-generated-alarms","children":[]},{"id":"ci_19b21910cb348fb9227d6faaf255a380e127293c128c0ebe301f612437de8953","title":"View AI Engine Rules","path":"/lrsiem/docs/view-ai-engine-rules","children":[]},{"id":"ci_95c26b36d627b7849e53c49fc3a74a55bc7057597602cb4fe1eb84f73ac52273","title":"Work with Existing AI Engine Rules","path":"/lrsiem/docs/work-with-existing-ai-engine-rules","children":[]}]},{"id":"ci_e691e8fb0b4ba626b4a0a70d2f8b492e8277c9df38bca24928d490fabeae7f3c","title":"Alarm Rules","path":"/lrsiem/docs/alarm-rules","children":[{"id":"ci_5aea39dd0d58d649ec1a7b0164dfe538da305db754a1de92a0adcb4698e2450e","title":"Alarm Notification Policies","path":"/lrsiem/docs/alarm-notification-policies","children":[{"id":"ci_616a242f6a7ae660eb0a88203a48fe924bf6457797ee4b1c14eef6cda05ae27d","title":"Create Group Notifications for Alarms","path":"/lrsiem/docs/create-group-notifications-for-alarms","children":[]},{"id":"ci_b192f073377d4cddb657a75e33c2f0c224b4fa06975f7d914d098fdf5f9e398a","title":"Create New Email Alarm Notification Policies","path":"/lrsiem/docs/create-new-email-alarm-notification-policies","children":[]},{"id":"ci_71f9fd017ade8280c2440c7d7cbda44d6ecd2f0a54ea5d95be8410612aa00232","title":"Create New SNMP Alarm Notification Policies","path":"/lrsiem/docs/create-new-snmp-alarm-notification-policies","children":[]},{"id":"ci_6612b5da4ee49a6b32c7414d6dc6dd228d2f16a4474bef3d741371b200ec7649","title":"Create New Text File Alarm Notification Policies","path":"/lrsiem/docs/create-new-text-file-alarm-notification-policies","children":[]},{"id":"ci_812b0d5962b69fb79cffecc1000519411f411359f10b89421067d97d2bf84ab5","title":"Define a Text File Notification Policy","path":"/lrsiem/docs/define-a-text-file-notification-policy","children":[]}]},{"id":"ci_209dcad334502fc2a89648a0aea3112ad99d1e96bffb2f7f6f88e3ad39426670","title":"Create Alarm Rules","path":"/lrsiem/docs/create-alarm-rules","children":[]},{"id":"ci_fbfc3a9c5a209613ebe86910463185048a06374fe878eaedb58341b9e70e8130","title":"Create Alarm Rules for Known Logs","path":"/lrsiem/docs/create-alarm-rules-for-known-logs","children":[]},{"id":"ci_8e424d6fc3103dbb0188e87657a8f2d248547f1426ee3a0226025e32e8100cd7","title":"Enable and Disable Alarm Rules","path":"/lrsiem/docs/enable-and-disable-alarm-rules","children":[]},{"id":"ci_5530699a3d563fb581c5b8e13fd7c9435bd8674796c1848b62ba0c42a59593d4","title":"Modify Alarm Rule Notifications in Batch","path":"/lrsiem/docs/modify-alarm-rule-notifications-in-batch","children":[]},{"id":"ci_c7d4fdf850538deef6a7d62695194a9a19611395d29768de5785e975ede1e3f4","title":"Modify Alarm Rules","path":"/lrsiem/docs/modify-alarm-rules","children":[]},{"id":"ci_fb8e31f0aa812fdb5da188ab7be86328c5ff0897bac2f3e4a4464fc5a74cfead","title":"Retire or Activate Alarm Rules","path":"/lrsiem/docs/retire-or-activate-alarm-rules","children":[]}]},{"id":"ci_24c60650ec503543acad9a6ffbe5acea2d9d506ba3216635b39c85fc4977d186","title":"Automatic Host Contextualization","path":"/lrsiem/docs/automatic-host-contextualization","children":[{"id":"ci_4b1905daa1a4c5f598875d842c3c6b143a51b23e7b6b74c21e9724b45617683c","title":"Disable Automatic Host Contextualization","path":"/lrsiem/docs/disable-automatic-host-contextualization","children":[]},{"id":"ci_0d4364bb9e89032820d7b2ca652e20069353e552762ae623761c3eb331f26397","title":"Map Ports","path":"/lrsiem/docs/map-ports","children":[]}]},{"id":"ci_9ba2f779c74047563ada124395609934050012fcb484812f0d48bc11389f766e","title":"Data Archives and Restoration","path":"/lrsiem/docs/data-archives-and-restoration","children":[{"id":"ci_9f58deaaa06be9e1271890cc21bb7fe03e54cc0bb8eb6907037be5c9b98f79e7","title":"Add a Data Processor to Restore Archives","path":"/lrsiem/docs/add-a-data-processor-to-restore-archives","children":[]},{"id":"ci_bd5b39ab6621ef1de123282a146119e5aacda3f687b6be5926d71fab00a4aad4","title":"Backup and Recovery Procedures","path":"/lrsiem/docs/backup-and-recovery-procedures","children":[{"id":"ci_662402ea91f25cd78768064d898e66a825a66424d80602b4bd601de8844fdb33","title":"Back Up LogRhythm Archives","path":"/lrsiem/docs/back-up-logrhythm-archives","children":[]},{"id":"ci_b75a58cc62e25a595dbc0dbfa454ed8751bce5fe5dbd559a28dc12956e438062","title":"Configure Automated Platform Manager Database Backups","path":"/lrsiem/docs/configure-automated-platform-manager-database-backups","children":[]},{"id":"ci_45c2389dd87097cce35258f3d095d99ac002ee80019d01fa05038dfb16542e6e","title":"Perform a Manual Platform Manager Backup","path":"/lrsiem/docs/perform-a-manual-platform-manager-backup","children":[]},{"id":"ci_a6459248fad677cb65add2d1040cbf7472908e789d0a5f9e01a29355dcd73288","title":"Restore From a Database Backup","path":"/lrsiem/docs/restore-from-a-database-backup","children":[]},{"id":"ci_b568d02ae5b07e97b567b23f682e148512202eb6214ee0c17c9127717d4e1f72","title":"Restore Service State","path":"/lrsiem/docs/restore-service-state","children":[]},{"id":"ci_4434d5d58791835b74dbdeb0047babd81c067479e4ad4c46375f711c2f57d07a","title":"Use a Dark Spare Backup Appliance","path":"/lrsiem/docs/use-a-dark-spare-backup-appliance","children":[]}]},{"id":"ci_985e06ea521afc0a84f1be81c1ebfdcb73bedee1c4957ebac6bda2e124429ace","title":"Configure Object Access Auditing for LogRhythm Archive Files","path":"/lrsiem/docs/configure-object-access-auditing-for-logrhythm-archive-files","children":[]},{"id":"ci_b9ce53e662951f1002b265600ea90fabde73ccd37f62c0464acef15d40eb3640","title":"Restore Platform Managers","path":"/lrsiem/docs/restore-platform-managers","children":[]},{"id":"ci_1ca512c1aec398e70f86055115cc2cc92d4a79230dada72931ba28a5fa75eeb6","title":"SecondLook","path":"/lrsiem/docs/secondlook","children":[{"id":"ci_583ac928bd3d24075920dfd9064355aecf6032586c5cb4e0f105c814730d1598","title":"Run a Saved SecondLook Restore","path":"/lrsiem/docs/run-a-saved-secondlook-restore","children":[]},{"id":"ci_374aa8f82215926c83d962d21840def33e5787e4a51ebfbba7f4c24cd34e2c2b","title":"Create a SecondLook Restore","path":"/lrsiem/docs/create-a-secondlook-restore","children":[]}]},{"id":"ci_17938e6cb832fc460edd19b2d9eb4740d36c6557874b0b6863468ee1eba36035","title":"Use Intelligent Indexing","path":"/lrsiem/docs/use-intelligent-indexing","children":[]},{"id":"ci_a6f8ddd5189c05f04079f24ffd00616cceabb13cf1c1161fe64ae0d37fb33a04","title":"Change Archive Location","path":"/lrsiem/docs/change-archive-location","children":[]}]},{"id":"ci_6f03d1913453b5f221d47039b7a9a9ac4dbedf7b0d1cf3d4494171e45a1541d9","title":"Data Indexer","path":"/lrsiem/docs/data-indexer","children":[{"id":"ci_5cf1dea7b88c882384437f4611a7b4c442d4518bc52f52d089a45d1a476dbc4e","title":"Add a Data Indexer Node","path":"/lrsiem/docs/add-a-data-indexer-node","children":[]},{"id":"ci_251d9c26515b8ff18c3429be4cb3ecc6469c85dc356da063f892b7af23a7781b","title":"Apply System Updates to a Data Indexer","path":"/lrsiem/docs/apply-system-updates-to-a-data-indexer","children":[]},{"id":"ci_fa61110f444b89594b3202bbbe6447efb4cc453f8179a4bb33355ea7291b5229","title":"Configure the Data Indexer","path":"/lrsiem/docs/configure-the-data-indexer","children":[]}]},{"id":"ci_d767f50687baf27aebb4b3f91949e936506b3f401230d313b0282a76ccfa36d1","title":"Data Processor","path":"/lrsiem/docs/data-processor","children":[{"id":"ci_f6fcbd359211ac251b99d8b1990969e0b80f1a9663128d872f1f1b3236977755","title":"Add a Data Processor","path":"/lrsiem/docs/add-a-data-processor","children":[]},{"id":"ci_3b183f6b2fe09b1b66d292798d61d46cb3f4ce83c31c6f46f76c9bd90357499b","title":"Apply Recommended Data Processor Values","path":"/lrsiem/docs/apply-recommended-data-processor-values","children":[]},{"id":"ci_b23aa113e55eec2cf7fcb52e1da5ffdd2e939476317b11741b09aaedfd02d9f0","title":"Configure a Data Processor to Duplicate Data Indexer Logs","path":"/lrsiem/docs/configure-a-data-processor-to-duplicate-data-indexer-logs","children":[]},{"id":"ci_85df59ee625be25e1755d65649d26bf458a8d0c2d5884fd8860bd4dc25972f92","title":"Configure the Mediator for Automatic Startup","path":"/lrsiem/docs/configure-the-mediator-for-automatic-startup","children":[]},{"id":"ci_551e6eeb044458ab4a7fc6ad093d2da62c91aea9215365c32ee21d57d39f2648","title":"Create a Custom Certificate for Communication Between the Data Processor and AI Engine","path":"/lrsiem/docs/create-a-custom-certificate-for-communication-between-the-data-processor-and-ai-engine","children":[]},{"id":"ci_e09e0a8e7c229b0b6000b0a8189720d839007cd3791ab9e3262ad963e5b49534","title":"TrueIdentity Entity Segregation","path":"/lrsiem/docs/trueidentity-entity-segregation","children":[]},{"id":"ci_0c056c1ede5afa74245f1261b58643c7be7de31a02058308dfda7bd5aa1b8239","title":"Filter LogRhythm Diagnostic Events","path":"/lrsiem/docs/filter-logrhythm-diagnostic-events","children":[]},{"id":"ci_426f93df9f6fa41d3ec797d663def5c51dcce5d37603988491e017021faf3c5c","title":"Modify Data Processor Advanced Properties","path":"/lrsiem/docs/modify-data-processor-advanced-properties","children":[]},{"id":"ci_ac9e689441dfdc129380d2f30d96cb39d52a23bcbdb2d894d6112f7e2e29b47a","title":"Modify Data Processor Basic Properties","path":"/lrsiem/docs/modify-data-processor-basic-properties","children":[]},{"id":"ci_ec4fe0eb63456fa4769a80206b7c3c6324fba4b71aa8d5f48fced7af982ef85f","title":"Retire a Data Processor","path":"/lrsiem/docs/retire-a-data-processor","children":[]},{"id":"ci_2cae025c02769eecfeae58fc415923774b37c3ffe1e5f5a546209d3320eeb015","title":"Revert to a Previous Data Processor Configuration","path":"/lrsiem/docs/revert-to-a-previous-data-processor-configuration","children":[]},{"id":"ci_c5fe4981c547e2c2518c09f3c1a99e0c79f484abbea27b328e699db20535caa1","title":"Set Data Processor Messages Per Second Value","path":"/lrsiem/docs/set-data-processor-messages-per-second-value","children":[]},{"id":"ci_5e90e62864a3b904ad3a7d776584d175ea913f76c440d12e8d746ada8cfcb39f","title":"Start, Stop, and Restart Data Processor Services","path":"/lrsiem/docs/start-stop-and-restart-data-processor-services","children":[]},{"id":"ci_84a79e0223cac2ea620eda866777e708dcec4b9c943b590393da49a5c14e3a0e","title":"Throttle the Mediator","path":"/lrsiem/docs/throttle-the-mediator","children":[]},{"id":"ci_2c297281d6080b2a780289c6f2caa352ccbc26afab618ae963ba2714bdd140a3","title":"Update the IP Address of a Data Processor","path":"/lrsiem/docs/update-the-ip-address-of-a-data-processor","children":[]},{"id":"ci_aaa8ab981b9178da1ebd2cc546bf559897ef462af08ab705c4d151f89785fad9","title":"Use the Data Processor Configuration Manager","path":"/lrsiem/docs/use-the-data-processor-configuration-manager","children":[]}]},{"id":"ci_74e103baa1a56373724fb4ef77f5c0d3ef0f15ea93a499d03829123d9503241b","title":"Deployment Health","path":"/lrsiem/docs/deployment-health","children":[{"id":"ci_4123249fe336a786ea153a7140000ee7587f5358e4787a1e85c3b85670ad0fd6","title":"Centralized Service Metrics","path":"/lrsiem/docs/centralized-service-metrics","children":[{"id":"ci_760261f16bb17b82de12a10a664b6cbbeca084545acd943c68a8ae586512990e","title":"Install and Work With Centralized Service Metrics","path":"/lrsiem/docs/install-and-work-with-centralized-service-metrics","children":[]},{"id":"ci_5f8d7d5337ac23edc5a8acc9727214bf900e1a09cfec672d3bb09fd051aacda3","title":"Troubleshoot Centralized Service Metrics","path":"/lrsiem/docs/troubleshoot-centralized-service-metrics","children":[]}]},{"id":"ci_221d5ab08f261dcb5dada394013e85924e167bd3e9c5ccb884a450da4778b73b","title":"Deployment Monitor","path":"/lrsiem/docs/deployment-monitor","children":[]},{"id":"ci_95d7157675abfedcc888479c7369b11e67817bb9145ec339d51c74339cc716dd","title":"Log Processing Reports","path":"/lrsiem/docs/log-processing-reports","children":[{"id":"ci_8a68856906ed3cb8cc7ca2663f1b89b309dcc328c8946beb7a019f9e5138a79f","title":"LPS Detail Report","path":"/lrsiem/docs/lps-detail-report","children":[]},{"id":"ci_0f461389dd06f096129ab27ee6fba5766e7346300f42bc4f62b7a5da98f60a79","title":"LPS Policy Sorting Stats Report","path":"/lrsiem/docs/lps-policy-sorting-stats-report","children":[]}]},{"id":"ci_78f2941bea3ff049d7a83171de60be85c34080b99d1e5d6807f79a93c71ebb8f","title":"Performance Counters","path":"/lrsiem/docs/performance-counters","children":[{"id":"ci_652086c23c7fec15b87e7c9f3335ba3b86a66a02c382bc59d3a4ebd0d362f2c4","title":"Performance Counters—LR AI Engine Communication Manager","path":"/lrsiem/docs/performance-counterslr-ai-engine-communication-manager","children":[]},{"id":"ci_6406eec5931751e7bd962d9dd737e0dcd7142b0cbd3d8e843168786d5ff7138d","title":"Performance Counters—LR AI Engine Data Provider","path":"/lrsiem/docs/performance-counterslr-ai-engine-data-provider","children":[]},{"id":"ci_2892a68ffb59a38c0c43bfaa9caed640e070c1a544d9871d1192a112c07b7cfa","title":"Performance Counters—LR AI Engine Server","path":"/lrsiem/docs/performance-counterslr-ai-engine-server","children":[]},{"id":"ci_4780c4527b5120ea753c1e062e9bba596172b34aaed13e652f3f9c780ee2ebba","title":"Performance Counters—LR Alarming and Response Manager","path":"/lrsiem/docs/performance-counterslr-alarming-and-response-manager","children":[]},{"id":"ci_2222adb85b149558da8f380f5b06707fbf8a28266ee7d23fde73ffe7602cc304","title":"Performance Counters—LR Mediator, Log Distribution Services","path":"/lrsiem/docs/performance-counterslr-mediator-log-distribution-services","children":[]},{"id":"ci_941a7ceb91403858dea2638118d7c63ad715e8a20271276b9a3b1bcce1b77cf3","title":"Performance Counters—LR Mediator, LDS, Sender","path":"/lrsiem/docs/performance-counterslr-mediator-lds-sender","children":[]},{"id":"ci_78230110e4f81607631415f97ec0d20182d12ff207b3468792e324498ac1983f","title":"Performance Counters—LR Mediator, LogMart","path":"/lrsiem/docs/performance-counterslr-mediator-logmart","children":[]},{"id":"ci_5fcf4aeba343147a7af7f144a76182690f7054daf8846a059de190f05ee73ffc","title":"Performance Counters—LR Mediator, Processing","path":"/lrsiem/docs/performance-counterslr-mediator-processing","children":[]},{"id":"ci_88594bf32ac88acfc7169bc73d5064f18ca679df9cb9a1e641bc1e9236f14883","title":"Performance Counters—LR Mediator, Stats","path":"/lrsiem/docs/performance-counterslr-mediator-stats","children":[]},{"id":"ci_8472d66c5a614915f8512b3f8038e200e1347f09414f2d85202af144405a8e6d","title":"Performance Counters—LR Mediator, True Source","path":"/lrsiem/docs/performance-counterslr-mediator-true-source","children":[]},{"id":"ci_afcbffc488ae5baffddfd106ad59abd0cdf1b8adf7a9cd944afb7e1b278869fb","title":"Performance Counters—LR Messaging (DP to DX)","path":"/lrsiem/docs/performance-counterslr-messaging-dp-to-dx","children":[]},{"id":"ci_62ed222ea99623ee3755e0d45db7f65471cf1b4bebd37d0fe21d4812763951b4","title":"Performance Counters—LR System Monitor","path":"/lrsiem/docs/performance-counterslr-system-monitor","children":[]},{"id":"ci_5ba23a5b89c61f3730e29507dba5375ff184d975d57d95e076a6691904b1ec95","title":"View and Add Performance Counters","path":"/lrsiem/docs/view-and-add-performance-counters","children":[]}]}]},{"id":"ci_684af0019401ff82b4fd32706217bc42ed371d1b682df8931fc4628807dda28a","title":"Deployment Manager","path":"/lrsiem/docs/deployment-manager","children":[]},{"id":"ci_cfcac0b2cabb55b4eb569559111e469780e2d4787d198a1055f1ecbb1785844a","title":"Deployment Security","path":"/lrsiem/docs/deployment-security","children":[{"id":"ci_3fcbf4759dfd7022ab52e2fe228324260bbdea290bc9ac5cef834b2d84a0d600","title":"Common Criteria Audit Data Generation","path":"/lrsiem/docs/common-criteria-audit-data-generation","children":[{"id":"ci_ed512623d0c055208ce667a606e9c2b51324a0722fe952bf44c736aba83f8506","title":"Set Up the Audit Functionality","path":"/lrsiem/docs/set-up-the-audit-functionality","children":[]},{"id":"ci_f46d411baa83f912e170fa30f9f26f232b82ea0bce6a587f817926ae00ff5ec4","title":"Set up Discretionary Access Controls on the Trace Folder on an NTFS File System","path":"/lrsiem/docs/set-up-discretionary-access-controls-on-the-trace-folder-on-an-ntfs-file-system","children":[]},{"id":"ci_12df80093e2148eb6dc9e2bc5b6ea0c5a9b9bc3f7441bf4673ee4d1e9e08fb77","title":"Configure Windows Task to Alarm on Audit Trace Failure","path":"/lrsiem/docs/configure-windows-task-to-alarm-on-audit-trace-failure","children":[]},{"id":"ci_8dfb05904507b1bea402cac7e54407866fca8a63b2150edde4b67da9c9d438df","title":"Configure SQL Server to Run Under Domain Account","path":"/lrsiem/docs/configure-sql-server-to-run-under-domain-account","children":[]},{"id":"ci_6aef47087721b9b41e44dfc69137bf451e2df50b4300e88b4963df3be9668ba3","title":"SQL Server Trace File Converter (TFC) User Guide","path":"/lrsiem/docs/sql-server-trace-file-converter-tfc-user-guide","children":[{"id":"ci_e17814774dd3fba2cf7e327cdd197e153e452dcab69ba89ffb475b1bc08a26cc","title":"Download the SQL TFC Installer","path":"/lrsiem/docs/download-the-sql-tfc-installer","children":[]},{"id":"ci_b83ee4651d30a4a3f87aa3d6cf27b41c3869f94a9087617e9b4fe888e49207ca","title":"Install the SQL Server TFC Server","path":"/lrsiem/docs/install-the-sql-server-tfc-server","children":[]},{"id":"ci_f56a9b3fbfde4126df1a55406edec3d9bdd13eecdeab57a04c2d0c10e94f1001","title":"Configure SQL Server TFC","path":"/lrsiem/docs/configure-sql-server-tfc","children":[]},{"id":"ci_7031cb68db67d2dc0e0a01a09ea7ac3c877b4e0ae2d1071687ab1d327c75b313","title":"Add a SQL Server TFC Log Source","path":"/lrsiem/docs/add-a-sql-server-tfc-log-source","children":[]}]}]},{"id":"ci_50a3eb10e7cf3611f6a566303e6aea0ed2ea87256b6cb5847cd34d6cf38f0974","title":"Common Criteria","path":"/lrsiem/docs/common-criteria","children":[{"id":"ci_1e49c68c4ee2cd616fca8a4b26966dbbe65b9d54aef8391f095c1327086ac07b","title":"Web Console Compliance","path":"/lrsiem/docs/web-console-compliance","children":[{"id":"ci_457bb5cac944c370e0c7ca0ed8629751084ff98780daaed2f8ec1e8ada2e5720","title":"Auto Logout for Idle Users (US9521)","path":"/lrsiem/docs/auto-logout-for-idle-users-us9521","children":[]},{"id":"ci_0f98feb79b9b25c6dc202379d1196f764a1297435871338bab644a11a1b70d9e","title":"Nginx File Configuration Updates (US9305)","path":"/lrsiem/docs/nginx-file-configuration-updates-us9305","children":[]},{"id":"ci_2a3282b1aa140c05c378569f77787b457482af5bc79e5905cb814068334ec168","title":"Requirements","path":"/lrsiem/docs/requirements","children":[]},{"id":"ci_fef1f35a99d5c608b892884e03f5122c96b695cd1f26f55157c5881efbe1f2a3","title":"Warning Banner on Login Page (US9518)","path":"/lrsiem/docs/warning-banner-on-login-page-us9518","children":[]},{"id":"ci_54edf66e68ead769f4fdad9cea6bd4588bfb7a9d64a2ece0b977b4ca66d24a3b","title":"Web Console FIPS Compliance Configuration (US9525)","path":"/lrsiem/docs/web-console-fips-compliance-configuration-us9525","children":[]},{"id":"ci_3a22e32c626ed9753b9b59ccfe5c01aa1702464b601cc0242793a183de606907","title":"Web Console Logout Button (US9519)","path":"/lrsiem/docs/web-console-logout-button-us9519","children":[]}]}]},{"id":"ci_de41ccf6cd3f644dc7a6560cd602d055057172f5962892a8a987f540b89fc360","title":"Federal Information Processing Standards (FIPS)","path":"/lrsiem/docs/federal-information-processing-standards-fips","children":[{"id":"ci_c015e4cffa960c3ff3c394f42572ba3365d5490a2fd156398eb243696519ccd9","title":"Configure User Access Control for FIPS Mode","path":"/lrsiem/docs/configure-user-access-control-for-fips-mode","children":[]},{"id":"ci_8c1bc9084538b111b62668a95b5ee777a5a455c88207934a02aca255cab0592e","title":"Configure LogRhythm XM for FIPS Mode","path":"/lrsiem/docs/configure-logrhythm-xm-for-fips-mode","children":[]},{"id":"ci_74171e43eedede2ef8ef59b98f5861790be9ff79a16178c46d43b9c9d4128f9e","title":"Configure LogRhythm DPAWC + DX for FIPS Mode","path":"/lrsiem/docs/configure-logrhythm-dpawc-dx-for-fips-mode","children":[{"id":"ci_e2441a65c11cf1787e8ba4d9155c94c1b176a62193c857bff45ef82d8fec6044","title":"Configure LogRhythm DPAWC","path":"/lrsiem/docs/configure-logrhythm-dpawc","children":[]},{"id":"ci_8012e6347646bcaaa7d6de8379a0f9757dcd37942cc64f9bb708562eb82867bb","title":"Configure LogRhythm DX","path":"/lrsiem/docs/configure-logrhythm-dx","children":[]},{"id":"ci_c7b882e95467bd072b5999ad669899ba4cc78e786728334832c540112fa3fcfc","title":"Establishing IPsec Communications between Windows & Linux OS","path":"/lrsiem/docs/establishing-ipsec-communications-between-windows-linux-os","children":[{"id":"ci_4f07c406f65a3e7b08132fb50d3a6ea859fb2d9c3873df48a9cc7bc4304579f2","title":"Windows OS IPsec Configuration","path":"/lrsiem/docs/windows-os-ipsec-configuration","children":[{"id":"ci_27800da5067e156f9a1cc93a2052b75c15e1c21e601eb54f5b0742017e7435e6","title":"Create a Custom MMC Console","path":"/lrsiem/docs/create-a-custom-mmc-console","children":[]},{"id":"ci_11ba19800db2083cef0fb79a486e7b9b94e123f504e1b69cac69c3d47b9f878e","title":"Enable Audit Policy for Your Computer","path":"/lrsiem/docs/enable-audit-policy-for-your-computer","children":[]},{"id":"ci_7bf0d56e6d36fe9bd2a2df44f09961a11d9172318f4e266772265874f009003e","title":"Build a Custom IPsec Policy","path":"/lrsiem/docs/build-a-custom-ipsec-policy","children":[]},{"id":"ci_19815d310c5be967a3b13b4b9f9306ebc7911d9419645ac798ff7a82b7ee0874","title":"Configure an IPsec Filter List","path":"/lrsiem/docs/configure-an-ipsec-filter-list","children":[]},{"id":"ci_5c70fdc9339313e4ee781d6bd84b97439e556088a7d63b61cb4c3967e67167cb","title":"Configure an IKE Authentication Method","path":"/lrsiem/docs/configure-an-ike-authentication-method","children":[]}]},{"id":"ci_0f1597111aa55fcf3450ff1e52a55f9a81ea5668486c582df503085c14f57863","title":"Linux/CentOS IPsec Configuration","path":"/lrsiem/docs/linux-centos-ipsec-configuration","children":[{"id":"ci_e9c3684cf19e7b186f7cc0f9e701ae01a5aa96c2b4e8d209eedc1770f8598a26","title":"Configure IPsec on Linux Machine","path":"/lrsiem/docs/configure-ipsec-on-linux-machine","children":[]},{"id":"ci_e40abccbd5ba71a61fbc6a73b7ff628065b38481a6d42e6616f78398d73c56e8","title":"Put Linux/CentOS into FIPS Mode","path":"/lrsiem/docs/put-linux-centos-into-fips-mode","children":[]}]},{"id":"ci_9a7e9bd67e2dd71b7c7fd9756647c9c1dd586c65705469b6752a39061d186dd3","title":"Test Your Custom IPsec Policy on both Computers","path":"/lrsiem/docs/test-your-custom-ipsec-policy-on-both-computers","children":[]}]}]},{"id":"ci_eb0038d46fa2bf6d43fa3b4b87be9026f424a8d6d08e08d98888b8ea487d5c74","title":"Force Encrypted Connections for SQL (Recommended)","path":"/lrsiem/docs/force-encrypted-connections-for-sql-recommended","children":[]},{"id":"ci_d4b126d609e39e8427cabbb75ab393ecfe77641172217972c62806746cceb6ea","title":"Deploy LogRhythm in a FIPS-Enabled Domain","path":"/lrsiem/docs/deploy-logrhythm-in-a-fips-enabled-domain","children":[]},{"id":"ci_471972acff88dd207559ddc42644cae67070dc402e4398c71013d18e33fd974e","title":"Put Windows into FIPS Mode","path":"/lrsiem/docs/put-windows-into-fips-mode","children":[]},{"id":"ci_72833df37df066c280b1a90b2505a34cb8dd91f32b777853d020577d2198d72d","title":"Configure LogRhythm Services and the Windows Data Indexer for FIPS Mode","path":"/lrsiem/docs/configure-logrhythm-services-and-the-windows-data-indexer-for-fips-mode","children":[]}]},{"id":"ci_c8ad78908cbad6e8a18c27c9403c3fffa2b861ff3389696420e43e26d7d128e6","title":"Integrated Security","path":"/lrsiem/docs/integrated-security","children":[{"id":"ci_ad1bf055608dfe5c8d99174080f2fe58c518bb3c9f9f84349b89d0a21fa68d07","title":"Create Accounts for LogRhythm Components","path":"/lrsiem/docs/create-accounts-for-logrhythm-components","children":[]},{"id":"ci_ae9c4d80b3d67ce2b70cd6aecc07ca03c8eadbcf790078e4a7de14b1897bddd1","title":"Configure Database Access","path":"/lrsiem/docs/configure-database-access","children":[]},{"id":"ci_faeef20fb1ea04fd67f2a0d09321338b1771f7f5ea77de53582106c2355a70d2","title":"Shut Down LogRhythm Services","path":"/lrsiem/docs/shut-down-logrhythm-services","children":[]},{"id":"ci_275693acd2464862b98a92254e190a91a94bf231cb9d336b0688059d7f50278f","title":"Reconfigure LogRhythm Services to Use Integrated Security","path":"/lrsiem/docs/reconfigure-logrhythm-services-to-use-integrated-security","children":[]},{"id":"ci_d5230bbbe7321f89fc90ad4eb60078e252404e4afc4a67c68c2180471f32c192","title":"Enable Mixed Authentication Mode","path":"/lrsiem/docs/enable-mixed-authentication-mode","children":[]},{"id":"ci_93fb515a53338b40fd1e5f4b88c75108649ec19d4fd3e274fbb1ac1fda84f5b6","title":"Restart LogRhythm Services","path":"/lrsiem/docs/restart-logrhythm-services","children":[]}]},{"id":"ci_6c38834d218ac48f5c9d2cd9be706c1a2adba123f235582aa89561f3506a71da","title":"Least Privileged User","path":"/lrsiem/docs/least-privileged-user","children":[{"id":"ci_c4094a50c60439770792759a056adeaab124c052d86794e60604bf5b97fab870","title":"Configuring LogRhythm Permissions","path":"/lrsiem/docs/configuring-logrhythm-permissions","children":[]},{"id":"ci_f2f7a1e96dad264c97f78c63c65aaee6f2d8f0ee4a8d7c2da1cdbc679b529e14","title":"Least Privileged User: DP, Mediator Server","path":"/lrsiem/docs/least-privileged-user-dp-mediator-server","children":[]},{"id":"ci_5d01da8aacad138093e111c6c1d7ef98b8fdf411b8040d7bf68197591514765d","title":"Least Privileged User: DX, Linux","path":"/lrsiem/docs/least-privileged-user-dx-linux","children":[]},{"id":"ci_783c39e90dc3b6749678744fd528562cb676b7d169715f0e3baf0fbe4a421447","title":"Least Privileged User: DX, Windows","path":"/lrsiem/docs/least-privileged-user-dx-windows","children":[]},{"id":"ci_75cd0bc62bf2d3ff690f19d3f4751fe0bff68c9f106328d44b7d7150baf09399","title":"Least Privileged User: PM, Advanced Intelligence Engine","path":"/lrsiem/docs/least-privileged-user-pm-advanced-intelligence-engine","children":[]},{"id":"ci_74645b96bc30aee1c6d5e835d2a177e236cf48bf18dcb9adbaa0b6a73662a48c","title":"Least Privileged User: PM, AIE Communication Manager","path":"/lrsiem/docs/least-privileged-user-pm-aie-communication-manager","children":[]},{"id":"ci_92ae724f52766c0bc31d809350d68c3cba0df19a9719f774d5e997d2d5f0c374","title":"Least Privileged User: PM, Alarming and Response Manager","path":"/lrsiem/docs/least-privileged-user-pm-alarming-and-response-manager","children":[]},{"id":"ci_afb2617e387d865d9156af216c11c0cae1f8408bed1428ab2d7f456e1ac01bef","title":"Least Privileged User: PM, Disaster Recovery","path":"/lrsiem/docs/least-privileged-user-pm-disaster-recovery","children":[]},{"id":"ci_5e4710dfdb5a2733ea27032d27699f985dd603d3bfb0984fc9cf689142113354","title":"Least Privileged User: PM, High Availability","path":"/lrsiem/docs/least-privileged-user-pm-high-availability","children":[]},{"id":"ci_45a00c4f35ad91ff0cf307f2cf321679c46af5a9ebe2b3b865c97c56da538292","title":"Least Privileged User: PM, Job Manager","path":"/lrsiem/docs/least-privileged-user-pm-job-manager","children":[]},{"id":"ci_22418182ea61dd230d82cb6fc8c5d051742f00bf1db6b14feecdd0776d5ee196","title":"Least Privileged User: PM, Web Console","path":"/lrsiem/docs/least-privileged-user-pm-web-console","children":[]},{"id":"ci_f7b1ca4f18e23ed9e8d3e73333bc2721abe19d5c01b561875d7ccf8eadf602d2","title":"Least Privileged User: SysMon, Linux, Unix","path":"/lrsiem/docs/least-privileged-user-sysmon-linux-unix","children":[]},{"id":"ci_6368787ca9fcf53289f5e1e6464ac154f0b1ebae95cb7b5e7decac729428b094","title":"Least Privileged User: SysMon, Windows","path":"/lrsiem/docs/least-privileged-user-sysmon-windows","children":[]},{"id":"ci_704085de9400afbbeddfaf454251fa7fcf1e67522bb4eb497e9814c30e578837","title":"Least Privileged User: TIS, Windows","path":"/lrsiem/docs/least-privileged-user-tis-windows","children":[]}]},{"id":"ci_c91f4962f5ab985d2afc69b9efb21652c44b936b713476486e1101158fa64730","title":"Public Key Infrastructure (PKI) Support","path":"/lrsiem/docs/public-key-infrastructure-pki-support","children":[{"id":"ci_5877065266da5182f7485d86177949e96ddfff2a6322e26843916ba6d78a119e","title":"Certificate Configuration for LogRhythm Component Connections","path":"/lrsiem/docs/certificate-configuration-for-logrhythm-component-connections","children":[]},{"id":"ci_23ce894c725b3487b284debe66dfc3ab43643316f2bafcbdd7bb6e4b995f07a9","title":"Create a Certificate for Microsoft SQL Server Connections","path":"/lrsiem/docs/create-a-certificate-for-microsoft-sql-server-connections","children":[]},{"id":"ci_a35a861888b11cde1bcc3cae76df602216d9cadbf5b7e81aceaa9aaab31b76f4","title":"Create Client and Server Certificates","path":"/lrsiem/docs/create-client-and-server-certificates","children":[]},{"id":"ci_6dd95a40092334bbce8d512550af9e294149ec9300cebbddbfee410339133200","title":"Verify Certificates","path":"/lrsiem/docs/verify-certificates","children":[]},{"id":"ci_b19613cb2985b09c0e051c49148dc1564b665b5680ed6720a2b8f516ed001393","title":"View an Example of Configuring Mutual Authentication in LogRhythm","path":"/lrsiem/docs/view-an-example-of-configuring-mutual-authentication-in-logrhythm","children":[]},{"id":"ci_2775691087128ca07bdbda66f8aaeae20c3bff913a76795fef58df80e0d6e8c3","title":"View an Example of Configuring Certificates for AI Engine","path":"/lrsiem/docs/view-an-example-of-configuring-certificates-for-ai-engine","children":[]}]},{"id":"ci_f115041389d7f2c8bad405146dbcd8a02b0752504ad7fbe3be5466d8e5c5a2dd","title":"Security Banners","path":"/lrsiem/docs/security-banners","children":[{"id":"ci_b4d493d613367bab7ddbcf056d933ca7e8cdea53540e6876998dade071f619a0","title":"Configure the Session-Timeout Error Message","path":"/lrsiem/docs/configure-the-session-timeout-error-message","children":[]},{"id":"ci_82dcda8e660456273289d2335ae0592a11de9ffcf58d64d664c90353fe7ef025","title":"Configure the Start-Up Warning","path":"/lrsiem/docs/configure-the-start-up-warning","children":[]}]},{"id":"ci_41d131b202b6e06a00fd4364f53149be6267f9932fa640ac05c52805e996e489","title":"Enhanced Auditing","path":"/lrsiem/docs/enhanced-auditing","children":[{"id":"ci_7926685cb5cde29504a01267989c42fa5f6e8b24030ccd4b630150838facbaf4","title":"Collect Enhanced Audit Logs","path":"/lrsiem/docs/collect-enhanced-audit-logs","children":[]}]},{"id":"ci_044adc0bd9e523520ff4aa7a5b9dec259c0fb02c78e1b253add432520a876392","title":"Query Auditing","path":"/lrsiem/docs/query-auditing","children":[]},{"id":"ci_29534f356e0ad7f1dfa016c2bc6f55ab58adf5c7eb9635e017ac66c7badc8bd8","title":"LogRhythm Default Passwords","path":"/lrsiem/docs/logrhythm-default-passwords","children":[]}]},{"id":"ci_f9561efc6a273764a50e2b9c06b734c8ca98444e3c787cab34d0fda9c35de4e4","title":"Endpoint Monitoring","path":"/lrsiem/docs/endpoint-monitoring","children":[{"id":"ci_d01ca3d1b3d4d6da977f397f3bcd5c646527ade3f9d1f8034a7ecd392501c219","title":"Data Loss Defender (DLD)","path":"/lrsiem/docs/data-loss-defender-dld","children":[{"id":"ci_07a4f4db9e7b7094e3bf0873838a182a308f14d018eebac6359bbc3ce128dc5a","title":"Create DLD Policies","path":"/lrsiem/docs/create-dld-policies","children":[]},{"id":"ci_2ebb094200834ffccbaae76aa8f1fd67c1a881c53fbb596fbb618ea3bb27807e","title":"Delete DLD Policies","path":"/lrsiem/docs/delete-dld-policies","children":[]},{"id":"ci_d42d63a3eb144b2157152d0a48ec86c0c968770bfc05b77d90535021d368b568","title":"Enable DLD for an Agent","path":"/lrsiem/docs/enable-dld-for-an-agent","children":[]},{"id":"ci_5f75eb57e80a8304d87c1dac8d37d919066ff44558f9618d5d92fa5930f9247b","title":"Modify DLD Policies","path":"/lrsiem/docs/modify-dld-policies","children":[]}]},{"id":"ci_f0810844c98d308423021a8766f146776622318052b6e1faabf20c065285cfad","title":"File Integrity Monitor (FIM)","path":"/lrsiem/docs/file-integrity-monitor-fim","children":[{"id":"ci_0ab4055c4116569a6162945620280f1035d51f245c4f3c196b841b269bcd4886","title":"Create File Integrity Monitor Policies","path":"/lrsiem/docs/create-file-integrity-monitor-policies","children":[]},{"id":"ci_9bc30b249003f192d103990af2aa5d3e18043b0006a5537a50a7b77e4d4ea06c","title":"Create Inclusions and Exclusions for FIM","path":"/lrsiem/docs/create-inclusions-and-exclusions-for-fim","children":[]},{"id":"ci_e69d587a18ba5573d86409f4651bfc3ba30a2ab26776b641d0056fb62008f586","title":"Associate a File Integrity Monitor Policy With an Agent","path":"/lrsiem/docs/associate-a-file-integrity-monitor-policy-with-an-agent","children":[]},{"id":"ci_2535f69dc8f7ac1853b683a4df6de5ebc2b7aeea8250a6270daf58226186df41","title":"Modify File Integrity Monitor Policies","path":"/lrsiem/docs/modify-file-integrity-monitor-policies","children":[]},{"id":"ci_c9a669c26e2f4a6315481ff4d6c6a27913bbced6f7a05a228c86d7a0573a6f1a","title":"Clone File Integrity Monitor Policies","path":"/lrsiem/docs/clone-file-integrity-monitor-policies","children":[]},{"id":"ci_7ad141af0647fe1e25705fc6e235470b96296a7db1d40a041630d2bc2b61d590","title":"Delete File Integrity Monitor Policies","path":"/lrsiem/docs/delete-file-integrity-monitor-policies","children":[]}]},{"id":"ci_9cfc98ffe84e8403b02f5475b93c20ec4459ae84e7bf468d3652ac3495e25ac2","title":"Network Connection Monitor (NCM)","path":"/lrsiem/docs/network-connection-monitor-ncm","children":[{"id":"ci_ab80cd7503650ae4bbb99c47daa6b6f1536d9def4f66991eb73238fe9da11246","title":"Enable NCM for an Agent","path":"/lrsiem/docs/enable-ncm-for-an-agent","children":[]}]},{"id":"ci_b2e4b199291ebf54dbd03a050246028b5562a997326446ccc5a3d86beb236358","title":"Process Monitor","path":"/lrsiem/docs/process-monitor","children":[{"id":"ci_a9b4f7126ea7c6a0fdb70499cc2ec8f546a48de1906f46d7f35bb3b60ffe5a99","title":"Enable Process Monitor for an Agent","path":"/lrsiem/docs/enable-process-monitor-for-an-agent","children":[]}]},{"id":"ci_b321dc0829bebe39df31bff60e8f88e97144b78507a2035405e8f0cd8fd1d337","title":"Registry Integrity Monitor (RIM)","path":"/lrsiem/docs/registry-integrity-monitor-rim","children":[{"id":"ci_aa46bfdc4399207ac17bb53009d4b88a8ec7b5472b286815c05a9305e9e7cd21","title":"Associate Items to RIM Policies","path":"/lrsiem/docs/associate-items-to-rim-policies","children":[]},{"id":"ci_4aacb9b5e81012aa148a4b8542917693c4ba766c0ca0bd8382ff0372403fda07","title":"Associate RIM Policies to Windows System Monitor Agents","path":"/lrsiem/docs/associate-rim-policies-to-windows-system-monitor-agents","children":[]},{"id":"ci_80083f13efce115b019c064b26cf639f7bd1ce605cc863092086b573a3deb7b6","title":"Configure RIM Policy Items","path":"/lrsiem/docs/configure-rim-policy-items","children":[]},{"id":"ci_043d3b5f8bb1a8a6f1f8dde7523379c7e6605d6d5d6fb52643a4e6e4df6505c8","title":"Create RIM Policies","path":"/lrsiem/docs/create-rim-policies","children":[]},{"id":"ci_978a290480caf5746a7126f8b930371c922cf947cad1e93a617dc1fc53d24fea","title":"Delete RIM Policies","path":"/lrsiem/docs/delete-rim-policies","children":[]},{"id":"ci_9a19b873f94fe2c70c64f8d24af894fa2d75c32e0ea11000ec021ca34df12cc8","title":"Delete RIM Policy Items","path":"/lrsiem/docs/delete-rim-policy-items","children":[]},{"id":"ci_c0ec2e30dd8b2a4f41427915f6bc00deb92653003ea1d414560c4fac4cd2f8c5","title":"Modify RIM Policies","path":"/lrsiem/docs/modify-rim-policies","children":[]},{"id":"ci_86aca361adf9aa5f0f5c3c03bd6dfd852a646fa7b2220a5de13d0f3894f0ed2b","title":"Modify RIM Policy Items","path":"/lrsiem/docs/modify-rim-policy-items","children":[]}]},{"id":"ci_e2d049622d110c1dcd66659aea2c3fe7271778693145af7a0738f24b89e4de5e","title":"User Activity Monitor (UAM)","path":"/lrsiem/docs/user-activity-monitor-uam","children":[{"id":"ci_a1822d5891f617e011f94f7a03dba70ac17351a59516505da96de50bdc1dd3c6","title":"Enable UAM for an Agent","path":"/lrsiem/docs/enable-uam-for-an-agent","children":[]},{"id":"ci_7ba79c0c0b89e13c124fe7327de16ed1c909b819516ff65baff183f9bdb38025","title":"Include UAM in File Integrity Monitor","path":"/lrsiem/docs/include-uam-in-file-integrity-monitor","children":[]}]}]},{"id":"ci_d2a41574bce6a8ed82aedc0d896bb0921db261abad274e9ace20a73d3edfe389","title":"Entities","path":"/lrsiem/docs/entities","children":[{"id":"ci_b031a8ec426289b5028c034844569f93bc806c6f4876ce597bc09a81cef6ea95","title":"Add a Single Entity","path":"/lrsiem/docs/add-a-single-entity","children":[]},{"id":"ci_2d7ab92c70143f47078d0642586f3e355adc1742d9869bca44ae521134fda986","title":"Bulk Import Entities From a File","path":"/lrsiem/docs/bulk-import-entities-from-a-file","children":[]},{"id":"ci_77f6daaf3effcba4211a30fde45ffd56d7bc0bc9272543f04f12bc77295e89a6","title":"Delete Entities","path":"/lrsiem/docs/delete-entities","children":[]},{"id":"ci_77b83a059421fdc869cf5f6c5fd347db3f6701caa9adff0f8a1281db613b4793","title":"Modify Entities","path":"/lrsiem/docs/modify-entities","children":[]},{"id":"ci_37bb7697ed7063f9caecb8b2e5e8486555c0d6d0dcc5f7d551fe4c4b3d39591d","title":"Run the Entities Reorganization Wizard","path":"/lrsiem/docs/run-the-entities-reorganization-wizard","children":[]}]},{"id":"ci_4c38112e3ef59ed585bd7c75ba726538c45a777a03a7114dfdf8ad9d463aec16","title":"Global Log Processing Rules","path":"/lrsiem/docs/global-log-processing-rules","children":[{"id":"ci_8fb94f385cdf2eea84b30a45692045dff2eea6ebd39a16a9e79cfb71010b4b2b","title":"Create Global Log Processing Rules","path":"/lrsiem/docs/create-global-log-processing-rules","children":[]},{"id":"ci_2850ce0a516bb71cb627f580dfa103809fbe8526be16a87984e3b9bc1f0e630a","title":"Modify Global Log Processing Rules","path":"/lrsiem/docs/modify-global-log-processing-rules","children":[]}]},{"id":"ci_6692cd05ac19d4283c8905871f73fe39cc858bcd18d973f8c3084919da2fd5f2","title":"Host Records","path":"/lrsiem/docs/host-records","children":[{"id":"ci_7643db1ae1b81055602c7679a0c24ffe3f34da14ae32ca13387abe2029562f2d","title":"Add Host Records Manually","path":"/lrsiem/docs/add-host-records-manually","children":[]},{"id":"ci_1a6c12611a9a2eef139a244625b88e6860581bd85374dbcdb334f049a2259ca7","title":"Add Hosts From Clipboard","path":"/lrsiem/docs/add-hosts-from-clipboard","children":[]},{"id":"ci_dd4943a23d68ca0559ace5d4a096e8da0f30d55cc148dafaa44bfbc03b77d16a","title":"Add Hosts From File","path":"/lrsiem/docs/add-hosts-from-file","children":[]},{"id":"ci_370260fd3b5271c4a944c70e9dd8d70d23df7a371d666163471b84d949062c7c","title":"Add Origin Hosts or Impacted Hosts as Known Hosts","path":"/lrsiem/docs/add-origin-hosts-or-impacted-hosts-as-known-hosts","children":[]},{"id":"ci_932ee7294ada12c4a7b6709556c737df39373adc1de540cc3ab181c7950b9a81","title":"Add or Remove Multiple Host Roles","path":"/lrsiem/docs/add-or-remove-multiple-host-roles","children":[]},{"id":"ci_85ba91d9c95e30f3e2a503c271156edd01a33e7277f7a7e579af8532dcef624c","title":"Export Multiple Host Roles to File","path":"/lrsiem/docs/export-multiple-host-roles-to-file","children":[]},{"id":"ci_0da1b497d2421d8ffa093cc753a03289eb6487a3c4f54bbbff195aa9fdb8e97b","title":"Modify Properties for a Single Host Record","path":"/lrsiem/docs/modify-properties-for-a-single-host-record","children":[]},{"id":"ci_5af9d5869d91d4a471c9d3738de7fc5a39feb88cb22d9dfdb00fd6cb32bfc635","title":"Modify Properties for Multiple Host Records","path":"/lrsiem/docs/modify-properties-for-multiple-host-records","children":[]},{"id":"ci_cb19cd8688db0a8e936af2800fbe9da5d1e8b4811744ab9af2690e06700f23b6","title":"Resolve Known Hosts","path":"/lrsiem/docs/resolve-known-hosts","children":[]},{"id":"ci_50a95a53f1740d4ad46f6c95164f55a8c98f205a6a610756d2de82a636a0c831","title":"Retire Host Records","path":"/lrsiem/docs/retire-host-records","children":[]},{"id":"ci_e2f6558052c1afc5fb5c079ea10205bc8fadebe406d09d38ec127d57ffbb6573","title":"Search for Hosts","path":"/lrsiem/docs/search-for-hosts","children":[]},{"id":"ci_1f0d7da931e43932f3b44681121431b3538ae1f35d675efc4bb7d5f3190c2232","title":"Windows Host Wizard","path":"/lrsiem/docs/windows-host-wizard","children":[{"id":"ci_169b90bb03cac3942c625c91e4de44b5b941f02a4f3e831aab2a903bbcde7c71","title":"Configure Initial Host Settings in Windows Host Wizard","path":"/lrsiem/docs/configure-initial-host-settings-in-windows-host-wizard","children":[]},{"id":"ci_f4d3ecc4e6a77d5c67d30a729ef4c20cd4fa8464527b02f39ac04d9c0639ed44","title":"Import Computers for Log Collection","path":"/lrsiem/docs/import-computers-for-log-collection","children":[]},{"id":"ci_c88455c0be656bf5cdda2844385a35f6779c3f2b19957a12895b70e99afd56ae","title":"Perform Optional Configuration for Remote Log Collection","path":"/lrsiem/docs/perform-optional-configuration-for-remote-log-collection","children":[]},{"id":"ci_c0630e438039bbdc0056517d793d7248d46b940ad6e2e99e47a824f0f078ca7b","title":"Query Computers with Windows Host Wizard","path":"/lrsiem/docs/query-computers-with-windows-host-wizard","children":[]},{"id":"ci_0a84e22bd89e9b520780c70c03c23ff11ebd27b7cc987d891cfde207cc795a44","title":"Review Computers with Windows Host Wizard","path":"/lrsiem/docs/review-computers-with-windows-host-wizard","children":[]},{"id":"ci_05d5cf32edecb5fe7e790af0c3d6c744d2b71d632d2129fb7bb1a875ade9e4af","title":"Scan a Domain for Computers","path":"/lrsiem/docs/scan-a-domain-for-computers","children":[]},{"id":"ci_34d474acabb06ce163bdcf087797fc75b041c5e82e57305d5fc63a24f10b88e7","title":"Work with Hosts and Agents in Windows Host Wizard","path":"/lrsiem/docs/work-with-hosts-and-agents-in-windows-host-wizard","children":[]}]}]},{"id":"ci_ffda5e60fa52fc4b4dbae4d5b89ce7f4012c2f5a317a11b03fb0049bce61a6c3","title":"Knowledge Base","path":"/lrsiem/docs/knowledge-base","children":[{"id":"ci_39532b698954fda22a93b95e811c7338ba66c79de26e48a15bc16e684e4728f4","title":"Back Up the EMDB","path":"/lrsiem/docs/back-up-the-emdb","children":[]},{"id":"ci_1d997c5e7d66973dd1f85f1801258fa1d5905b6dd387e13843039a034188a94d","title":"Configure Knowledge Base Synchronization Settings","path":"/lrsiem/docs/configure-knowledge-base-synchronization-settings","children":[]},{"id":"ci_5135a3dcf77d83902637fdeef377eadc39bf1bbdfc7dc0eb661a5f89d0e871f6","title":"Download the Knowledge Base File","path":"/lrsiem/docs/download-the-knowledge-base-file","children":[]},{"id":"ci_75618ac37a4d2151a8e7e90f80afb86d54c18082ceb976b17e68a19421d6e325","title":"Import a Knowledge Base","path":"/lrsiem/docs/import-a-knowledge-base","children":[]},{"id":"ci_f52bfb79ada501350326a876a6bca11f97ac8e1710f3953a695a107d195a57eb","title":"Knowledge Base Manager","path":"/lrsiem/docs/knowledge-base-manager","children":[{"id":"ci_ad2a8c3ada56f9138e0ab77ef1b6bf8958e11f83c6f13ae539595e59b9e8d883","title":"Disable Knowledge Base Modules","path":"/lrsiem/docs/disable-knowledge-base-modules","children":[]},{"id":"ci_71e4b98f25d3d776833047b9da2aaca9ef4a1eb56ae3096a90a95a2bb9f2d83e","title":"Enable Knowledge Base Modules","path":"/lrsiem/docs/enable-knowledge-base-modules","children":[]},{"id":"ci_9085f90adef68388282396f884063e453438f839f80beff55fb9d0cb2835ec8b","title":"Export Knowledge Base Module Information to a File","path":"/lrsiem/docs/export-knowledge-base-module-information-to-a-file","children":[]},{"id":"ci_52d59b97977a45dc008b056718d9d6642c8e56a5d8aa4660041414b6a1e28c88","title":"Migrate Common Events","path":"/lrsiem/docs/migrate-common-events","children":[]},{"id":"ci_c979a4eb7d6e2033931b114fd42935318a2589eb9b2e92b282978e999118c942","title":"Modify the Properties of Knowledge Base Modules","path":"/lrsiem/docs/modify-the-properties-of-knowledge-base-modules","children":[]},{"id":"ci_9fc58f82b01518f28d5c8d4d051595c71a32f13bef389891308b6142919b5ead","title":"View Knowledge Base Module Dependent Objects","path":"/lrsiem/docs/view-knowledge-base-module-dependent-objects","children":[]}]}]},{"id":"ci_62cf85ea4dcc485e32d7c7d4d81c289c6fd3ff46ce70ad2677ae5cdeb67b9828","title":"Log Distribution Services","path":"/lrsiem/docs/log-distribution-services","children":[{"id":"ci_bcb931fa9e5ce213c893a5045e0863b4f08f6f17b2d12a253d704792e607383a","title":"Log Distribution Receiver Manager","path":"/lrsiem/docs/log-distribution-receiver-manager","children":[{"id":"ci_7b9ab7abdf13b8034228acd1eb9b5223583615de94f2b4b13105f0ee9ee6c683","title":"Create Log Distribution Receivers","path":"/lrsiem/docs/create-log-distribution-receivers","children":[]},{"id":"ci_c3a30051dd614798ea8b02e31ac550dfecd2a21f708cdf31e5b9f48e4fb68e11","title":"Enable Log Distribution Receivers","path":"/lrsiem/docs/enable-log-distribution-receivers","children":[]},{"id":"ci_556cc353c12369a3b289e611402c2d113fe31067da7d9826f8b09b16fca7fc74","title":"Modify Log Distribution Receivers","path":"/lrsiem/docs/modify-log-distribution-receivers","children":[]}]},{"id":"ci_3ec7d58bcac5f73642ea8f01674f6bc8f735b24a942c1ea8da8ba82aae3570b4","title":"Log Distribution Policy Manager","path":"/lrsiem/docs/log-distribution-policy-manager","children":[{"id":"ci_9f845979f02a0df88eff273da43bb271aabc6ee9ace600e2ab5c26f69eb115b6","title":"Create Log Distribution Service Policies","path":"/lrsiem/docs/create-log-distribution-service-policies","children":[]},{"id":"ci_60754995e9733a2af1c6bf6316aeb79a1c66ecd1083c4ba64abf4119a297e7df","title":"Enable or Disable Log Distribution Service Policies","path":"/lrsiem/docs/enable-or-disable-log-distribution-service-policies","children":[]},{"id":"ci_8b92581b3fa30d099a0a5e912dc9e0cc12730c7a1b6eeb550b1e346b34c3cf20","title":"Modify Log Distribution Service Policies","path":"/lrsiem/docs/modify-log-distribution-service-policies","children":[]}]},{"id":"ci_0b2b648d23d031ead5df59ae7b2f1ef1075bd1eaad3d6be134a185d05bf9d0a8","title":"LogRhythm Log Distribution Services Version 2","path":"/lrsiem/docs/logrhythm-log-distribution-services-version-2","children":[{"id":"ci_4abcf1bb849c6a31df7f2403f4d0ff8f07b5e5bd3df5fd213935ba956b0be367","title":"Determine When to Switch to Log Distribution Services v2","path":"/lrsiem/docs/determine-when-to-switch-to-log-distribution-services-v2","children":[]},{"id":"ci_5293e96664803a8bf900a782e0a3ed2ca65e7b7fc0a8ba8f317396066bf7df39","title":"Enable Log Distribution Services v2","path":"/lrsiem/docs/enable-log-distribution-services-v2","children":[]},{"id":"ci_8cd6f9b4617d32adf0ad5bd6d425dcc3cd763de17ea1be5d5a7b32086925d8c7","title":"Troubleshoot Log Distribution Services v2","path":"/lrsiem/docs/troubleshoot-log-distribution-services-v2","children":[]}]},{"id":"ci_24ed93d6493b8d7df83c97556911a5a912dd0bfa62278e58e2bbc043adc88ae2","title":"Modify Log Distribution Service Properties in Data Processors","path":"/lrsiem/docs/modify-log-distribution-service-properties-in-data-processors","children":[]}]},{"id":"ci_567966bfe43bef4cb628da7526b1466c1a780dd8910dc61415c1ea13b77286c8","title":"Log Processing Policies","path":"/lrsiem/docs/log-processing-policies","children":[{"id":"ci_f5a08f2ee77092fa4d1eabc09a140ffbc74df878ff7d84657b81d0f078e6ea26","title":"Create Log Processing Policies","path":"/lrsiem/docs/create-log-processing-policies","children":[]},{"id":"ci_f7ccd1e1a8771bbf50e03fe4dea9e68be34e76818f77655af4456ed65fe433d5","title":"Assign Log Processing Policies","path":"/lrsiem/docs/assign-log-processing-policies","children":[]},{"id":"ci_a7dfac86382afd1e7a36120d356fa212ebe8d8ade4504f9f7a5feb9d762d0cac","title":"Modify Log Processing Policies","path":"/lrsiem/docs/modify-log-processing-policies","children":[]},{"id":"ci_5379cd12d1da69071dd3c22a34d2cf9fbeb5d6edbb61cf1044e69e2f1c0572f1","title":"Delete Log Processing Policies","path":"/lrsiem/docs/delete-log-processing-policies","children":[]},{"id":"ci_1ac5e36b3e43c0778a30bec3a370e8cc7b4199fad7cc43801ba4e39d528e1a45","title":"Troubleshoot MPE Rule Performance","path":"/lrsiem/docs/troubleshoot-mpe-rule-performance","children":[]}]},{"id":"ci_14b826c76dfa9b3f74cc06c1be2e6e458d115915139661ce39cf92b7a1914966","title":"Log Sources","path":"/lrsiem/docs/log-sources","children":[{"id":"ci_0b46928dca4a6f3a2d561d434315ce58e3fd8951af425c166816f8710a1629d0","title":"Work With Log Sources","path":"/lrsiem/docs/work-with-log-sources","children":[{"id":"ci_52931cd1cbd4d31d4b57d82b4657dad481c9ccac7f372912547bffbbbd9d845a","title":"Add a Single Log Source","path":"/lrsiem/docs/add-a-single-log-source","children":[]},{"id":"ci_7da65b8b144fd16d548479409873bdfa96d06acc366dca1b02bc1c0cb43dc107","title":"Add Multiple Log Sources","path":"/lrsiem/docs/add-multiple-log-sources","children":[]},{"id":"ci_46dfdefe9394ca1526a7416c07ce6d17c17761154e573e370afdd8a9497768b4","title":"Associate New Log Sources","path":"/lrsiem/docs/associate-new-log-sources","children":[]},{"id":"ci_0f97548a8f2f75337607a848214f5a22bcd7b7dae5aac6df3544ac10f8311a3c","title":"Collect Local Event Logs with the Server Service Disabled","path":"/lrsiem/docs/collect-local-event-logs-with-the-server-service-disabled","children":[]},{"id":"ci_ba7ee8d68871e20ecc3cb7d13b296578023a7b3b991574c87172629dca2d6b27","title":"Configure Log Sources Automatically","path":"/lrsiem/docs/configure-log-sources-automatically","children":[{"id":"ci_2e4b785ba59c273cfcb1d0038d8ed801fe2b2f655b35d05e00724ee02ad0567d","title":"Add and Delete SNMP Connections","path":"/lrsiem/docs/add-and-delete-snmp-connections","children":[]},{"id":"ci_14a71e40d9bfb8a5e2b6f6ea78fd673ecddf732175ccf9fd68bf11e2b971a2ff","title":"Enable Automatic Log Source Configuration","path":"/lrsiem/docs/enable-automatic-log-source-configuration","children":[]},{"id":"ci_e9a02984adb82e100bf744ad60063c2ea81fa73d957cac536751dc969a7420f3","title":"Use the Advanced Criteria Manager","path":"/lrsiem/docs/use-the-advanced-criteria-manager","children":[]}]},{"id":"ci_7a27e0cd3ba2e4d40d0330d5e4379489209c4ef58d49dca023b0dff19bd10ff9","title":"Configure Support for Multi-Line Logs","path":"/lrsiem/docs/configure-support-for-multi-line-logs","children":[]},{"id":"ci_3d454d05f964e53ee552301c91e2f82d048ce928e17434fdf6e0ef5173c4e25a","title":"Export Log Sources","path":"/lrsiem/docs/export-log-sources","children":[]},{"id":"ci_d3d6d9123a5abe273c396d95b30cc28387019a22591e23fa7ad1ca905b34b6e4","title":"Modify a Single Log Source","path":"/lrsiem/docs/modify-a-single-log-source","children":[]},{"id":"ci_9f492a9e5221bca9e5e3c1e631644ca1973bae2be0aedde07eee59c296615aec","title":"Modify Event Settings","path":"/lrsiem/docs/modify-event-settings","children":[]},{"id":"ci_56f0c6ba90b01d25df1f832e18eaaa48a930a69b3bd7ed89a296a7920e0bcfd7","title":"Modify Multiple Log Sources","path":"/lrsiem/docs/modify-multiple-log-sources","children":[]},{"id":"ci_4a66b6cbdd34e0007534983a7e912c374c0ea9443fa1fadfd8eb3d3dcc962fe7","title":"Move Log Sources to New Hosts","path":"/lrsiem/docs/move-log-sources-to-new-hosts","children":[]},{"id":"ci_8fa916ecd61b56fd22d85c5344072a98b1f192e27023966e2aa08b27a315876d","title":"Preregister Log Sources","path":"/lrsiem/docs/preregister-log-sources","children":[]},{"id":"ci_a0696c5a07e5f39983360c3d673caab0f1cc7e7166d4d3d47638a8ace3354139","title":"Resolve Log Source Hosts","path":"/lrsiem/docs/resolve-log-source-hosts","children":[]},{"id":"ci_6b81047226ffa6f1d694e5ab02216502d38ab83ee6b965f632af1607deb9cca9","title":"Retire or Activate Log Sources","path":"/lrsiem/docs/retire-or-activate-log-sources","children":[]}]},{"id":"ci_30289460ee3235accb4c23283117ab5d6fc895b8150f3f2c2c451b544741760d","title":"Log Source Types","path":"/lrsiem/docs/log-source-types","children":[{"id":"ci_b5e2eaa1960706cf00c4f2b537693ecdfe29e4a7649041779013440045ee3583","title":"Create Custom Log Source Types","path":"/lrsiem/docs/create-custom-log-source-types","children":[]},{"id":"ci_409be02dcd0180f0445ccb0ecce5e1ec6606ab71815f676612f60d77f7de4a87","title":"Delete Custom Log Source Types","path":"/lrsiem/docs/delete-custom-log-source-types","children":[]},{"id":"ci_89b07327c1b5b7d2507c939ab1e0d21d58f56a0fb45c8f6fc1ab6017bcf867cc","title":"Modify Custom Log Source Type","path":"/lrsiem/docs/modify-custom-log-source-type","children":[]},{"id":"ci_f8d34f72178c42ef73f22090b2cf6a55c63205bc9d677d190c31cd40ec874a53","title":"Modify Type for Pending Log Source","path":"/lrsiem/docs/modify-type-for-pending-log-source","children":[]}]},{"id":"ci_a39e2ab466b5357c4e3bc73c10fdca40190390d4b4c88a73def9aa34baad25c4","title":"Data Masking","path":"/lrsiem/docs/data-masking","children":[{"id":"ci_c89742719990ff60d3696eaf2f61525d346ab536be06b7fcca60fd2f83d21665","title":"Add New Data Masking Rules","path":"/lrsiem/docs/add-new-data-masking-rules","children":[]},{"id":"ci_28852556eae2d96c12701613ecb44a7affd80d9eb8230e685a9c12873ac25999","title":"Import and Export Data Masking Rules","path":"/lrsiem/docs/import-and-export-data-masking-rules","children":[]},{"id":"ci_1314885a50a38924432c778a776e898b38b60f3eaa115831da11b1f5fc7c3b5d","title":"Enable and Disable Data Masking Rules","path":"/lrsiem/docs/enable-and-disable-data-masking-rules","children":[]},{"id":"ci_4baee92843a0cb1500bd7ba7afdec78da437915d71de4914923e5dd2308f60ee","title":"Reorder Data Masking Rules","path":"/lrsiem/docs/reorder-data-masking-rules","children":[]},{"id":"ci_f50488653647484ff24e12c70f0041dae2439f5dc8c6560445abd1e28f4b238f","title":"Delete Data Masking Rules","path":"/lrsiem/docs/delete-data-masking-rules","children":[]}]},{"id":"ci_9af1f9e59c78e12931154672987a1090f400b2ab4536587064ea47db564b26ed","title":"Log Source Identification and Acceptance","path":"/lrsiem/docs/log-source-identification-and-acceptance","children":[{"id":"ci_5fe25ab6d0f423c47fbdfa6c6594ac4c03100369d3bb609e2edfff279bf6cb38","title":"Accept New Log Sources","path":"/lrsiem/docs/accept-new-log-sources","children":[]},{"id":"ci_6176d6283ed91841be62f316fa82332e1eba9b66fc3f912a6f7f3ce8dff9d913","title":"Accept New Log Sources Automatically","path":"/lrsiem/docs/accept-new-log-sources-automatically","children":[{"id":"ci_40a18f00d7b27c2c9708097a2a2d5249d3f1a1f0dffb3898ac784815e8ed0b72","title":"Create IP Range Log Source Acceptance Rules","path":"/lrsiem/docs/create-ip-range-log-source-acceptance-rules","children":[]},{"id":"ci_da4abc3f324306b989c2d5921c25d252b56d3768a4054d0400b8a257ef0eb390","title":"Create Pattern Match Log Source Acceptance Rules","path":"/lrsiem/docs/create-pattern-match-log-source-acceptance-rules","children":[]},{"id":"ci_78433055b7e1509ebceeb124977f95296a3bd3cf81e39f9d5b59f221b91d444f","title":"Manage Automatic Log Source Acceptance Rules","path":"/lrsiem/docs/manage-automatic-log-source-acceptance-rules","children":[]}]},{"id":"ci_a4eb7a27ca7ec451fcda50374163eea66356d2b869953665690704132b6c96e9","title":"Set the Log Source Identification Search Scope","path":"/lrsiem/docs/set-the-log-source-identification-search-scope","children":[]},{"id":"ci_ea5237d93cd95b9b154ce0cd8707fb15f35d1fb4f0c4b10247318da2832bfb61","title":"View Log Source Acceptance Properties","path":"/lrsiem/docs/view-log-source-acceptance-properties","children":[]}]},{"id":"ci_df28bfb06c2eae17fb312303adba19ae56fd0df2579df95f5f457402d9c0b0b1","title":"Log Sources and Agents","path":"/lrsiem/docs/log-sources-and-agents","children":[{"id":"ci_86a663937e66b48eb56a5b7ee05b9e028746f16c73a7035e56484a85bae75da4","title":"Limit the Number of Agents Available for Batch Updates","path":"/lrsiem/docs/limit-the-number-of-agents-available-for-batch-updates","children":[]},{"id":"ci_a9295d25a743228e8a2750a0d6bab6b5ed326fa6ace35962ea098b9cd5138622","title":"Move Log Sources Between Agents","path":"/lrsiem/docs/move-log-sources-between-agents","children":[]}]},{"id":"ci_58a520e1bfebca0128016da734219e56af90df2d4e565286e1756b0c36fecbb4","title":"Flat File Collection","path":"/lrsiem/docs/flat-file-collection","children":[{"id":"ci_edb430857826d1e45f78f1786132384430467034870ba9127f86bcafd08b5ccd","title":"Configure a Host for Local Flat File Collection","path":"/lrsiem/docs/configure-a-host-for-local-flat-file-collection","children":[]},{"id":"ci_930cb87ad5e869786b712c4f69c1de31f3435021f97fb9e8f8bc6637490e107d","title":"Configure an Agent for IIS Log Collection","path":"/lrsiem/docs/configure-an-agent-for-iis-log-collection","children":[]},{"id":"ci_5cde9523ce847078c309ee62a985c88ec50fc465a8a5ec8bf1f1041a68b57633","title":"Convert Flat File to Epoch Time","path":"/lrsiem/docs/convert-flat-file-to-epoch-time","children":[]},{"id":"ci_23496bebb39cc3cf49bf332d1faea76afdae364ce9d59539c67134b8446e7179","title":"Supported Date Parsing Formats","path":"/lrsiem/docs/supported-date-parsing-formats","children":[]}]},{"id":"ci_794bd33b13b2d465e5975ff4d59772dfcff36c801c7928dbdd6ce231095449bb","title":"UDLA Collection","path":"/lrsiem/docs/udla-collection","children":[{"id":"ci_c96abb4498ed88b69ac5f4897bc610f924215607569e8c14a3178c9366d4a5d7","title":"Configure UDLA Log Collection","path":"/lrsiem/docs/configure-udla-log-collection","children":[]},{"id":"ci_fee496eae00520b03d5d90cf883b8cb7cf0a5cb1b2c1cea95996c28fbacf0d2a","title":"Create a Sample McAfee ePolicy Orchestrator (ePO) Event Log Source","path":"/lrsiem/docs/create-a-sample-mcafee-epolicy-orchestrator-epo-event-log-source","children":[]},{"id":"ci_b80a4dd651ce31486f3f6ce32de67c422a7b136bf7eec17704a7569d9a3b4938","title":"Create a Sample Oracle 10g Audit Trail UDLA Log Source","path":"/lrsiem/docs/create-a-sample-oracle-10g-audit-trail-udla-log-source","children":[]},{"id":"ci_6cab2c9cbdce8c0c8f68c232885dbd42cabe18dcc0d7eeeba56c7595420820d1","title":"Export and Import UDLA Log Source Configurations","path":"/lrsiem/docs/export-and-import-udla-log-source-configurations","children":[]},{"id":"ci_2bb23bf550d3f7f6bfa17ca9a919aac1d9fb6726fdb36b20afab4e327cb419aa","title":"Override UDLA SQL","path":"/lrsiem/docs/override-udla-sql","children":[]}]},{"id":"ci_ae3c01543a2ca98732a8104c2a6b356ef3901fa74f7c89ccaedcc70ea41f8c10","title":"Log Source Virtualization","path":"/lrsiem/docs/log-source-virtualization","children":[{"id":"ci_97d2f0de3d546f094ceee8581611ccdbc7edd629644f4495870e6dd6bffb71c4","title":"Create Log Source Virtualization Templates","path":"/lrsiem/docs/create-log-source-virtualization-templates","children":[]},{"id":"ci_2a3058a55ee5a67a3243fde8aa540db3ca14b47146c5d6fc33e02dd2616d7d7a","title":"Create Virtual Log Sources","path":"/lrsiem/docs/create-virtual-log-sources","children":[]},{"id":"ci_f4a6d71f3b031feac9d9c13cc49b72972ce61dd060b688b892522d6dc14e13be","title":"Delete Log Source Virtualization Templates","path":"/lrsiem/docs/delete-log-source-virtualization-templates","children":[]},{"id":"ci_e7548902548d439654e9575f9e861acca9decd60962c5f8b7389844728fb91be","title":"Delete Virtual Log Sources","path":"/lrsiem/docs/delete-virtual-log-sources","children":[]},{"id":"ci_aea0045974a30a584874b300808239b066432b07d8526c47992f7547b32ac611","title":"Enable Virtualization on a Single Log Source","path":"/lrsiem/docs/enable-virtualization-on-a-single-log-source","children":[]},{"id":"ci_673e4cfffd40392897f694cdb4d9ec4a5d4f769c3d8eea7ca564a95ce6107ada","title":"Enable Virtualization on Multiple Log Sources","path":"/lrsiem/docs/enable-virtualization-on-multiple-log-sources","children":[]},{"id":"ci_76bec91b0fa9c2a09079b98ae989ea1228ed56caf121042bf908d288151ba29f","title":"Export Log Source Virtualization Templates","path":"/lrsiem/docs/export-log-source-virtualization-templates","children":[]},{"id":"ci_e1092942b0267990b03f7104afead051767138ef6a3ccaba292bbc63a832471f","title":"Filter Virtual Logs at the Agent","path":"/lrsiem/docs/filter-virtual-logs-at-the-agent","children":[]},{"id":"ci_1e7350c910ba43e68b032cd7474148d7f415709abad0acf06a3996be3ff6f41e","title":"Import Log Source Virtualization Templates","path":"/lrsiem/docs/import-log-source-virtualization-templates","children":[]},{"id":"ci_adc1dc9e91dea6067380339e2a11bbfe90be813805d75c022f09bb8aa1c6e35f","title":"Modify Catch-All Sources on a Batch of Parent Log Sources","path":"/lrsiem/docs/modify-catch-all-sources-on-a-batch-of-parent-log-sources","children":[]},{"id":"ci_3412b2ba9dd51b03ddda32a77542c4e5ac9c9a59efec8243f5a31a2168b161fa","title":"Modify Log Source Virtualization Templates","path":"/lrsiem/docs/modify-log-source-virtualization-templates","children":[]},{"id":"ci_36447d6120bce0f5aef142133c8a94f2571942c5ef1fa0868657746bd85a698f","title":"Modify Virtual Log Sources","path":"/lrsiem/docs/modify-virtual-log-sources","children":[]}]}]},{"id":"ci_189c0817d92c364382bcaf7ce5278336c54c4f7f3330fafb6b6bab2217ef8b9d","title":"Network Monitor","path":"/lrsiem/docs/network-monitor","children":[{"id":"ci_d2b4342af44a862d7bc98c55f46bd8d5242fff08aeef835ae21f6f9bd436f027","title":"Add NetMon in the Client Console","path":"/lrsiem/docs/add-netmon-in-the-client-console","children":[]},{"id":"ci_60260c5ef3ba34a6492c46b201cc08f11116a93a4b38efb6356d389b72b0d606","title":"Configure NetMon in the Client Console","path":"/lrsiem/docs/configure-netmon-in-the-client-console","children":[]},{"id":"ci_d85723d232c555475830606b43455e0b11d693aa5b6719bc0e32e0f34949c8ce","title":"Delete NetMon in the Client Console","path":"/lrsiem/docs/delete-netmon-in-the-client-console","children":[]},{"id":"ci_e45191e148f3227b44bd40aa2da011ea6bc7e3d932453c171bd177907fbcc033","title":"Modify NetMon in the Client Console","path":"/lrsiem/docs/modify-netmon-in-the-client-console","children":[]},{"id":"ci_db3fb50e164534eef5f713d9f196ae15b3286745f73f1cd096d997e363364f56","title":"Monitor NetMon in the Client Console","path":"/lrsiem/docs/monitor-netmon-in-the-client-console","children":[]}]},{"id":"ci_ddbeff8f6da8d02805f7b2773a9fa356f5b52cf90515811c6e68a5553cc351de","title":"Network Records","path":"/lrsiem/docs/network-records","children":[{"id":"ci_f8fb50581e8622acff32c38c3e045527f581a30e9d2f62de5edd8e7d12262ba5","title":"Add Network Records from File","path":"/lrsiem/docs/add-network-records-from-file","children":[]},{"id":"ci_b24c3be07418665be7393e7f55d3b7c00f7310b3ed2491395187a75e726a8aa0","title":"Manually Add Network Records","path":"/lrsiem/docs/manually-add-network-records","children":[]},{"id":"ci_a1ad5dd238bf6c1e73653195f7c17ff7db021205894d670fb450491a2b18e24c","title":"Modify Properties for a Single Network","path":"/lrsiem/docs/modify-properties-for-a-single-network","children":[]},{"id":"ci_3532eecf0881243fb6604e82f3afb00b70c43c0ca9b2c0dcada3109193def9be","title":"Modify Properties for Multiple Network Records","path":"/lrsiem/docs/modify-properties-for-multiple-network-records","children":[]},{"id":"ci_c7f0476bdd37a595a93538dda7a9564a52695c6012985a53fc4bc448d04849f7","title":"Resolve Known Networks","path":"/lrsiem/docs/resolve-known-networks","children":[]},{"id":"ci_9c289b39345c9bd2f181beed3857156b4da4735e000b6774276f14f096e8ca44","title":"Retire Network Records","path":"/lrsiem/docs/retire-network-records","children":[]},{"id":"ci_4124ebfb547c1dd85c016f90591e10535d4abaf52fb3d3f45e4d329fbd964176","title":"Search for Networks","path":"/lrsiem/docs/search-for-networks","children":[]}]},{"id":"ci_b86e84eb5fd6ffb91efdb1ec64b193403b5dd621452c75e3833d26c53b9bbcd3","title":"Object Permissions Manager","path":"/lrsiem/docs/object-permissions-manager","children":[{"id":"ci_9bde45fc03c7916fe50c0f45126ff18f54a2943a75e87939d21959b768c29f08","title":"Modify Objects' Security Settings","path":"/lrsiem/docs/modify-objects-security-settings","children":[]}]},{"id":"ci_e5a3e1f97cd8d0d031769a7e43f19264870ebc96fc7043717e6ce0a86ba0f34e","title":"People and Users","path":"/lrsiem/docs/people-and-users","children":[{"id":"ci_0c5de1dd39851e06a5f67d448b8bfe992a27ff5e01c14b1a1802965a320467ae","title":"Add Person Records or Roles","path":"/lrsiem/docs/add-person-records-or-roles","children":[]},{"id":"ci_e78b03e71ddfd496cd4c88f662a5252c34f73bf7ccda66cdd55027fd379bc1d8","title":"Assign Active Directory Credentials to Local Users","path":"/lrsiem/docs/assign-active-directory-credentials-to-local-users","children":[]},{"id":"ci_394782af3560abc7a6b16a30507857d325b427e41e953998095b606ceb3bc021","title":"Create User Accounts for Person Records or Roles","path":"/lrsiem/docs/create-user-accounts-for-person-records-or-roles","children":[]},{"id":"ci_dc2e6cfa94c9f9e6601b214e39d05f37b788e03e108cfc2679fee085ab482aa8","title":"Direct Requests to the Case API URL","path":"/lrsiem/docs/direct-requests-to-the-case-api-url","children":[]},{"id":"ci_135bbe13cc3da039f06306cf34f1c823407445fc30fb933e1a7ac4c8246ec26f","title":"Disable Person Records or Roles","path":"/lrsiem/docs/disable-person-records-or-roles","children":[]},{"id":"ci_29483bc01e9a72af4af613f34b1e73ea506790caf2f9889daef5fa43e3169567","title":"Modify Logins for Person Records or Roles","path":"/lrsiem/docs/modify-logins-for-person-records-or-roles","children":[]},{"id":"ci_848ec72409218158e7ebb5235de789b8ce646059459f9e8f2ce7ca9294d812f8","title":"Modify Person Records or Roles","path":"/lrsiem/docs/modify-person-records-or-roles","children":[]},{"id":"ci_c7c4b4461eed77c75c042829e5c45e13b2333e8428ffc9f3fb4e7194f6bfd8c0","title":"Rename LogRhythm Users","path":"/lrsiem/docs/rename-logrhythm-users","children":[]},{"id":"ci_2aea60873c3bf4a3e6dbfbd3ac8ef3029aec43b2da135554c6e1b6b93747c503","title":"Reset Multi-Factor Authentication Access to the Web Console","path":"/lrsiem/docs/reset-multi-factor-authentication-access-to-the-web-console","children":[]},{"id":"ci_b09a9231fb478e4a83eaf3a72c230c13ab7a2142e672401c560d7dcbbe8f4abc","title":"User Profile Manager","path":"/lrsiem/docs/user-profile-manager","children":[{"id":"ci_92f12f0c74d49d067597dd8a2021890d66932e668b5f66e2be7d25aa8ece8978","title":"Create a New User Profile","path":"/lrsiem/docs/create-a-new-user-profile","children":[]},{"id":"ci_12627bdab8ae21502e2e4e7858c362ddf095def74f4cfe52ef94aefecd857a18","title":"Manage User Profile SmartResponse Access Rights","path":"/lrsiem/docs/manage-user-profile-smartresponse-access-rights","children":[]},{"id":"ci_d397f7d61ff92100b0b0d999a9f937d32d5a91d0513bc611958340c74221f6c5","title":"Modify User Profile Data Processor Access Rights","path":"/lrsiem/docs/modify-user-profile-data-processor-access-rights","children":[]},{"id":"ci_1b49b49422fe3cb92fa38e85c4e0154798d54f38c8f061f5b4ef5ae8273221d1","title":"Modify User Profile Effective Log Sources Settings","path":"/lrsiem/docs/modify-user-profile-effective-log-sources-settings","children":[]},{"id":"ci_b2ad325a048251c9f42bc7746ba729aa973e8fdc8ee2c06bd215de27f3348660","title":"Modify User Profile Entities Settings","path":"/lrsiem/docs/modify-user-profile-entities-settings","children":[]},{"id":"ci_acd32e24d318bc998c93852ef190bf6847f901ca3e418e1b75021830d5b24b51","title":"Modify User Profile General Settings","path":"/lrsiem/docs/modify-user-profile-general-settings","children":[]},{"id":"ci_4daa5efc4a24b0ae191fcae351f48acba513334757cf689b5f2135ed63dfea0a","title":"Modify User Profile Log Sources Access Rights","path":"/lrsiem/docs/modify-user-profile-log-sources-access-rights","children":[]},{"id":"ci_16dec61e5e95ae35c78b32e880ce70d2246a13bb5b1f67bfe7a2b5bdb01ef4c6","title":"Manage User Profile Notification Group Access Rights","path":"/lrsiem/docs/manage-user-profile-notification-group-access-rights","children":[]},{"id":"ci_1bbf6e051180d3291e5b88ae1d15924637e180cf0eb4f2fcccdeb30c4d7c6fe3","title":"Modify User Profile Management Permissions","path":"/lrsiem/docs/modify-user-profile-management-permissions","children":[]}]}]},{"id":"ci_5e22c5b1073f27d9bba3ee7c710a6ad6f06b7ced1d796f226058fd290d9dcb86","title":"SmartResponse","path":"/lrsiem/docs/smartresponse","children":[{"id":"ci_47319d8b62bc104bebb78162bc4ccc5eff8d5829c5af11403326a137cba802ef","title":"Approve or Deny SmartResponse Actions in the Client Console","path":"/lrsiem/docs/approve-or-deny-smartresponse-actions-in-the-client-console","children":[]},{"id":"ci_7da6a30d7d9c66374780aa508330ef0997e031353b5799f5aa0f1f9136753042","title":"Develop SmartResponse Plugins","path":"/lrsiem/docs/develop-smartresponse-plugins","children":[{"id":"ci_508bb837e64d39667d1f7578220df67d548bef788212a51a8b20c4c78aa7706f","title":"Create the Payload","path":"/lrsiem/docs/create-the-payload","children":[]},{"id":"ci_10bce43e5758e565c67f1c8c43872fb830890ed90d18f072bd10c4fe508af2fa","title":"Create the Configuration File","path":"/lrsiem/docs/create-the-configuration-file","children":[]},{"id":"ci_e990cf888c07ee2f351966bc1bb7475c51227848ed028cd851bd8380035cdf49","title":"Package and Test the SmartResponse","path":"/lrsiem/docs/package-and-test-the-smartresponse","children":[]},{"id":"ci_c17f2906bcfc71cdff7a95df330bcf6d2a91249110dfba5ccf2a502c2dc315c0","title":"Deploy Custom SmartResponse Plugins","path":"/lrsiem/docs/deploy-custom-smartresponse-plugins","children":[]}]},{"id":"ci_6cd6428344ea3680c0f3dda936e3db14707aa0a84000d40138d42119e6ff0b82","title":"Import SmartResponse Plugins","path":"/lrsiem/docs/import-smartresponse-plugins","children":[]},{"id":"ci_6cc0d88c3221010fafbbcd74cc8d49f581bd1d3fc4baf47646fe062a84aaf3f2","title":"Initiate SmartResponse","path":"/lrsiem/docs/initiate-smartresponse","children":[]},{"id":"ci_b71f71999d852828d27d575c0049ba29949c4bcf5aa82e9365a721e783f2fd63","title":"Preview SmartResponse Command Execution","path":"/lrsiem/docs/preview-smartresponse-command-execution","children":[]},{"id":"ci_4891eb4a5d3cea47c7eae4e8be15a13f383330229a73df9d5eb85d032e606a85","title":"Test SmartResponse Plugin Actions","path":"/lrsiem/docs/test-smartresponse-plugin-actions","children":[]},{"id":"ci_e8589e9b813120dcb0d36850839117392746ea630fc91c98f4e8fd890453e1d8","title":"Troubleshoot SmartResponse Action Testing","path":"/lrsiem/docs/troubleshoot-smartresponse-action-testing","children":[]},{"id":"ci_348bf95c41dbe9a87ed9321933061e12f4a80e5874dc9983ef2e2fc638829f36","title":"Validate SmartResponse Plugins","path":"/lrsiem/docs/validate-smartresponse-plugins","children":[]}]},{"id":"ci_e467e19ecc9994db905859478a48731064ef62d7befc0edda60117bd90d68ec0","title":"System Monitor","path":"/lrsiem/docs/system-monitor","children":[{"id":"ci_2a78649a30e01c891bdcf1b5e7386c65042c097abbc1c507b643541e95344710","title":"Agent Identification and Acceptance","path":"/lrsiem/docs/agent-identification-and-acceptance","children":[{"id":"ci_aaf7282e78afcdc6e137adb1f734de03ef99e901cbf0f58e1eefc7457d4924c4","title":"Accept a New System Monitor","path":"/lrsiem/docs/accept-a-new-system-monitor","children":[]},{"id":"ci_05f34c93d8929b07f35bd896c517249e5400a34fb6427a70c712eea8504ea689","title":"Associate a System Monitor Agent","path":"/lrsiem/docs/associate-a-system-monitor-agent","children":[]},{"id":"ci_0860354d28d82e7366ca41dfc337d4ab550ad35ab1461ffa81958fc33b9cf3dd","title":"Work With New System Monitors","path":"/lrsiem/docs/work-with-new-system-monitors","children":[]}]},{"id":"ci_292d56330e9ad2e0147715c91bc1c6ead6481121654a2f651d323caa7ddb070d","title":"NetFlow, IPFIX, and J-Flow Collection","path":"/lrsiem/docs/netflow-ipfix-and-j-flow-collection","children":[{"id":"ci_c8527d3be7e30f2e92b0a9081c7af7ee6201594b448777fdb1020a0c0a6edb1c","title":"Configure a Device or Host for NetFlow, IPFIX, or J-Flow Collection","path":"/lrsiem/docs/configure-a-device-or-host-for-netflow-ipfix-or-j-flow-collection","children":[]},{"id":"ci_e1ec532de94fb5f7e8f15fda80d1d2391eaaa4b34b10810f675c77bf206da01a","title":"Customize IPFIX Logs","path":"/lrsiem/docs/customize-ipfix-logs","children":[]}]},{"id":"ci_46086aa6dfd3ab742607d5425d4a03696232a9f14b4da06dbb3d3038ef2868f1","title":"Work With System Monitor Agents","path":"/lrsiem/docs/work-with-system-monitor-agents","children":[{"id":"ci_6249a625a7584c97728c81e6dbe2f3617e27ee0e3d9ec56c1f4a7625f7f975e3","title":"Add System Monitors","path":"/lrsiem/docs/add-system-monitors","children":[]},{"id":"ci_a628b0c679a3322d646927357deaf59335be336564df535c1cc442af10458499","title":"Configure the scsm Service","path":"/lrsiem/docs/configure-the-scsm-service","children":[]},{"id":"ci_dc520dacd9c03d91607582d7abcc79e898653d662fe479ddc311c253b88613ea","title":"Connect System Monitor Agents to Different Entities","path":"/lrsiem/docs/connect-system-monitor-agents-to-different-entities","children":[]},{"id":"ci_39e78a47ac9acb456188e0769b716174662f77dc73c65b0368d402a8753525dc","title":"Connect System Monitor Agents to New Data Processors","path":"/lrsiem/docs/connect-system-monitor-agents-to-new-data-processors","children":[]},{"id":"ci_7a4ae2a463e7293983edff3f74d17bd3ba71f5fe7e0ec1233753b5f81a4cb777","title":"Connect System Monitor Agents to Existing Data Processors","path":"/lrsiem/docs/connect-system-monitor-agents-to-existing-data-processors","children":[]},{"id":"ci_d4cb83a1c31075c6244490b3f4035d072ed597f3bafc11dc0a2cbb85e992c32c","title":"Data Processor Pooling","path":"/lrsiem/docs/data-processor-pooling","children":[{"id":"ci_628721035b568d078fece82c7d5d9b3919ab2e593bd3cc0194a6c48dea86bdcf","title":"Data Processor Pool Manager","path":"/lrsiem/docs/data-processor-pool-manager","children":[]},{"id":"ci_84f600f29a5a546c4ad1beee84003bed7074dfc18d08e35101f88fcfb1bcd602","title":"Assign a Data Processor to a DP Pool","path":"/lrsiem/docs/assign-a-data-processor-to-a-dp-pool","children":[]},{"id":"ci_ed5ca45badb39aa1c9a4305e01072f3dd45cd8661ae98809df7972fe27b7884b","title":"Remove a Data Processor from a DP Pool","path":"/lrsiem/docs/remove-a-data-processor-from-a-dp-pool","children":[]},{"id":"ci_72a039901b5004a29ee7d26c8071d5a1644c1f59dc678051dbc38fcaee29a52b","title":"Configure a System Monitor Agent into DP Pool Mode","path":"/lrsiem/docs/configure-a-system-monitor-agent-into-dp-pool-mode","children":[]},{"id":"ci_658c13af192d61e514415529ecf0682c9b0ed2838c673981004d6b86e1c3fac8","title":"Edit System Monitor Data Processor Settings","path":"/lrsiem/docs/edit-system-monitor-data-processor-settings","children":[]},{"id":"ci_e501869de0272cffbd2cae67575c3cde23cbc69673bd8560ad6b19f53f305992","title":"Assign a DP Pool to a System Monitor Configuration Policy","path":"/lrsiem/docs/assign-a-dp-pool-to-a-system-monitor-configuration-policy","children":[]}]},{"id":"ci_2834c72a49492c6f87b11ad4100e8ad9b9e2d89bc58d235195b30499dc8134ab","title":"License System Monitors","path":"/lrsiem/docs/license-system-monitors","children":[]},{"id":"ci_dbb5560b56c7f7af3a2d032711dd285df35e98fcfe461ccdad4bfef3fb7553ef","title":"Load Balanced Agent Groups","path":"/lrsiem/docs/load-balanced-agent-groups","children":[{"id":"ci_d27738615e13d81b9500b03cc6eaaa7846978b3b5a020ab93911ed636a066315","title":"Load Balanced Group Manager","path":"/lrsiem/docs/load-balanced-group-manager","children":[]},{"id":"ci_ecf05e494233d2a8f29a7e93e4c51f3ba858176385a9668b34479ce66ba0da71","title":"Assign Agents to a Load Balanced Group","path":"/lrsiem/docs/assign-agents-to-a-load-balanced-group","children":[]}]},{"id":"ci_37a7c901e1373191339bee537af3d205653f98f9bfa41bba3b3a9992203e9865","title":"Modify System Monitor Basic Properties","path":"/lrsiem/docs/modify-system-monitor-basic-properties","children":[]},{"id":"ci_0c20d2136be6dd94b225855759f5a6745d0ca02f3b22b014a80eac2571630443","title":"Modify System Monitor Advanced Properties","path":"/lrsiem/docs/modify-system-monitor-advanced-properties","children":[]},{"id":"ci_fb7d948079143cf130a936d7540c6f9271c7fd1b121ea8b812ea60d7d9ee206f","title":"Modify Properties of Multiple System Monitor Agents","path":"/lrsiem/docs/modify-properties-of-multiple-system-monitor-agents","children":[]},{"id":"ci_9d99cc70ce47a5234345e54176b4bcd658a31bb5773861cbcfb4c6353c6829eb","title":"Modify System Monitors","path":"/lrsiem/docs/modify-system-monitors","children":[]},{"id":"ci_82fe1ef3cfb41b665af77f804d61c4ae8e1ac5a219fb722d4c60377adc849f1d","title":"Configure a Secure Syslog Agent","path":"/lrsiem/docs/configure-a-secure-syslog-agent","children":[]},{"id":"ci_15a40ddd6ca80c542543c5b1407fe160261bba02ae3b35be8562964891a56214","title":"Retire or Activate System Monitor Agents","path":"/lrsiem/docs/retire-or-activate-system-monitor-agents","children":[]},{"id":"ci_3280f7269dd26749e271d5e4ffdc6449a2cd57607dd399be5eeed7d86e643335","title":"Revert System Monitor Agents to Previous Configurations","path":"/lrsiem/docs/revert-system-monitor-agents-to-previous-configurations","children":[]},{"id":"ci_ac4d12295d7bb80f31e90136608ce0dc581fa10511e732bea3c9b73a6a38e8bf","title":"Startup and Shutdown System Monitors on Linux","path":"/lrsiem/docs/startup-and-shutdown-system-monitors-on-linux","children":[]},{"id":"ci_83cab51a4b1b3de07831180ffe33b0f85194cb7d75ff86b18d22e6cac5c26e5b","title":"Stop, Start, and Restart Agent Services on Windows","path":"/lrsiem/docs/stop-start-and-restart-agent-services-on-windows","children":[]},{"id":"ci_8089c96e18608f9502cf013a863534e9520b4087badfecc46707ab5c340e3bcb","title":"Generic JSON Collector","path":"/lrsiem/docs/generic-json-collector","children":[]}]},{"id":"ci_c12fc0b5048b170f7a70e5c21b7d67869e96cf52932790ff88dc9ce4c4e4b83c","title":"Register Agent to Host with Duplicate Name","path":"/lrsiem/docs/register-agent-to-host-with-duplicate-name","children":[]},{"id":"ci_42d22c247d416b9fa6d0231fe3e648b53c3cec54f74e747bc445ad38de98cdfb","title":"sFlow Collection","path":"/lrsiem/docs/sflow-collection","children":[{"id":"ci_1d55ebfe53f9fc742ff3aa328759622eec70c1df203ae84ed4c7423ff2740bc4","title":"Configure a Device or Host for sFlow Collection","path":"/lrsiem/docs/configure-a-device-or-host-for-sflow-collection","children":[]}]},{"id":"ci_5301242ecc2f8a701f4772ed16022ad7e52c9a79a71df505cab9e960199ba6d2","title":"SNMP Trap Receivers","path":"/lrsiem/docs/snmp-trap-receivers","children":[{"id":"ci_4d619df1b9d14cb13cbd704f8e40f383bf5b728fe9e76dacf3e52373af55586a","title":"Configure a System Monitor for SNMP Trap Receiver","path":"/lrsiem/docs/configure-a-system-monitor-for-snmp-trap-receiver","children":[]}]},{"id":"ci_c69a783da57dc51905db7be3c729c5fbb8ee6a5a9de08c970794bb518cfaac5e","title":"System Monitor Configuration Policy Manager","path":"/lrsiem/docs/system-monitor-configuration-policy-manager","children":[{"id":"ci_5347b4179be4a10de733467fcec3c7e31b314f490ff456984a7fcb1dfd1c69f6","title":"Apply System Monitor Configuration Policies","path":"/lrsiem/docs/apply-system-monitor-configuration-policies","children":[]},{"id":"ci_dfdd407cf4075207c0bbc519e51793208ce84fcc5bb7698797e59f784de64158","title":"Assign Configuration Policies to Multiple System Monitor Agents","path":"/lrsiem/docs/assign-configuration-policies-to-multiple-system-monitor-agents","children":[]},{"id":"ci_b7db46bc15d66ca15716f5b8e8dd375ed72201a279d96ddea2138559e380e2a0","title":"Create New System Monitor Configuration Policies","path":"/lrsiem/docs/create-new-system-monitor-configuration-policies","children":[]},{"id":"ci_c569ae04f5d0f45ba33f764348ee46012981a544067a260a032957e93b7e73d2","title":"Delete System Monitor Configuration Policies","path":"/lrsiem/docs/delete-system-monitor-configuration-policies","children":[]},{"id":"ci_32b579d37bb713767ea111a45a70b9e60fdc865be5d711d66972c8cc45a6e1b0","title":"Modify Configuration Policies on System Monitor Agents","path":"/lrsiem/docs/modify-configuration-policies-on-system-monitor-agents","children":[]},{"id":"ci_bdf99bbf61160096fe780f02f2afa2e111f093778642141bdff2eaa7e1ad342e","title":"Modify System Monitor Configuration Policies","path":"/lrsiem/docs/modify-system-monitor-configuration-policies","children":[]}]},{"id":"ci_d18a956dd38dcebc383aeb8345d85cae2d9d1521c43c4615f707d0e69f1ba652","title":"Unidirectional Windows Agent Settings","path":"/lrsiem/docs/unidirectional-windows-agent-settings","children":[{"id":"ci_e8eae3bbe1da7f72006da08c22e0a19e4ec319fd62a35b4356597a07243f1a97","title":"Confirm a SysMon Agent is Sending Logs","path":"/lrsiem/docs/confirm-a-sysmon-agent-is-sending-logs","children":[]},{"id":"ci_eef35df22e7c4cef351e64800912444eefe6c17e38df3bfaa7bacb05641e2657","title":"Copy the System Monitor Agent Configuration File to the Agent Machine","path":"/lrsiem/docs/copy-the-system-monitor-agent-configuration-file-to-the-agent-machine","children":[]},{"id":"ci_e64fe840c12b701392d53c7cde4b3710fef6325226f8ac2d767fe128665473af","title":"Enable the Unidirectional Feature on the Data Processor","path":"/lrsiem/docs/enable-the-unidirectional-feature-on-the-data-processor","children":[]},{"id":"ci_62457d18d7859cf7456a79e7ce3b13d0b1dd0bbc802d9254f048f75be5d79432","title":"Enable the Unidirectional Feature on the System Monitor Agent","path":"/lrsiem/docs/enable-the-unidirectional-feature-on-the-system-monitor-agent","children":[]},{"id":"ci_02c356a6721879cbbfb18f5c99fc8a85b85dfc656dfb1e098e7b532982785f18","title":"Export the System Monitor Agent's Local Configuration File","path":"/lrsiem/docs/export-the-system-monitor-agent-s-local-configuration-file","children":[]}]},{"id":"ci_67443845bad2235dc1456f01388036377b7122e7ee95a4a8b121b6c93cb35fd5","title":"Windows Event Log Collection","path":"/lrsiem/docs/windows-event-log-collection","children":[{"id":"ci_dbc7efbed40d6248d1bd6af0f680b2fa43202eadc041dd4e0fc01b4a0a5d8316","title":"Collect Non-Domain Logs Remotely","path":"/lrsiem/docs/collect-non-domain-logs-remotely","children":[]},{"id":"ci_f2b928d9fec8b16a52b612a3b2586fb3f2c895f5f8959d0ffb25d9af8662084b","title":"Create a Least-Privileged Domain User Account for Remote Log Collection","path":"/lrsiem/docs/create-a-least-privileged-domain-user-account-for-remote-log-collection","children":[]},{"id":"ci_96b423433371f6ede712242fe8f8d56e51b3cc4c6ec9b77f62e802d11a79a0b5","title":"Set Up Remote Log Collection","path":"/lrsiem/docs/set-up-remote-log-collection","children":[]}]},{"id":"ci_5137682563681fef9cf70922089a3708c318a116b42afb180441bcbb3869e66c","title":"Syslog Collection","path":"/lrsiem/docs/syslog-collection","children":[{"id":"ci_bf3da645a08b5c1e78701139311f86a907d61fc5cf350b10f40e6643fc8aca22","title":"Configure a Device or Host for Syslog Collection","path":"/lrsiem/docs/configure-a-device-or-host-for-syslog-collection","children":[]}]}]},{"id":"ci_975333b89c4b716af9e1b5ca4ead59f73b8653984dc4abb20bebfdcc32e8c476","title":"Platform Manager","path":"/lrsiem/docs/platform-manager","children":[{"id":"ci_429ccf0979c1b53b19492d65dc236db88f215baf09dd1ee07e4184e1ef86222d","title":"Alarming, Reporting, and Response Manager Services","path":"/lrsiem/docs/alarming-reporting-and-response-manager-services","children":[{"id":"ci_3e4f9d78d9b2887eed06162a2a255363578847a31f4a15ed6fbd85d932cd82a9","title":"Apply Recommended Platform Manager Values","path":"/lrsiem/docs/apply-recommended-platform-manager-values","children":[]},{"id":"ci_639f78e27b353ce471de22d6ef7ed9742eefed4c8e795a0d0bf50694b9fa5a31","title":"Integrate LogRhythm and McAfee ePolicy Orchestrator","path":"/lrsiem/docs/integrate-logrhythm-and-mcafee-epolicy-orchestrator","children":[]},{"id":"ci_f018faa31a68e270a13d2cc86e575ee84f17e589dd26f6f2baddcec305d1cfaf","title":"Modify Platform Manager Advanced Properties","path":"/lrsiem/docs/modify-platform-manager-advanced-properties","children":[]},{"id":"ci_1826c8f035abcd2343bf5f9046989462308fd7a82a8129a17ad59846945c081d","title":"Modify Platform Manager Basic Properties","path":"/lrsiem/docs/modify-platform-manager-basic-properties","children":[]},{"id":"ci_03ca309b4620a37564df77e32a5ba40518e2636b7fdcfaad40a192a7e161a98f","title":"Revert to a Previous Platform Manager Configuration","path":"/lrsiem/docs/revert-to-a-previous-platform-manager-configuration","children":[]},{"id":"ci_c0f9e1181c2a239a756f2c0c4c891073b1d95323ada575b19e02b5a271471680","title":"Specific SMTP Servers to Allow for Failover","path":"/lrsiem/docs/specific-smtp-servers-to-allow-for-failover","children":[]},{"id":"ci_7456727dc77469a2aed35e4aa798888db37f3fe5921e44a38580419818a37174","title":"Start, Stop, and Restart Platform Manager Services","path":"/lrsiem/docs/start-stop-and-restart-platform-manager-services","children":[]}]},{"id":"ci_451d54746b1a5f3ec82233aec413106acca7432ddbd45360cf5f80446264c183","title":"Global Risk Based Priority","path":"/lrsiem/docs/global-risk-based-priority","children":[{"id":"ci_913202f8d3690b069df4c19a99b80b30d67374afecd3a833a3b79474042d967b","title":"Determine the MPE RBP Manually","path":"/lrsiem/docs/determine-the-mpe-rbp-manually","children":[]},{"id":"ci_5e0e1648943875744126251223f2d74ceb3070cdd7f0f8f95149bde806fb27a4","title":"Modify AIE Risk Based Priority Settings","path":"/lrsiem/docs/modify-aie-risk-based-priority-settings","children":[]},{"id":"ci_d64792e2846ce36125916d9cb6e59e7f6584e19bb47e334ea38dc41f7ce36dde","title":"Modify the Default Destination Risk Level","path":"/lrsiem/docs/modify-the-default-destination-risk-level","children":[]},{"id":"ci_bdf39a6e4e1df4a7c51da799e6b5452c0d77b3542e72d3345a5d673540d49505","title":"Modify the Default Source Threat Level","path":"/lrsiem/docs/modify-the-default-source-threat-level","children":[]},{"id":"ci_cc5ad02a8042c0e7d0dad96238e7b987557a489879bec680c15451cc6c954149","title":"Modify the MPE Risk Based Priority Settings","path":"/lrsiem/docs/modify-the-mpe-risk-based-priority-settings","children":[]},{"id":"ci_19aa1cf4b4140731911a251d2d1449f4af6611e210947d4068cbdb075a717cf2","title":"Risk Based Priority Calculator","path":"/lrsiem/docs/risk-based-priority-calculator","children":[{"id":"ci_299a3b6353bac55031b9d83cf7133f3e6939e764b45bf1ed6555e4c5b90977c4","title":"Install the RBP Calculator","path":"/lrsiem/docs/install-the-rbp-calculator","children":[]},{"id":"ci_184474716b8c1e352976edb311f8a518dcbc26727ba97e85624b4e4ae0d0d950","title":"Determine MPE or AIE Risk Based Priority With The RBP Calculator","path":"/lrsiem/docs/determine-mpe-or-aie-risk-based-priority-with-the-rbp-calculator","children":[]},{"id":"ci_44bb9bfd91472209d9a8d98d57f309e10b2d726ce5f325214647c5fb956ba99b","title":"Transfer AIE RBP Calculator Values to a LogRhythm Deployment","path":"/lrsiem/docs/transfer-aie-rbp-calculator-values-to-a-logrhythm-deployment","children":[]},{"id":"ci_ac952491fb8966e658018415675b889032db97eb0c0d9cf84b29f1769a36407f","title":"Host, Network, and Default DRL and STL Settings","path":"/lrsiem/docs/host-network-and-default-drl-and-stl-settings","children":[{"id":"ci_ac74896142b7f5b8767ffaa76c9c1c3108132a7741454b869af46e59bcd1d93c","title":"Known Host and Network Search Algorithm","path":"/lrsiem/docs/known-host-and-network-search-algorithm","children":[]}]},{"id":"ci_fed6eafa0459a89980e29c85817b2521ee801d664fa7571fa7474ea917f88f17","title":"Message Processing Engine RBP Algorithm","path":"/lrsiem/docs/message-processing-engine-rbp-algorithm","children":[]},{"id":"ci_bd6adc2590ceb3a0f85cce8cb628ecb1247751211c8fc793ce8430e3b4d68b7e","title":"AI Engine RBP Algorithms","path":"/lrsiem/docs/ai-engine-rbp-algorithms","children":[]}]}]},{"id":"ci_e5484d87ef3ad2d96e6b3c0e3bb6da8199a21288806f85a82ab660357d0d4ad8","title":"Job Manager Services","path":"/lrsiem/docs/job-manager-services","children":[{"id":"ci_565d12a6edb4d1003a4e4a7d3bbaa066be085c2bdae81f26e6cd41d6fefa9a70","title":"Modify Job Manager Advanced Properties","path":"/lrsiem/docs/modify-job-manager-advanced-properties","children":[]},{"id":"ci_df26013b341d13584ebd6621c7bd57e6f02fb57478cca7be8532552034e1f7ff","title":"Modify Job Manager Basic Properties","path":"/lrsiem/docs/modify-job-manager-basic-properties","children":[]},{"id":"ci_67bc59d0684a24aac34cbeac2a66babcad11941ee33f4b4a6e55062e94303dee","title":"Start, Stop, and Restart Job Manager Services","path":"/lrsiem/docs/start-stop-and-restart-job-manager-services","children":[]},{"id":"ci_a809aa458884d1913d1afb429eea3f463f8135518dc5a82bf788d42f5ffe9a80","title":"Use the Job Manager Configuration Manager","path":"/lrsiem/docs/use-the-job-manager-configuration-manager","children":[]}]},{"id":"ci_8207988cc2183f207f51a2aa54e2a1f2e8ad62ddb2d0920d5c49663972fd8549","title":"System Management Settings","path":"/lrsiem/docs/system-management-settings","children":[{"id":"ci_c29564601f7320e2f9383e265891a454742e85ae25ad470b2995419ecd21b24c","title":"Active Directory Domain Manager","path":"/lrsiem/docs/active-directory-domain-manager","children":[{"id":"ci_4f6800c45cebd1062a572ab5916d39c899927fe6f9c071a59131fece03efc78d","title":"Add Active Directory Groups as Filters","path":"/lrsiem/docs/add-active-directory-groups-as-filters","children":[]},{"id":"ci_df0cdf826bb11b60a83a6a3ea97a9e30310bb4a220353365173bc140caa21e75","title":"Add New Active Directory Domains","path":"/lrsiem/docs/add-new-active-directory-domains","children":[]},{"id":"ci_b394346b23c341bf73524028f6a4d582e1bcde692c44eb4cb15c9042045c8b43","title":"Check the Active Directory Synchronization Status","path":"/lrsiem/docs/check-the-active-directory-synchronization-status","children":[]},{"id":"ci_5e00cd563bb5f2f294419a69db691417f31430bc94dc3fb73c9e8fcfaed5ab65","title":"Modify Active Directory Domains","path":"/lrsiem/docs/modify-active-directory-domains","children":[]},{"id":"ci_ca7eec055dbfe4390fe8be820460a5459c9ba0cb30242c24e3b0bbf75255286f","title":"Retire or Activate Active Directory Domains","path":"/lrsiem/docs/retire-or-activate-active-directory-domains","children":[]},{"id":"ci_51dd3ae50bb506205fbc14308821272094a46213d62239f6d192c6696de9c97c","title":"Run Active Directory Browser Investigations","path":"/lrsiem/docs/run-active-directory-browser-investigations","children":[]}]},{"id":"ci_16305d454d6dfb1fa8d603baaffe921593272349d08ee69b0de2b8d1d57798d2","title":"Configure Global Maintenance Settings","path":"/lrsiem/docs/configure-global-maintenance-settings","children":[]},{"id":"ci_ebe8e5df332947f9fcba13da2f37d9da98893ed56915d4fcb6a48ddc4749c865","title":"Set or Modify Data Management Settings","path":"/lrsiem/docs/set-or-modify-data-management-settings","children":[]},{"id":"ci_545a046d5450928221431daa20f93bd26adeb88506b5c9b68ee7c1386b59b08e","title":"Enable Intelligent Indexing Globally","path":"/lrsiem/docs/enable-intelligent-indexing-globally","children":[]}]},{"id":"ci_8b1a3a0dbb8057f78cd1d390c7a25f6f3c5cb33cda38b009d6fc211081cf782e","title":"Update the IP Address of the Platform Manager","path":"/lrsiem/docs/update-the-ip-address-of-the-platform-manager","children":[]},{"id":"ci_c028f6a6559bff7943a583561c948b77f33b240bc12cf0198d100bdba473177e","title":"Use the Platform Manager Configuration Manager","path":"/lrsiem/docs/use-the-platform-manager-configuration-manager","children":[]}]}]},{"id":"ci_1a2ab497c6dc49d4b58279e79cca8e1e2fcb0334c31bc8575dcbe313618742c2","title":"Client Console Analyst Guide","path":"/lrsiem/docs/client-console-analyst-guide","children":[{"id":"ci_86160b95117b44332bf08c62902b1e437ed1daafd2e42bde040dd5d5ddaf3256","title":"Filters and Wizards","path":"/lrsiem/docs/filters-and-wizards","children":[{"id":"ci_51b32099387fdfcdd100051676d1b645a8c361716ef0d82ce3a67bd375545bf9","title":"Use Filter Modes","path":"/lrsiem/docs/use-filter-modes","children":[]},{"id":"ci_31da694fbcb3d1d11c3304470ae180b8964210cb819ae4f532fbe915eb34c5c1","title":"Use Lists with Filters","path":"/lrsiem/docs/use-lists-with-filters","children":[]},{"id":"ci_1e055a95609707fa8d1f5c3ed481b9bebd71175fcc951a00d49924e72b29085f","title":"Use Multiple Filters","path":"/lrsiem/docs/use-multiple-filters","children":[]},{"id":"ci_b71c8c392695fcf2676edf3f61fad82b135a485366ef48ce7f4eb68e08ec517c","title":"Use Multi-Type Filters","path":"/lrsiem/docs/use-multi-type-filters","children":[]},{"id":"ci_d589ff3a4c59861828f134c87cebf609dabb635676a4be30cde0a8dd03d90873","title":"Use Search Strings with Filters","path":"/lrsiem/docs/use-search-strings-with-filters","children":[]},{"id":"ci_6e7852633fca1f3750cf6e0a2d73ead3994c5f2b1094e30ff24ceec6890e8bb9","title":"Use SQL Pattern Match with Filters","path":"/lrsiem/docs/use-sql-pattern-match-with-filters","children":[]},{"id":"ci_7d6a10c3d6ff55840ee2df0e11eff2205b30867f9c2e51187f0dcec4af5dd17d","title":"Use the Filter Editor","path":"/lrsiem/docs/use-the-filter-editor","children":[{"id":"ci_5f25052c0e6901956bd1abccc55a61d85c443f596adb59ba0668e5b92802580d","title":"Filters—Action","path":"/lrsiem/docs/filtersaction","children":[]},{"id":"ci_728a958dc3b6327c56181bf0db6e98830524796572d59220fa37545c2e5650f0","title":"Filters—Aggregation","path":"/lrsiem/docs/filtersaggregation","children":[]},{"id":"ci_0ba5dad4ada09bca81ed0e20b18644489167284dfe93652a74c5ad7a3e29e5e5","title":"Filters—AIE Summary Fields","path":"/lrsiem/docs/filtersaie-summary-fields","children":[]},{"id":"ci_bc5b4e6810446358d9a39a59849c5640b394c281c71e197a73fdfd27c4a6e918","title":"Filters—Data Fields","path":"/lrsiem/docs/filtersdata-fields","children":[]},{"id":"ci_8c7c49a866ca42335e6215fcadeca10fc67d1973df434970ed75aab701dee19e","title":"Filters—Day and Time Criteria","path":"/lrsiem/docs/filtersday-and-time-criteria","children":[]},{"id":"ci_cf95df8b7fb87770a13abb8a32e312324a22214789d24a91d53fbd32d0a94453","title":"Filters—Distinct","path":"/lrsiem/docs/filtersdistinct","children":[]},{"id":"ci_780f08a9767411e384ed372a5b1931898477a4af6e9a680f3319e6fb8c333a11","title":"Filters—Exclude Filter","path":"/lrsiem/docs/filtersexclude-filter","children":[]},{"id":"ci_ddd3b261a8e229bdf37e4100fdcd6f2347b9daea98e13d665283c509f7d1b19d","title":"Filters—Expressions","path":"/lrsiem/docs/filtersexpressions","children":[]},{"id":"ci_0b31781294b7f02cbe11fc4f1b361690d6c87713d23a198711f735128d0bcb28","title":"Filters—Group By","path":"/lrsiem/docs/filtersgroup-by","children":[]},{"id":"ci_9fd2095eea8ae3a44e07a4f20a3f09b130e8abbe296afa3e64aa8ed5916883c1","title":"Filters—Include Filter","path":"/lrsiem/docs/filtersinclude-filter","children":[]},{"id":"ci_0fb5ea0f9149e9d22abb3b882031c0820388a40299a6fc7d730f1d28a9475da0","title":"Filters—Information","path":"/lrsiem/docs/filtersinformation","children":[]},{"id":"ci_48a515e311febda05c3bf484b544210bd2a6a101cdbb55ca3330400e0a4bdfa3","title":"Filters—Log Source Criteria","path":"/lrsiem/docs/filterslog-source-criteria","children":[]},{"id":"ci_1f5325a946cc770c64de0f2d084509441cb9aed35bffcf4b6f4388953d66ed9c","title":"Filters—Notify","path":"/lrsiem/docs/filtersnotify","children":[]},{"id":"ci_7587c53355ab4ce359f7fcadba41e30ec710b441b0ee42dab2d0a24de5c21240","title":"Filters—Primary Criteria","path":"/lrsiem/docs/filtersprimary-criteria","children":[]},{"id":"ci_8586ffda033f8780b4997458a98cab6f8edbfb5e2814af10071ea5571cb6a7af","title":"Filters—Profile","path":"/lrsiem/docs/filtersprofile","children":[]},{"id":"ci_d834c404e6396d336f1f131fa10c668bf5db7722f546af86dc5c9d4418171120","title":"Filters—Schedule","path":"/lrsiem/docs/filtersschedule","children":[]},{"id":"ci_4dbc4313c3034a090f4c7d483518c44f99a98c01491026b0b8f75e08e29b73bc","title":"Filters—Settings","path":"/lrsiem/docs/filterssettings","children":[]},{"id":"ci_d6df9b0891760e2ad24a652e8cebe9cc60757ab2cb4fa07748ecc0d372dc435d","title":"Filters—Thresholds","path":"/lrsiem/docs/filtersthresholds","children":[]},{"id":"ci_ee830026f758e984f67c91abbdfcc011f65222acca814908b02ae62e606dfcfc","title":"Filters—Time and Schedule","path":"/lrsiem/docs/filterstime-and-schedule","children":[]},{"id":"ci_264dc5cac46890a69ae9e601aec2e3e7681ab2fedc353c4134baa2fc61363518","title":"Filters—Unique Values","path":"/lrsiem/docs/filtersunique-values","children":[]}]}]},{"id":"ci_b1b0cfb2030cfb198682c006edd2422616d55b3946663a1717c96fc5b56b08a7","title":"General Console Features","path":"/lrsiem/docs/general-console-features","children":[{"id":"ci_5166f0d0f9093b2f07d971a99fdc593f45eff806a5e5d70bb7df0824eb947d92","title":"Export Grid to File","path":"/lrsiem/docs/export-grid-to-file","children":[]}]},{"id":"ci_773efa93414df676a52a50e7221213480407c84b9f98f2d89cda287673e59d9e","title":"Layouts","path":"/lrsiem/docs/layouts","children":[{"id":"ci_8ae78e71310ed7ed3287e72dd37ede2ac0079e37f76d489dbe7a16045f0f9ca4","title":"Clone Existing Layouts","path":"/lrsiem/docs/clone-existing-layouts","children":[]},{"id":"ci_9a82301c22f9fe3324e8f87037c2b89241746ad4eba7ef39e333d5088fb9e4af","title":"Create New Layouts","path":"/lrsiem/docs/create-new-layouts","children":[]},{"id":"ci_84ebf943c37c7093a2a660cbc951db56edace2cb44d1ad32b2a9b1c5295c4a7f","title":"Delete Layouts","path":"/lrsiem/docs/delete-layouts","children":[]},{"id":"ci_f1b1b9c5ba9e4f2bf1cb3590ca1351e6eb0c6940f5f4fbcb757d6ed8112d482f","title":"Import and Export Layouts","path":"/lrsiem/docs/import-and-export-layouts","children":[]},{"id":"ci_8920004ff2322da1178f13970f25e58a1f7b35ef87d30f4c92bf7bd4607b6f41","title":"Make or Clear Default Layouts","path":"/lrsiem/docs/make-or-clear-default-layouts","children":[]},{"id":"ci_8f50c4b7ab5f3069250cb10b3059172d7818e8366585663500600547cadba38c","title":"Modify Layout Properties","path":"/lrsiem/docs/modify-layout-properties","children":[]},{"id":"ci_abe666c825c34fee86cdb7016449ad11cc72157222a9a9334a10dd53a2147673","title":"Reset Layouts","path":"/lrsiem/docs/reset-layouts","children":[]},{"id":"ci_72b7401fbd6b476c2cedcd13c13c133899238cc96bf6b87cb70368acd493cbf6","title":"Save Layouts","path":"/lrsiem/docs/save-layouts","children":[]},{"id":"ci_63f0025427c36ad534a10ebdf8e3230747fff2821384e1e1660c071c6ec75a17","title":"Set Color Themes in Layouts","path":"/lrsiem/docs/set-color-themes-in-layouts","children":[]}]},{"id":"ci_cab1ed293c1c58749c1c1880e329706cdce96205f1462e2f5d889d0e9ce3c2b5","title":"Lists in the Client Console","path":"/lrsiem/docs/lists-in-the-client-console","children":[{"id":"ci_f6b68d902f2a42877161e815825f420dcd38182711fbf4015e73d722704e4781","title":"Add Expiring Items to a List","path":"/lrsiem/docs/add-expiring-items-to-a-list","children":[]},{"id":"ci_a47ebda2f5d0d6a5976628d75313d55eedf1136916e1600abbe91bc6a2533ec2","title":"Add Values to a List","path":"/lrsiem/docs/add-values-to-a-list","children":[]},{"id":"ci_303590b6585a27f205f81a2604986604bf374c78029a33509aff3141fb7df5f1","title":"Clone Lists","path":"/lrsiem/docs/clone-lists","children":[]},{"id":"ci_aeaa25ecd8ed2cc2d0e7bb4ca210e7650197fbeebb437c7a4ec2f23ccab0dd1e","title":"Create Lists in the Client Console","path":"/lrsiem/docs/create-lists-in-the-client-console","children":[]},{"id":"ci_3a2abcc24555c03f3aef8d36c8163b887bd1f14d5594281a3ff9b81cc1575083","title":"Modify the Properties of Lists","path":"/lrsiem/docs/modify-the-properties-of-lists","children":[]},{"id":"ci_c4b716377015ef3332249e2a9917655cdea64a9c342fc47dad2c6eec5524ed73","title":"Remove List Items","path":"/lrsiem/docs/remove-list-items","children":[]},{"id":"ci_52cfdb01c373a00c6ba4b104278b12de9868488ab78d5c6efac81a27c3dfcce8","title":"Reset Expiration Date for List Items","path":"/lrsiem/docs/reset-expiration-date-for-list-items","children":[]}]},{"id":"ci_5474f94596c000254b2af18431a379ee9c87562f98dd79cae3ea0f9b4ec22494","title":"Message Processing Engine Rule Builder","path":"/lrsiem/docs/message-processing-engine-rule-builder","children":[{"id":"ci_d45454b0de83eaaa816922e2743091badbfec3fbcadccb5e46002f31a1e6599a","title":"Application Manager","path":"/lrsiem/docs/application-manager","children":[{"id":"ci_5567c299842a52f08c263575ec4d818cb88b4ef1c1ec030920defd9912fb1abc","title":"Create New Application Records","path":"/lrsiem/docs/create-new-application-records","children":[]},{"id":"ci_158d6999fbb4a07ca774475504461f03b3d49ce57f49c32121dc1bc886cd5e40","title":"Modify Application Record Properties","path":"/lrsiem/docs/modify-application-record-properties","children":[]},{"id":"ci_cf27d34b15aa08be0e2ccd2178f2209b9b842d99853e075d26e98ff45a8af2aa","title":"Refresh the Application Manager","path":"/lrsiem/docs/refresh-the-application-manager","children":[]},{"id":"ci_9352d1cfe495f1be96a421625da2ce8cad2ec9dee40a9990fb594d4a0b77cc2f","title":"Retire or Activate Application Records","path":"/lrsiem/docs/retire-or-activate-application-records","children":[]}]},{"id":"ci_3cfa030d604b75fc6f8c8a31fdd8e2af98296ee7b2f67c01ca954b90eab4aa7a","title":"Common Event Manager","path":"/lrsiem/docs/common-event-manager","children":[{"id":"ci_3f4d4192b0b483f5841e332baa437bdc7cbe9a409500b0a4c9fbddd63f0ed99a","title":"Create Common Events","path":"/lrsiem/docs/create-common-events","children":[]},{"id":"ci_6a741923dc3f9ffede1b394724e5369d619be78f11ba5b5b583393ca953bb56c","title":"Delete Common Events","path":"/lrsiem/docs/delete-common-events","children":[]},{"id":"ci_c51f54eb992fe2f4b7a0aac22f81e45970715601a6837a6855b8d7d05157fea4","title":"Modify Common Events","path":"/lrsiem/docs/modify-common-events","children":[]},{"id":"ci_0a490e9d7187746448eca02d3fee40553bb9f0f3c6e1ac0579a7f9ef4714fd41","title":"Search for Common Events","path":"/lrsiem/docs/search-for-common-events","children":[]}]},{"id":"ci_bee1ba9a38a94191149b637efae45ff9cc34947e25d8a0ca952b0a86278f3e86","title":"Create MPE Policies","path":"/lrsiem/docs/create-mpe-policies","children":[]},{"id":"ci_1ebedda9c995b4e7a6038beb3baabd99e36be10b2ec15369c23255d2da7456b6","title":"Create New Base MPE Rules","path":"/lrsiem/docs/create-new-base-mpe-rules","children":[]},{"id":"ci_9a8a813c8bbae74fc5d7d7cb97043d89fd9fec19acae2c4fa7ba492ed0262d8f","title":"Edit MPE Rules","path":"/lrsiem/docs/edit-mpe-rules","children":[]},{"id":"ci_a1a4e40d78d4ad66be9121932e628a835d927f06b1be3d26bb85a4925f350eee","title":"Edit Sorting Properties for System Base MPE Rules","path":"/lrsiem/docs/edit-sorting-properties-for-system-base-mpe-rules","children":[]},{"id":"ci_ea9ca131f278331b6e7b8bbe77c5b7a3767beedb660345ec45799dc36ddac40f","title":"Import and Export MPE Rules","path":"/lrsiem/docs/import-and-export-mpe-rules","children":[]},{"id":"ci_0f988ef7f5c3e23452d348433ffdd392003d42af9cea053ab5b0dfe99b1c35c0","title":"Regular Expression Characters and Practices","path":"/lrsiem/docs/regular-expression-characters-and-practices","children":[]},{"id":"ci_f2278eecd98facb7c1ca2d69009ec85ce87a5d17d1dfd51c4c79489d3bf92311","title":"Create Custom MPE Sub-Rules","path":"/lrsiem/docs/create-custom-mpe-sub-rules","children":[]}]},{"id":"ci_84db1c52d5049239a02e01800e2b7f632c234ebe1d46acbc198e4bc4b72ece44","title":"Monitor, Search, and Analysis","path":"/lrsiem/docs/monitor-search-and-analysis","children":[{"id":"ci_dee122419860ba69b0050edaec90c20cd3b78019a2cbc9d02aee7ec9b853a9bc","title":"Alarm Viewer","path":"/lrsiem/docs/alarm-viewer","children":[{"id":"ci_738948c39e9b7802f21fd3b10bd4a09458ee5c565d24b8252a78c4558d7743ce","title":"Change the Status of a Single Alarm","path":"/lrsiem/docs/change-the-status-of-a-single-alarm","children":[]},{"id":"ci_3c551b8e58526e78051f30ae1d6bf38b26b3e48f163a9070a358583913c19878","title":"Change the Status of Multiple Alarms","path":"/lrsiem/docs/change-the-status-of-multiple-alarms","children":[]},{"id":"ci_54e9b544cd866975e4267d0e5180afe42dc0e887c5dce346a94f6a4752d4ad1e","title":"Create Alarm Lists","path":"/lrsiem/docs/create-alarm-lists","children":[]}]},{"id":"ci_bc4b62a9a13872e76ab624e611d469af07ba7b6ba6e4c07095db74782f0d2382","title":"Investigator","path":"/lrsiem/docs/investigator","children":[{"id":"ci_64f674feafa63607a07716497fab21181c961f9a01abebe3ed321eb06e252ee2","title":"Change Share Permissions on a Saved Investigation","path":"/lrsiem/docs/change-share-permissions-on-a-saved-investigation","children":[]},{"id":"ci_ba0a9b55044efeb86a48224f50eb52c95c6c43f673b2c6843355fb604dbbfd78","title":"Create Investigations","path":"/lrsiem/docs/create-investigations","children":[]},{"id":"ci_9d4c58379b9d1eb414f6c9c93f721982da3c3f24dbfc2ca3c9279ffeb115c1c8","title":"Drill Down on a Single Item in Investigation Results","path":"/lrsiem/docs/drill-down-on-a-single-item-in-investigation-results","children":[]},{"id":"ci_c767f06342df4ed01323512c764e9b0949a03b470b13100c33995030baf1bb59","title":"Drill Down on Multiple Items in Investigation Results","path":"/lrsiem/docs/drill-down-on-multiple-items-in-investigation-results","children":[]},{"id":"ci_3cfca3075563adb1a83bfd4eed0bdbee02c99ba71fb5d4c793ceea29ccb53567","title":"Import and Export Investigations","path":"/lrsiem/docs/import-and-export-investigations","children":[]},{"id":"ci_06485e0b5a9a4c5fb5e85c336d728c5bce803614beba01576e31bf226c1631c0","title":"Run Saved Investigations","path":"/lrsiem/docs/run-saved-investigations","children":[]},{"id":"ci_5641da4b581eb38d7874e652a45e77b6db00d0ad9443542c3877b71cbd4d1c07","title":"Save Investigations with Report Packages","path":"/lrsiem/docs/save-investigations-with-report-packages","children":[]},{"id":"ci_961d00a535408a1e1756ac3ac9c94ed8835bae17a775d80add88c353cf551de1","title":"Save Investigations with Report Templates","path":"/lrsiem/docs/save-investigations-with-report-templates","children":[]},{"id":"ci_c3203e898e3a867c5e1733dd6cf20df138e813bfaeee3aef72172847bd641d2d","title":"Search for Most Frequent Common Events","path":"/lrsiem/docs/search-for-most-frequent-common-events","children":[]},{"id":"ci_b27af8cf55d96252ec8e722d06c6f1c8c5c9666439d1057bd29bda6dfadae969","title":"View Metadata in the Log Viewer Tab","path":"/lrsiem/docs/view-metadata-in-the-log-viewer-tab","children":[]},{"id":"ci_a4aba5d1a25a0d570bb5c869fffec845c11a6a70cd537419fe1c577a7d723094","title":"Work With Investigation Result Graphs","path":"/lrsiem/docs/work-with-investigation-result-graphs","children":[]},{"id":"ci_477f3068ff72d8a323c4eeff1480b9bdd7ddb4c1183b2585ccbd54f97c5dfd6c","title":"Work with Log Miner","path":"/lrsiem/docs/work-with-log-miner","children":[]},{"id":"ci_6fbdb47ad40ad59e8d2e2f7084fb7808fe37c2ef5f2d0e5fd4753607c0fcd54e","title":"Work With Network Visualization Diagrams","path":"/lrsiem/docs/work-with-network-visualization-diagrams","children":[]}]},{"id":"ci_e5ea48fe35fe21d87f47d327817609f4a60d981691156a4cf3dbf93bef560d6f","title":"Personal Dashboard","path":"/lrsiem/docs/personal-dashboard","children":[{"id":"ci_f24322507247538804cae63b29fcddbcb3eaccadcd1174bbd54fe40e9bd528fb","title":"Add Personal Dashboard Filters","path":"/lrsiem/docs/add-personal-dashboard-filters","children":[]},{"id":"ci_56021a58181b7c8cf04bbe2217b1f5a23a78c8c934c2777be83db408e89da811","title":"Apply Personal Dashboard Filters","path":"/lrsiem/docs/apply-personal-dashboard-filters","children":[]},{"id":"ci_670c7fd089696fa037d006ef844d9e26a0c125fc1b8d2aa885bf161379041d00","title":"Clone Personal Dashboard Filters","path":"/lrsiem/docs/clone-personal-dashboard-filters","children":[]},{"id":"ci_1a5b3cc172df90efcabf7139d86ddcfaf260740974d3a073819f5530b483aaa4","title":"Configure the Personal Dashboard Display","path":"/lrsiem/docs/configure-the-personal-dashboard-display","children":[]},{"id":"ci_522fa4b457374d9e6b2c1d5b725a526ebafcbfd39096f1d64a6acdd20c213abd","title":"Delete Personal Dashboard Filters","path":"/lrsiem/docs/delete-personal-dashboard-filters","children":[]},{"id":"ci_82171abdd992769aa9bd70546e02a00fb9b790b2fe9e24f9998c483394639f6c","title":"Drill Down on Dashboard Data","path":"/lrsiem/docs/drill-down-on-dashboard-data","children":[]},{"id":"ci_fdce609713be54d6025a44513bf66b0a7990fce28a2b7cdd1a43fa80936d49ab","title":"Modify the Properties of Personal Dashboard Filters","path":"/lrsiem/docs/modify-the-properties-of-personal-dashboard-filters","children":[]}]},{"id":"ci_828814c898d99dd37881f380d31548d5de613c3e408c0d2d1fda0f4a7bf03142","title":"Quick Search Toolbar","path":"/lrsiem/docs/quick-search-toolbar","children":[{"id":"ci_19e68a58bc8d964cdc75f1c94eed48bf411dc335678f1e7a055f793876f28da9","title":"Use the Quick Search Toolbar","path":"/lrsiem/docs/use-the-quick-search-toolbar","children":[]}]},{"id":"ci_bc8da955b9f48bd465514012df9ab1fb6828f4a346b9af8a28db60651b17ffcd","title":"Run Contextualize","path":"/lrsiem/docs/run-contextualize","children":[]},{"id":"ci_a6ebaa2bdc2543674b15e0a5b32e2a6d96a165f7514717e1df7d2cbeeb7616f3","title":"Run Correlate","path":"/lrsiem/docs/run-correlate","children":[]},{"id":"ci_5f259a88b467b81d0eebd4bb9e8464756e0898673a1052ab139205c19b5bc6f7","title":"Tail","path":"/lrsiem/docs/tail","children":[{"id":"ci_70c78cfe5e8d4fc56e1395f648efe65d63217c32ff36790b6ef499f615da0c13","title":"Create New Tails","path":"/lrsiem/docs/create-new-tails","children":[]},{"id":"ci_c114936a4d7164f5603467ba8e4d78911280290a7411eda9808ca66960f8dc33","title":"Run Saved Tails","path":"/lrsiem/docs/run-saved-tails","children":[]},{"id":"ci_7df9507d161b94eedff2479fd9386377b700823231d2e8be1452bc4c6a7b03af","title":"Tail Log Sources","path":"/lrsiem/docs/tail-log-sources","children":[]}]},{"id":"ci_87af17c84ac5d018553a72c32d76a7ea91562d32009527fe54abbd339e3c78e6","title":"TopX Analysis","path":"/lrsiem/docs/topx-analysis","children":[{"id":"ci_cb73d7050862b253447a12f85a3f143331a6f135b25112684d2299db0bce0623","title":"Analyze TopX Results","path":"/lrsiem/docs/analyze-topx-results","children":[]},{"id":"ci_daa943b64c4f3ce372e98eee8d8c3178d73ad4771f12fd0cf3e588a692c36014","title":"Configure TopX Widgets","path":"/lrsiem/docs/configure-topx-widgets","children":[]}]}]},{"id":"ci_3ace29c4c99e059eb2a7781bec0867aaa6be7d3723abe65f17fa56092834a1ea","title":"My LogRhythm","path":"/lrsiem/docs/my-logrhythm","children":[{"id":"ci_e106d1631f53d9452aaf8f59ed8732950b0fe5b6e56ffe35190148710ec5fc64","title":"Add or Modify a Person Record","path":"/lrsiem/docs/add-or-modify-a-person-record","children":[]},{"id":"ci_6078262cfa9552ab80d7fbff363474203edf5679f427a98d12ff62777140f1b8","title":"Change Your Password","path":"/lrsiem/docs/change-your-password","children":[]},{"id":"ci_f7bf2f2399932c5e7e1f5187c270bca31942911bc86ebcc5bedc5edcc956dc3a","title":"Create Email Notification Policies","path":"/lrsiem/docs/create-email-notification-policies","children":[]},{"id":"ci_956193ca230a94de996c7cfb0a0bb0fb4c7d23f323a85888d173b82d19e6a0c1","title":"Manage Your Preferences","path":"/lrsiem/docs/manage-your-preferences","children":[]}]},{"id":"ci_f29643241030018b6bbb68ae9594058baa09c5faf1f4b9bf1ad5cb533b3d80b3","title":"Report Center","path":"/lrsiem/docs/report-center","children":[{"id":"ci_3117b88866c82ce6e37aff8d01e03c6b6de7b7b374dc4da4ed38bd7cbfb1c989","title":"Add Custom Logos to Reports","path":"/lrsiem/docs/add-custom-logos-to-reports","children":[]},{"id":"ci_d4de40a75bb7bd9dcd13e165a7e1c23c49abe57558c45a1da36dc187b9f57dca","title":"Clone Reports or Report Packages","path":"/lrsiem/docs/clone-reports-or-report-packages","children":[]},{"id":"ci_3eab381f01d774409b16ef0b6fe6583dd21c7cb8cbb9a5c0c5fe9995f22aa266","title":"Create Custom Log Detail Report Templates","path":"/lrsiem/docs/create-custom-log-detail-report-templates","children":[]},{"id":"ci_82537d41c69c1a854535823c0690501fafd8b2df3b01f73e52551e1dbbbbf6dd","title":"Create Custom Log Summary Report Templates","path":"/lrsiem/docs/create-custom-log-summary-report-templates","children":[]},{"id":"ci_5e70927363ad719eb765b1febb242452e50415d81c5dc2ca1c4cee82bb0c30ce","title":"Create Report Packages","path":"/lrsiem/docs/create-report-packages","children":[]},{"id":"ci_ce12d924934b3f2266dc11269d4b53c3929332060fbc6911f56282ec5e9eee2e","title":"Create Reports","path":"/lrsiem/docs/create-reports","children":[]},{"id":"ci_4c22f895aded2f9e0014c0de9ae0b1bfc5e725565184ff61d02d8ba73efbe05b","title":"Create Scheduled Reports","path":"/lrsiem/docs/create-scheduled-reports","children":[]},{"id":"ci_b305a07fb5de35071bc422b564d15f1fa5b2b963abc10cc20e61297da244e051","title":"Import or Export Reports or Report Packages","path":"/lrsiem/docs/import-or-export-reports-or-report-packages","children":[]},{"id":"ci_a2c894b3b69820ca041f12224b731e4fa1cee39ce1f25c21d8e4bb28d876868b","title":"Manage Scheduled Reports","path":"/lrsiem/docs/manage-scheduled-reports","children":[]},{"id":"ci_8f04ef357c5242e371c20d1d0fece5d348322b359e0759a9de02cdc44b6149a5","title":"Modify Custom Report Templates","path":"/lrsiem/docs/modify-custom-report-templates","children":[]},{"id":"ci_391b0436ae7ff5923cb375d4acfe5c86433ce768758d0f0624876ecfd8c6fddd","title":"Restore Default Logo to a Report","path":"/lrsiem/docs/restore-default-logo-to-a-report","children":[]},{"id":"ci_aef81710837a56bfdaf6561a9c16a6f4e51481c1b6540ea0ec719351ba55aa19","title":"Run Reports","path":"/lrsiem/docs/run-reports","children":[]},{"id":"ci_12775c8e810f1e36f380ef46ff2a478463c495d2df44d1ec0efe12fb43685e8e","title":"Run Reports as Investigations","path":"/lrsiem/docs/run-reports-as-investigations","children":[]},{"id":"ci_8bc0ae6ce9a9e45987590fc582b280f17519158c4f1b51b9381172e6b8419a4e","title":"Troubleshoot Empty Reports","path":"/lrsiem/docs/troubleshoot-empty-reports","children":[]},{"id":"ci_3eaec8da11fc771190211937d77e2fe7f1cbc372f3362bf335ab11df7a9b315e","title":"View Report Center Job Status","path":"/lrsiem/docs/view-report-center-job-status","children":[]},{"id":"ci_8d91917c3cf738846e3f733da0c7fcef62e452f19a94b03879df7ea3633ae0e6","title":"View Reports in the Client Console","path":"/lrsiem/docs/view-reports-in-the-client-console","children":[]}]}]},{"id":"ci_4a69d3971cad9ca42a31afc4c2798cf7cba237d1ba5358691a944a8e4e19be3a","title":"Web Console User Guide","path":"/lrsiem/docs/web-console-user-guide","children":[{"id":"ci_3d79b97995e0b83d0c1eb6f62346376ca9f56df25d964aa1d5b173415b05aef5","title":"Alarms","path":"/lrsiem/docs/alarms","children":[{"id":"ci_5c6e953c9482904d387c4372b029bdcc0559fe66a4a38495aa08baeac00e20f4","title":"Alarms Page Overview","path":"/lrsiem/docs/alarms-page-overview","children":[{"id":"ci_4a96b98fc2656d2aefebf43f513aa4c96f5eb4ca253ca35a3f4a664ba73daf81","title":"Alarm Cards","path":"/lrsiem/docs/alarm-cards","children":[{"id":"ci_e6099a65145938132967807c23eca9f6fd4a803f579a93e31a8a11ca43b9ba0c","title":"Sort Alarm Cards","path":"/lrsiem/docs/sort-alarm-cards","children":[]}]},{"id":"ci_7e7595490d370781d7528532c6a0d4d7a5ae320b0a65d88709cbe482407ad05a","title":"Alarm Grid","path":"/lrsiem/docs/alarm-grid","children":[{"id":"ci_a49bce066692bf69a6eceafeaeb9352a168189177fdf6027c203f9095c44eed1","title":"Pin and Resize Alarm Grid Columns","path":"/lrsiem/docs/pin-and-resize-alarm-grid-columns","children":[]}]},{"id":"ci_ee9852441587c33d3afe6647a2591bba504977057800fa1f5c6c5e047f7672cf","title":"Alarm Status Trends","path":"/lrsiem/docs/alarm-status-trends","children":[]}]},{"id":"ci_b3fc8e5f02e50eb1e65500cc0a510074a87262b30eeac6c318f44a6fb97c3da7","title":"Alarm Filters","path":"/lrsiem/docs/alarm-filters","children":[{"id":"ci_7223cd57f1a05426287157ce51e8021b5c6df72d8cf90760b7a9423df7b887cb","title":"Remove Alarm Filters","path":"/lrsiem/docs/remove-alarm-filters","children":[]},{"id":"ci_57fd079616e383a2c6e8f04c06d2b837f1128ce131224484e6ba0a7aaeebd330","title":"Use Dynamic Alarm Filters","path":"/lrsiem/docs/use-dynamic-alarm-filters","children":[]},{"id":"ci_5a0a918df6fe617f8bc1ef68446f1db7cbbb17b46db126947f672e65e599c381","title":"Use the Time Frame Filter","path":"/lrsiem/docs/use-the-time-frame-filter","children":[]}]},{"id":"ci_733d5758a9c55494e40e27a9ff5b84629c5fa25ad38c7020be3bc0b97ce87546","title":"Add Comments to Alarms","path":"/lrsiem/docs/add-comments-to-alarms","children":[]},{"id":"ci_dbe3f5ee78e9fcc88e1ef446f22a44a6dc2ba7e7d897615b648ca4fb808036f9","title":"Approve or Deny SmartResponse Actions in the Web Console","path":"/lrsiem/docs/approve-or-deny-smartresponse-actions-in-the-web-console","children":[]},{"id":"ci_c9d4b9749555ae7769d8f9f48f4f63755fde6eee22a3785e63095385e9093677","title":"Drill into Log Data Associated with an Alarm","path":"/lrsiem/docs/drill-into-log-data-associated-with-an-alarm","children":[]},{"id":"ci_5ab28bdb7baff6c6d11db7c173923fbcb15bf0f03a3f11bd65e4c337c18980e0","title":"Update the Alarm Status","path":"/lrsiem/docs/update-the-alarm-status","children":[]},{"id":"ci_d694de39d57c82167b67ee125388334b7b065463926d4a8f10df9c15131fef2c","title":"View Alarms in Your Browser","path":"/lrsiem/docs/view-alarms-in-your-browser","children":[]},{"id":"ci_4797b6df813f009c5e16348b62fabe74ab60b6e8845445d679c82f460b5a6e43","title":"Alarm Inspector Panel","path":"/lrsiem/docs/alarm-inspector-panel","children":[]}]},{"id":"ci_e2d3c4324512fe080abd735dd43133b772a4ea0ad15c3060371b2669f81e93a2","title":"Analyzer Grid","path":"/lrsiem/docs/analyzer-grid","children":[{"id":"ci_4815a07a00bbea6fc674bb03ef88d71f9908df50a01984119e0a3e3e768fba1d","title":"Use the Analyzer Grid","path":"/lrsiem/docs/use-the-analyzer-grid","children":[]},{"id":"ci_e679117da014acd3dcc825efaf66b6b221d68389d95b5685bd9944d962d0e4d7","title":"Configure the Analyzer Grid","path":"/lrsiem/docs/configure-the-analyzer-grid","children":[]},{"id":"ci_a85f20d35f6c1e0ac9031b6b51b0b5c2f1e6a293c66e6fb6b86becbd40cbceb5","title":"Details & Actions Panel","path":"/lrsiem/docs/details-actions-panel","children":[]},{"id":"ci_98af360fba389c93dd2ff1c07c4f8e38fc505e070ee56e477c447967a9ec4c13","title":"Export Log Data into a CSV File","path":"/lrsiem/docs/export-log-data-into-a-csv-file","children":[]},{"id":"ci_8f7eddcdd868bb927f6d699038d5c34e4a81842d713150e317dd4cdd09618ec1","title":"Inspector Panel","path":"/lrsiem/docs/inspector-panel","children":[{"id":"ci_b1dcf46b00f7ece0ddbd242b682913c1bb90764ccd0193adbf4c3a5e2741cff6","title":"Integrate with LogRhythm UEBA (formerly CloudAI)","path":"/lrsiem/docs/integrate-with-logrhythm-ueba-formerly-cloudai","children":[]},{"id":"ci_0ece36bc0223076e988a144b59d04673d33ac1fb9a527cb8a61cdf9ebcfedaf8","title":"Use Contextualize","path":"/lrsiem/docs/use-contextualize","children":[]},{"id":"ci_1b8614364e4185fa95e81a0cbca5f73924f882106673ee371e95a6657fc9c4cb","title":"Configure Third-Party Contextualize Actions","path":"/lrsiem/docs/configure-third-party-contextualize-actions","children":[]},{"id":"ci_ddeee5139e70abd533c6fabbcbabe8a9959bebf670643e109a749d993b94b61f","title":"Use SmartResponse","path":"/lrsiem/docs/use-smartresponse","children":[]},{"id":"ci_ccd6f7f9dcc8ae5ecc8bfec29b5cd60ee900d027d63631231df6c3e5dbef0d1a","title":"Use the AI Engine Rule Viewer","path":"/lrsiem/docs/use-the-ai-engine-rule-viewer","children":[]},{"id":"ci_a369effe85d2dbfa695a095b9b0b9470fd098a4f1c83ce37b2f0b686417be71e","title":"Use Threat Intelligence Service Integration","path":"/lrsiem/docs/use-threat-intelligence-service-integration","children":[]}]}]},{"id":"ci_7079c66154dd8e00ad693f0584a1fe1380ba3af31ab7cf8c54f82b34d26e4a07","title":"Case Management","path":"/lrsiem/docs/case-management","children":[{"id":"ci_f2ee53d78a07df6b0a392d69c20f12fb42bcd38e36cd92b7f7602a2af6e498b9","title":"Case Cards","path":"/lrsiem/docs/case-cards","children":[]},{"id":"ci_7951a21712911f05023e3404553da9bc090e659330bda2c1d52418478e423705","title":"Case History Widgets","path":"/lrsiem/docs/case-history-widgets","children":[]},{"id":"ci_cd2ae716ceefd0b39a263b056f3e313534fb69d71153c7037fdb6903d2721656","title":"Case List Widgets","path":"/lrsiem/docs/case-list-widgets","children":[{"id":"ci_9f4927b61154b21c0d80c680a670c2c4c62c4c414e412d7851b9395ec47b17f0","title":"Configure Case List Widget Settings","path":"/lrsiem/docs/configure-case-list-widget-settings","children":[]}]},{"id":"ci_fe3cc4907c09185d4ce1c73d0a2552425ef3fc4fa51a06b1925f9751d6ff962d","title":"Case Owners vs. Collaborators","path":"/lrsiem/docs/case-owners-vs-collaborators","children":[]},{"id":"ci_0b3af598c1a93126998f4a3ee8c67b1af3b84dcb40608da07cfa21fa3accf1bf","title":"Case Status and Workflow","path":"/lrsiem/docs/case-status-and-workflow","children":[]},{"id":"ci_0bca44386917538354f03a12ffaa0513f8861e97ce43b4c592807a4f7f5d03e2","title":"Case Trend Widgets","path":"/lrsiem/docs/case-trend-widgets","children":[{"id":"ci_57e084117f6d3a4883de334b65b20f136b7da89a8d4815a5792f8b90fc11fcea","title":"Configure Case Trend Widget Settings","path":"/lrsiem/docs/configure-case-trend-widget-settings","children":[]},{"id":"ci_e63c2114ed57b40f0904186890a330344f1d472774bd4a5a008d16628d8d8c13","title":"Read Case Trend by Priority Charts","path":"/lrsiem/docs/read-case-trend-by-priority-charts","children":[]},{"id":"ci_5e71ae1c3c8aa03b1cdc12557d49e61d007dcc1fd3d7b3b76b073613ffcb69f5","title":"Read Case Trend by Status Charts","path":"/lrsiem/docs/read-case-trend-by-status-charts","children":[]}]},{"id":"ci_81ffb06f59b58c94d4eb8609420a5ae613cfad0761d57ac68528c62056bf7f3c","title":"Open the Case Details View","path":"/lrsiem/docs/open-the-case-details-view","children":[]},{"id":"ci_e68f24725f54cbeab4239d9c179eee49340b6cbb01a5f354d5b82226b3a19f32","title":"Separate Entities in Cases","path":"/lrsiem/docs/separate-entities-in-cases","children":[]},{"id":"ci_10304e528e726efb89c2f9bf7e79288edbdef8a1beffcf6db9557250ef3971eb","title":"Work with Cases","path":"/lrsiem/docs/work-with-cases","children":[{"id":"ci_7727d04728ad329ee4c5b67584da607021c76165c81b29c257b7016dce265c9e","title":"Add Alarms to a Case","path":"/lrsiem/docs/add-alarms-to-a-case","children":[{"id":"ci_a76173f621fd285e8dcb23198aa09c36c6b0857783c3ed1667f34571473897ed","title":"Update the Status of Alarms Associated with a Case","path":"/lrsiem/docs/update-the-status-of-alarms-associated-with-a-case","children":[]}]},{"id":"ci_2e9d855a6091bdb23f0b32da21875e22e70e614335f66b407c2c052098504050","title":"Add Files to a Case","path":"/lrsiem/docs/add-files-to-a-case","children":[]},{"id":"ci_eec94d9cdaa70f9c877d4ad1f08449109ce14c5b6aa2dc8e0be56915a139bd65","title":"Add Logs to a Case","path":"/lrsiem/docs/add-logs-to-a-case","children":[]},{"id":"ci_b496e7fe5fe79e417b1941d85a31e038162c448e1df3dd84cce0b8bec920118a","title":"Add Notes to a Case","path":"/lrsiem/docs/add-notes-to-a-case","children":[]},{"id":"ci_dd2c1de9c60acbbefc3432c2c6988db9c04dacffd5a998a545eb10d893b5455a","title":"Case Associations","path":"/lrsiem/docs/case-associations","children":[{"id":"ci_b756f64ff1be69b9603e3bdd03540b37e09d2f7aacb7711f301e8d60290a3811","title":"Add Case Associations","path":"/lrsiem/docs/add-case-associations","children":[]},{"id":"ci_6121c9a4a45d685d60fab26e1abd7f8c305a823bf1be86058da8e84233ec24b7","title":"Remove Case Associations","path":"/lrsiem/docs/remove-case-associations","children":[]}]},{"id":"ci_ca31eec4005d9b43f60622df129c2f3c94d0b3ea7775c94628e8cf6f5cae6ee9","title":"Case Collaborators","path":"/lrsiem/docs/case-collaborators","children":[{"id":"ci_6bacd84a6cf35a1c69ba79ad7de5f90998a668201624d5643670c7d5e4295e55","title":"Assign Collaborators to a Case","path":"/lrsiem/docs/assign-collaborators-to-a-case","children":[]},{"id":"ci_3c7193bf152742d88099e4da9a0e1cd5671da49bc2ea96ab03bb40abb3ebed3c","title":"Remove Collaborators from a Case","path":"/lrsiem/docs/remove-collaborators-from-a-case","children":[]},{"id":"ci_cdc64e1c919009603812f7d0b446551fe110560b346925aec53adf9e8a5514d3","title":"Transfer Case Ownership","path":"/lrsiem/docs/transfer-case-ownership","children":[]}]},{"id":"ci_e1ab8914b5c2afdb379ce756b2098d437a49527e1f28a04911f453e1d6d5e74b","title":"Case Tags","path":"/lrsiem/docs/case-tags","children":[{"id":"ci_4cbc6067d0030ea568b75987b03ed09297c7e3fd11e8f0214773abe589bb5ae6","title":"Add Case Tags to a Case","path":"/lrsiem/docs/add-case-tags-to-a-case","children":[]},{"id":"ci_53b4a4f315bfbef3fd52af9646d1397f5e455fb1c2bdfadb6e6de5a6c87fa421","title":"Remove Case Tags from a Case","path":"/lrsiem/docs/remove-case-tags-from-a-case","children":[]},{"id":"ci_026007ef3b75ba3f911fd5eaa82824f6d58799b4b9d591ce7b15f5c70ab5050d","title":"Use Case Tags to Filter Cases in Case Widgets","path":"/lrsiem/docs/use-case-tags-to-filter-cases-in-case-widgets","children":[]},{"id":"ci_8e872dcb9920e6b6fba76979a81aecec1bd9fecb85d9017002fc1cfcf518193e","title":"Use the Case Tag Library","path":"/lrsiem/docs/use-the-case-tag-library","children":[]}]},{"id":"ci_5cd9d06db7dc60d7aeb589d59383da1570c247bbc9d839de12fe00cd8693e6c5","title":"Close Cases","path":"/lrsiem/docs/close-cases","children":[]},{"id":"ci_fee720ec8af42758f1595a52080dd17929676d1b6357070ab31c2dc1ba6cbd08","title":"Create New Cases","path":"/lrsiem/docs/create-new-cases","children":[]},{"id":"ci_978d42beb8dc769210a0e9d6a8e8aae61b4e3bd68b78e6eca3133746cb456e30","title":"Delete Logs, Alarms, and Files from Case Evidence","path":"/lrsiem/docs/delete-logs-alarms-and-files-from-case-evidence","children":[]},{"id":"ci_73d554dd27e289a1f4d6677ec790b917d846e7aad1dd9e82d92720bdde39a923","title":"Edit and Delete Notes in Case Evidence","path":"/lrsiem/docs/edit-and-delete-notes-in-case-evidence","children":[]},{"id":"ci_eadfc797d7936b176256d395f57a29920a0299c462fe1faae6d0cf01327235b1","title":"Edit Case Names, Priorities, Due Dates, and Summaries","path":"/lrsiem/docs/edit-case-names-priorities-due-dates-and-summaries","children":[]},{"id":"ci_57712925a147e40b2a50d54474e2f23a6dc8c8e7ccfb774625ba5c4646608597","title":"Filter Cases","path":"/lrsiem/docs/filter-cases","children":[]},{"id":"ci_07f178e0eb46c0f7cf9ca1770888078f08f1811b6b89316ff2c2206a3857f65d","title":"Pin Important Evidence","path":"/lrsiem/docs/pin-important-evidence","children":[]},{"id":"ci_8570b5e11436ad5be1f882f5f870fe290e00d8ab3e891dc30f209ee850fb291c","title":"Reopen Cases","path":"/lrsiem/docs/reopen-cases","children":[]},{"id":"ci_7e37d3ef6ce77c7548150a15e603412d6ca57c764fa58328c3378c55969b44fc","title":"Unpin Evidence","path":"/lrsiem/docs/unpin-evidence","children":[]}]},{"id":"ci_bb1bbbbbf28baece4a7ebc34289bfd4d47e8ad1d52923b352770b0aa6cd6ccce","title":"Work with the Current Case Panel","path":"/lrsiem/docs/work-with-the-current-case-panel","children":[]}]},{"id":"ci_a3b5452acc15419bbd8ab1509d1bb0ebc5516aefc2e816e5341f5c25ccf14c49","title":"Cloud to Cloud Log Collection","path":"/lrsiem/docs/cloud-to-cloud-log-collection","children":[{"id":"ci_8aa0f859128d333ca2d2f232f346e8790aba8ba3fcdedeea647c12570ee75e87","title":"Configure an Open Collector Log Source","path":"/lrsiem/docs/configure-an-open-collector-log-source","children":[]},{"id":"ci_35faed4fd1c67ec03e23e9a5b6a363c8db373e3271d17933f806f8eb79906bb3","title":"Add a Log Source Configuration","path":"/lrsiem/docs/add-a-log-source-configuration","children":[]},{"id":"ci_cb038037a59edf1bc21142901f2c13f53914368e2d28befd7e679e4abc47fa0f","title":"Use the Log Source Configuration Grid","path":"/lrsiem/docs/use-the-log-source-configuration-grid","children":[]},{"id":"ci_8c5820997de0129ce06084e8523f20059280f0d48dd4c734848044d0a01ba44e","title":"Edit a Log Source Configuration","path":"/lrsiem/docs/edit-a-log-source-configuration","children":[]},{"id":"ci_1024c265f9aa9425a7706376e485cb7348160a7066878b647b543578c59971f4","title":"Delete a Log Source Configuration","path":"/lrsiem/docs/delete-a-log-source-configuration","children":[]}]},{"id":"ci_e07d1ee5cf0e8b9083a22807ad2fbe7c26c834e8964f1d6120564394b51d2dc4","title":"Dashboards","path":"/lrsiem/docs/dashboards","children":[{"id":"ci_c3481a4f7769163f0ac8aacc72a974a09c71d47608e00a2b453bc44bffaa851f","title":"Create New Dashboards","path":"/lrsiem/docs/create-new-dashboards","children":[]},{"id":"ci_c43fdda86acdcdef0a17f77f6e4f564e771307a533468a440773a9024662741d","title":"Clone Dashboards","path":"/lrsiem/docs/clone-dashboards","children":[]},{"id":"ci_e874a6e02f648be7b4086c3b430e06feb962264987b2b1acb7fa230ba8cadb83","title":"Import and Export Dashboards","path":"/lrsiem/docs/import-and-export-dashboards","children":[]},{"id":"ci_36558cc5edacffa80cfd74bb8a4394cd762d14f67914fd32166a2fa3c23506bd","title":"Change Dashboards","path":"/lrsiem/docs/change-dashboards","children":[]},{"id":"ci_dc55753e0e7f86ef0906174c6367d5b57cbc3ad705d11076164da8fe6e12deb2","title":"Revert Changes","path":"/lrsiem/docs/revert-changes","children":[]},{"id":"ci_01dc1f48d6d39387779cccf99b603461598fc26024f2c3c8e5de892a102c87ec","title":"Print Dashboards","path":"/lrsiem/docs/print-dashboards","children":[]},{"id":"ci_137a3a86925c1553e2802e8fa1db67f7dc003dcb9ca6235ab111f81e7a511672","title":"Save Dashboard Changes","path":"/lrsiem/docs/save-dashboard-changes","children":[]},{"id":"ci_4994f1f766bdab5ab3fb9350b6e1023d43a094113fd0b6bcbd8bcec384a8abf5","title":"Filter Data with Lucene Searches","path":"/lrsiem/docs/filter-data-with-lucene-searches","children":[{"id":"ci_046996cfa98a2518bea27c00b4f6456bfb12d79f834e33c00b5c40ef5c7664ec","title":"Lucene Search Syntax","path":"/lrsiem/docs/lucene-search-syntax","children":[{"id":"ci_397575c7d4943404aa1ad806ddcd7436ecef6dbf1dd1b2dcd6f0dd88098935a3","title":"Basic Queries","path":"/lrsiem/docs/basic-queries","children":[]},{"id":"ci_0246da36da1911cb62c80d1d68a82d5eb69370abc2ac67fad89b3a5ebe6edd1e","title":"Complex Queries","path":"/lrsiem/docs/complex-queries","children":[]},{"id":"ci_e25cbcdfda58f6790c6c880c6c550444943ded3b52d49e57680443514f81a3a6","title":"Troubleshoot the Lucene Search","path":"/lrsiem/docs/troubleshoot-the-lucene-search","children":[]},{"id":"ci_ae84142c4410e3d43e558933870a7837164a2b18c9f8ca7637cfcaec36c27580","title":"Wildcard Queries and Fuzzy Matches","path":"/lrsiem/docs/wildcard-queries-and-fuzzy-matches","children":[]},{"id":"ci_e1aba277671e85437b28ffa4deed98cbc6ccc826a53212e897901ae2dd862f2b","title":"Metadata Fields","path":"/lrsiem/docs/metadata-fields","children":[{"id":"ci_5942823ab63e44c0c69d580e4556f3760b6de9bc5c56695e25bf5b190d72d120","title":"Applications","path":"/lrsiem/docs/applications","children":[]},{"id":"ci_bfcf514e82f7183323c263c713a97559ece2122df85ec099b5e9b93a4efe667e","title":"Classification","path":"/lrsiem/docs/classification","children":[]},{"id":"ci_f151d159476e4b821cb8bf59249ee682954908dc053983f750972eef6c0fca51","title":"Identity","path":"/lrsiem/docs/identity","children":[]},{"id":"ci_a6875bc3727ea513429452fef247afd9655ed4856f332c1da3de2fe6b3729087","title":"KBytes and Packets","path":"/lrsiem/docs/kbytes-and-packets","children":[]},{"id":"ci_f19816b257525c7ec91623e8f8a950df43237e4f9eaf8ba13bb40298ac1f8a9d","title":"Location","path":"/lrsiem/docs/location","children":[]},{"id":"ci_65c71526d66b88c74db89240637d0f28283d41f235cc4824dac71e327f0e1fb1","title":"Log","path":"/lrsiem/docs/log","children":[]},{"id":"ci_20552660c219b388e49bf5b7c1f20585373f3364009f1d07d145b875d6ac8d02","title":"Network","path":"/lrsiem/docs/network","children":[]},{"id":"ci_3ed8bba0884063829e61a7732dc7f5e365f6c5c0c9281a7a01809fc0f5d8f9e2","title":"Host","path":"/lrsiem/docs/host","children":[]}]}]},{"id":"ci_b6d69d335791962ecf7e363d4a7d07122c6eff0678a2ca5b5883bf994af30f23","title":"Supported Lucene Fields by Dashboard Type","path":"/lrsiem/docs/supported-lucene-fields-by-dashboard-type","children":[]}]}]},{"id":"ci_c283a545f5fbd767cae35d7cea4a7025959860f933dd1f4d1682917515aa6311","title":"Data Indexer (DX) Dashboards","path":"/lrsiem/docs/data-indexer-dx-dashboards","children":[]},{"id":"ci_76c1de12c2b01f39b496914f96ed62e7347706ef00c44bc281881cdaa0e4373e","title":"Lists in Web Console","path":"/lrsiem/docs/lists-in-web-console","children":[{"id":"ci_2bb6a82e28701e396f852b8b6446432e4ed34b64efc337a6d40665b793725849","title":"Add List Items in the Web Console","path":"/lrsiem/docs/add-list-items-in-the-web-console","children":[]},{"id":"ci_60cf42fa13f5fedd50a130626cb593bb898b3fd298df61b7f3814c350a19ddea","title":"Add Related Lists","path":"/lrsiem/docs/add-related-lists","children":[]},{"id":"ci_cc63617eeffc6d0b3b02dcdc9b15c9f579f164946ede55bbccf4af78c3a5bf95","title":"Create a List in the Web Console","path":"/lrsiem/docs/create-a-list-in-the-web-console","children":[]},{"id":"ci_a9a457b1b924773c6b4c1567a4f268eb60698ddc3a77c725f6f477d297bb6ac5","title":"Filter and Sort Lists","path":"/lrsiem/docs/filter-and-sort-lists","children":[]},{"id":"ci_6e4cce026a07256e6340d995e1854108ef78a79734eb02d9e9a7d5f4e1041fdc","title":"Remove List Items in the Web Console","path":"/lrsiem/docs/remove-list-items-in-the-web-console","children":[]},{"id":"ci_1b0b5154ca4cd483b74fcac338db7da6d502fb40db8e42b16e3f846676710720","title":"Select and View a List","path":"/lrsiem/docs/select-and-view-a-list","children":[]},{"id":"ci_8bb5d58391b20756b1efa4b79fc342720735a5e74d1e47677616609f7942c909","title":"View Retired Lists","path":"/lrsiem/docs/view-retired-lists","children":[]}]},{"id":"ci_1a37647eb400eeea21c22acdb4e1b1898ccaf72e7039b49b0f96e0cb647ad207","title":"Log Collection in Web Console","path":"/lrsiem/docs/log-collection-in-web-console","children":[{"id":"ci_4b225eb97d1af6f65355df8e1d109a7ed0b9921158dbcc698733f95ecb30e2e2","title":"Agents Grid","path":"/lrsiem/docs/agents-grid","children":[]},{"id":"ci_8491504199aa9e8fa8393ec47e97325960876da032f34c0b2f378bf8ad445082","title":"Beats Grid","path":"/lrsiem/docs/beats-grid","children":[]},{"id":"ci_a4b4a9b9bee7ac697691c89225b3d3c626594f53da3fd28718a8fe781f3d6d50","title":"Log Sources Grid","path":"/lrsiem/docs/log-sources-grid","children":[]},{"id":"ci_131e615b897e18beaa18e3be6feb4659a37cea3b59330ffd3c099636ba66dd0d","title":"Open Collectors Grid","path":"/lrsiem/docs/open-collectors-grid","children":[]},{"id":"ci_9457eafcc17b70857901b97a66888692379a41b926b6da773b781db0109f3b84","title":"Add a New Beat in Web Console","path":"/lrsiem/docs/add-a-new-beat-in-web-console","children":[]},{"id":"ci_920ddae3a9e3a0dbf49dab5ba80007dd76ec6c1a456979f536c62ae61c52c872","title":"Add a New Log Source in Web Console","path":"/lrsiem/docs/add-a-new-log-source-in-web-console","children":[]},{"id":"ci_686e49fdbce3dfd4a032f8946c1e87f3c75be6bf713a10b983e7345b83dfe7c8","title":"Manage Pending Log Sources","path":"/lrsiem/docs/manage-pending-log-sources","children":[]},{"id":"ci_9341115e4b533b057c78229f86cc2779f472109ddb4df8a1e9061d49aeecf122","title":"Retire Beats","path":"/lrsiem/docs/retire-beats","children":[]},{"id":"ci_a2f3ad523c9b0ecbba4c4a4df6eaa6bc8f210c2765603b3c0a8c822f54ac6b98","title":"Retire Open Collectors","path":"/lrsiem/docs/retire-open-collectors","children":[]}]},{"id":"ci_6c987b95ea5e376d90dc582547b8428ccc23e15a56bee6e0f24175daa6ed6df3","title":"Playbooks","path":"/lrsiem/docs/playbooks","children":[{"id":"ci_74b0831f5816f8f5c70cbdf0144492113fbcd42e772c5662dc215c01d70fd6c3","title":"Create Playbooks","path":"/lrsiem/docs/create-playbooks","children":[]},{"id":"ci_3cd703c1a6feccb2e6ef672d6ffeaee45708ba271b43fe9096f37a657063316c","title":"Import Playbooks","path":"/lrsiem/docs/import-playbooks","children":[]},{"id":"ci_b8d6efdbb16b325cce7b97f38f66ce509a9257d24de4d5a56f0d23dc55a121c8","title":"Work with Playbooks","path":"/lrsiem/docs/work-with-playbooks","children":[]},{"id":"ci_6ad8f5e88b2c6ff68b8a4831c7f8982c23c348df1a4eb537edb89d9dd6e4954c","title":"Add Playbooks to a Case","path":"/lrsiem/docs/add-playbooks-to-a-case","children":[]},{"id":"ci_865712f599ddf128a7ad0dcd60ec96595bf61fa29866c617f39a519d162a30c6","title":"Work with Playbooks in a Case","path":"/lrsiem/docs/work-with-playbooks-in-a-case","children":[]},{"id":"ci_d29e1f7ed3fd13186f6720d52a3e1b937bf060da4b0e3ce915a19943a709f9d9","title":"Procedures List Widget","path":"/lrsiem/docs/procedures-list-widget","children":[]}]},{"id":"ci_c0075f5b35c7634b38c9861b8217bb50bb9fd473dc9eaf4fe6e7cffe7e048ec9","title":"Reports","path":"/lrsiem/docs/reports","children":[{"id":"ci_6aa24c2324bd59eaa62d42a0afed9c3e11191ec3870ddb8ea123e73ef8b9d0ed","title":"Completed Reports Widget","path":"/lrsiem/docs/completed-reports-widget","children":[{"id":"ci_6b87abdec24b1231fd4c9b104c14ea152082ad7de8123c23a410f7757e7ce3ac","title":"Configure Completed Reports Widgets","path":"/lrsiem/docs/configure-completed-reports-widgets","children":[]}]},{"id":"ci_19e4683e5076ac8f3b064dc8cb217cb3c28bb707d8916d2f3bef9767bd65f6fa","title":"Download Reports from the Web Console","path":"/lrsiem/docs/download-reports-from-the-web-console","children":[]},{"id":"ci_8d4f0694743f65fe8e6636779b9d085bc3d818f903a1b7d2805efe277f10773d","title":"Filter Report Packages on the Reports Grid","path":"/lrsiem/docs/filter-report-packages-on-the-reports-grid","children":[]},{"id":"ci_cea440706308eb6be5ff4a9f73ff688b9dd04abda80ee36433232b38fc95ee30","title":"Pin and Resize Reports Grid Columns","path":"/lrsiem/docs/pin-and-resize-reports-grid-columns","children":[]},{"id":"ci_c00c35554f579b90423c48e6bf8ff27c3abc95162d00ca782e5b9bbf1b9e8480","title":"Run Searches from Report Filter Criteria","path":"/lrsiem/docs/run-searches-from-report-filter-criteria","children":[]},{"id":"ci_6a9a20795f6231e9b0509300d3db87ff1cdc1019a22f648008e5241d03daa6e9","title":"Sort Content on the Reports Grid","path":"/lrsiem/docs/sort-content-on-the-reports-grid","children":[]},{"id":"ci_70840504437308504fedf2e571e5bbd86cb831bea836cdf6c0b73b7552fa8232","title":"View Package and Reports Details in the Inspector","path":"/lrsiem/docs/view-package-and-reports-details-in-the-inspector","children":[]}]},{"id":"ci_ef1c0593ead5f1c430171722e6c8364105e19adb11c3b87d3e7466c0aef472a3","title":"SecondLook - Web Console","path":"/lrsiem/docs/secondlook-web-console","children":[]},{"id":"ci_729db8092a142e1a6590261e96a2e0fd373a38aa50313127c0d67d9c33913a5c","title":"Single Sign-On","path":"/lrsiem/docs/single-sign-on","children":[{"id":"ci_c98eeed6e7093d6a8d5be9ad21f8fa2847607873677bad252ff07004b6a8566d","title":"SSO Known Issues and Recommendations","path":"/lrsiem/docs/sso-known-issues-and-recommendations","children":[]},{"id":"ci_7fb709dfcff836535d07ddff905d3d779d4060f0ac0c759891226048b97c5d69","title":"SSO User Auto-Provisioning","path":"/lrsiem/docs/sso-user-auto-provisioning","children":[]},{"id":"ci_e2e8b163f76c831dbef0ea055183f8a22f2b7d3c23f00cffa6e4f0fea6670daf","title":"SSO Configuration","path":"/lrsiem/docs/sso-configuration","children":[{"id":"ci_0175b1a53497b4fddebb55d801cdc38b127c6a8afe6a0009a6d341b10ee1a0be","title":"Supported Identity Providers","path":"/lrsiem/docs/supported-identity-providers","children":[{"id":"ci_c90c443373976f71083d172b1160d14cf639fb6b1bee21b547860d63fc1ae030","title":"Configure SSO with Okta","path":"/lrsiem/docs/configure-sso-with-okta","children":[]},{"id":"ci_872f639af40508779c67a759abd721e46b107e1fad22bf589f6500764a4580a1","title":"Configure SSO with Azure AD","path":"/lrsiem/docs/configure-sso-with-azure-ad","children":[]},{"id":"ci_e6b25b17bec7a526f0430a8146068242d974aea1ebfb4dede215419d45036a50","title":"Configure SSO with PingOne for Customers","path":"/lrsiem/docs/configure-sso-with-pingone-for-customers","children":[]},{"id":"ci_99c840f4eac6343234f57512303ca0c7b307d53bc53962220ee97714fb371be4","title":"Configure SSO with PingOne for Enterprise","path":"/lrsiem/docs/configure-sso-with-pingone-for-enterprise","children":[]}]}]}]},{"id":"ci_fcee42cf92aa2bc7d4f9efc2b0a9c875663d25700c1a7f358fd2d12f53e20c79","title":"TrueIdentity","path":"/lrsiem/docs/trueidentity","children":[{"id":"ci_a0f7490529c3c3bca479fff0d6d892d20e143ce95167b19bd10bd4a664acf514","title":"Work with TrueIdentities","path":"/lrsiem/docs/work-with-trueidentities","children":[]}]},{"id":"ci_469a36d69bdef2f0b543067c1e1f5457d00664933b7a23d48d36c3a82e7aa844","title":"User Interface","path":"/lrsiem/docs/user-interface","children":[{"id":"ci_d0495d8611de7d2739d17e081683a78157215638a551c1ef3e2b0ff0c69a0dbd","title":"Resource Center","path":"/lrsiem/docs/resource-center","children":[]},{"id":"ci_e00af6fc7a16a605f722e3c0101f8a93c0d255279da7cc82590974e8f14f3fa0","title":"Pages","path":"/lrsiem/docs/pages","children":[{"id":"ci_f73d6c8abf130de4738ca42e81d3ad803097dd9280a2918ffc982d6574259019","title":"Alarms Page","path":"/lrsiem/docs/alarms-page","children":[]},{"id":"ci_004eb01c0af5986cc0cb5d636fda4004aaf98ad2696019ea0abf17c06f7729d8","title":"Analyze Page","path":"/lrsiem/docs/analyze-page","children":[]},{"id":"ci_09bdaf2d7b80e647fdb42a9fe3d44673535e3f156b09e3372c408bea0f1fd69d","title":"Cases Page","path":"/lrsiem/docs/cases-page","children":[]},{"id":"ci_8ae947a8802b6f038dd65fc26cf7cad6afc0021215fc2633993a36879d8f60d6","title":"Dashboards Page","path":"/lrsiem/docs/dashboards-page","children":[]},{"id":"ci_fc856771c64ad18ed8ac6a7c7be7b8a2d071352fbf146f3a5cd940cacc55990c","title":"Host/User Detail Page","path":"/lrsiem/docs/host-user-detail-page","children":[]},{"id":"ci_82ef5c6fae44c6ed2ab18373a2bac326f8a730f2a6da08b256fae274cbd7a95d","title":"Lists Page","path":"/lrsiem/docs/lists-page","children":[]},{"id":"ci_070b78928f976297f3a8a3969cd9a19679126b31de0cc805f0132e93520f32ef","title":"Reports Page","path":"/lrsiem/docs/reports-page","children":[]},{"id":"ci_f96118d6828ac7482e0d692bfaed66a05431801228dae8bf357fd7c12a5505b0","title":"Searches Page","path":"/lrsiem/docs/searches-page","children":[]},{"id":"ci_8444937c2f3e4d5ecaaf21db342bb2c97a56136f8b5062d979486f46a892e314","title":"TrueIdentity Page","path":"/lrsiem/docs/trueidentity-page","children":[]}]},{"id":"ci_82419ef6fc77fb2ae336b192408115b35fc2badfbc0eb87ad6ad8d7d3c80b117","title":"Panels","path":"/lrsiem/docs/panels","children":[{"id":"ci_6a2e586d9f8a460582274d47cc4306defdc05d2dde3b2954516b192701c1bc59","title":"About the Analyzer Grid","path":"/lrsiem/docs/about-the-analyzer-grid","children":[]},{"id":"ci_8d87cf5989e5a91e15081eca03c67164030fea12bb0939d3169b6ab9bca0d3a8","title":"Current Case Panel","path":"/lrsiem/docs/current-case-panel","children":[]},{"id":"ci_3920b0a5713e1f0e1c2e05017fbe5e530ab6d61a97722fc7de2fe45d50f16e14","title":"Inspector","path":"/lrsiem/docs/inspector","children":[]}]},{"id":"ci_59fa7e8baf71f77599812cb5432edbfc1ab8a19a4e8a72fb39f4cbdefdd28595","title":"Tools","path":"/lrsiem/docs/tools","children":[{"id":"ci_1d83f3954a821c4f2e4a40ffebc5f3e4532a48ca9058d424a33aa66d5a6ac2a7","title":"About Widgets","path":"/lrsiem/docs/about-widgets","children":[]},{"id":"ci_80456e94c5e03a938e1a681efd79ae93de30078f2e8df69d12b6b223a8af299a","title":"Breadcrumbs","path":"/lrsiem/docs/breadcrumbs","children":[]},{"id":"ci_04b0b932d97dc0dc31d118d26db815858b1a0ad32bd3dab84d356b2f8b8a20f7","title":"Hotkeys","path":"/lrsiem/docs/hotkeys","children":[]},{"id":"ci_052a8e54d7e09142084b140cf5ccc6921e6e02fc0ec83ae16928c34502e3f17b","title":"Icons","path":"/lrsiem/docs/icons","children":[]},{"id":"ci_40c8c6c48e99b7b08b7d0fab835093ebda5ceb3f076a4d3d523bb935f2445273","title":"Search Tools","path":"/lrsiem/docs/search-tools","children":[]},{"id":"ci_b065487741bb02e7e9d8f56eec17525357949e6822f115c4f18119c6e3b0d9d1","title":"Taskbar","path":"/lrsiem/docs/taskbar","children":[]},{"id":"ci_77074262b773a7bb5dd3d4b44039a106be31a70806017d41aab7034078b89d04","title":"Typeahead Filters","path":"/lrsiem/docs/typeahead-filters","children":[]}]}]},{"id":"ci_2e0fe253b5dc728d054f3e30bb37e9732fc911be0a0c3c753cddab66c077f3b6","title":"User Settings","path":"/lrsiem/docs/user-settings","children":[{"id":"ci_b3cdca82ad5e61e4746974b2fcdb49ff7f04e35fcd602f427ec865c4bedb412d","title":"Access Web Console Help","path":"/lrsiem/docs/access-web-console-help","children":[]},{"id":"ci_2354129d7717fcf96f8f35e485f9d16c17c6cf914eaa266f84d12d2316410b9a","title":"Change the Default Web Console Search Timeout Period","path":"/lrsiem/docs/change-the-default-web-console-search-timeout-period","children":[]},{"id":"ci_0a17dcf417e1b3c921a7f36a1de197ca8641664026cb39b3552caf990ff5fb7d","title":"Change the Web Console NGINX Configuration to Modify Available Ciphers","path":"/lrsiem/docs/change-the-web-console-nginx-configuration-to-modify-available-ciphers","children":[]},{"id":"ci_ba3c77166982ca6ea52e1648a124844cb3bfa51d05f073eb3700324d795882d3","title":"Change Web Console Password","path":"/lrsiem/docs/change-web-console-password","children":[]},{"id":"ci_4d6c504f330993894450d12528a3fd942b0e1b09b3a256a37c7d5a2f8458aaea","title":"Configure Navigation Warning","path":"/lrsiem/docs/configure-navigation-warning","children":[]},{"id":"ci_b5c9dc24b282ac024866f12f25cfa989d7ae0969abb6d5739b1a0cbb52c8c9d8","title":"Configure Search Results","path":"/lrsiem/docs/configure-search-results","children":[]},{"id":"ci_0edcbe885d1a37cacaa23fd5863f96ad8ea54d86f3781414db37c497704d3327","title":"Select Query Location","path":"/lrsiem/docs/select-query-location","children":[]},{"id":"ci_36ed976a59b1d2bbb1a97e613c374b68408d3cf8b76b8fdb206607ffe8072c84","title":"Set the Date Time Format","path":"/lrsiem/docs/set-the-date-time-format","children":[]},{"id":"ci_8315168b9074e22bc05d53a89d836a3863ef90be0ce5062b593b2b4fa2ae80a8","title":"Set Your Drilldown Preference","path":"/lrsiem/docs/set-your-drilldown-preference","children":[]},{"id":"ci_0011e9388195c5bfef3412167e3241389b695f2bd094aebeed060a01bd7473a4","title":"Switch Between Day and Night Modes","path":"/lrsiem/docs/switch-between-day-and-night-modes","children":[]}]},{"id":"ci_fabde71cefe02c6576e0adc12843a273467abff950b5053dcff6b08fe6be4d7a","title":"Search","path":"/lrsiem/docs/search","children":[{"id":"ci_95d5ce7b8160f5d009dc234ea9d97de8f54435960f6b98b5fb31c4038f4b996b","title":"Manage the Searches Page","path":"/lrsiem/docs/manage-the-searches-page","children":[]},{"id":"ci_3dcdb36d3e54f97b86b997e1c208efa66c63294ff1dc1d00d05b84c2a7c5d303","title":"Run Searches from the Searches Page","path":"/lrsiem/docs/run-searches-from-the-searches-page","children":[]},{"id":"ci_c93c0ce7c47e39efa9b288cbebd7b4b779e215c0470912d235bebcf7112337fb","title":"Use Search","path":"/lrsiem/docs/use-search","children":[]},{"id":"ci_2f90d54f7245e50a6069f9604ecd60bda467d614216d965983d49c2a02c0515b","title":"Save Searches","path":"/lrsiem/docs/save-searches","children":[]},{"id":"ci_698749464dd4c35a0ca839e78f9dff171dae6931757a12d9dd8129fe91512b1f","title":"Perform Details Searches (User/Host)","path":"/lrsiem/docs/perform-details-searches-user-host","children":[]},{"id":"ci_61774866148e0570b48bd56e65bfcae3152950392ba7c2ea002feb0883009aeb","title":"Perform Pivot Searches","path":"/lrsiem/docs/perform-pivot-searches","children":[]},{"id":"ci_1f99a96340f45b1c05f7d66e37ce433133d929cf2092d1da256d0344a7fcdc7d","title":"Search Tiers (Hot/Ultra-Warm/Warm/Cold)","path":"/lrsiem/docs/search-tiers-hot-ultra-warm-warm-cold","children":[]}]},{"id":"ci_7d138a038b3902d9ef6592ed4afbed388add81b3c5a7ea095e2c61b25f1306fc","title":"Widgets","path":"/lrsiem/docs/widgets","children":[{"id":"ci_1b748188a07d8aeade074b76db953f3a9228922e28bf24642479f7ef0c1d765f","title":"Threat Activity Map","path":"/lrsiem/docs/threat-activity-map","children":[{"id":"ci_ebc8487832f45d264b9c7d784a81c4189f88e045f438b9cbc8bae81be5a61877","title":"Configure Threat Activity Map Widget Settings","path":"/lrsiem/docs/configure-threat-activity-map-widget-settings","children":[]},{"id":"ci_7fe29f6f38ef68bc090f73117beac6d54df6bc16ee36dc05afa3fef06b2f637c","title":"Drill into Threat Activity Map Node Data","path":"/lrsiem/docs/drill-into-threat-activity-map-node-data","children":[]},{"id":"ci_4aa0d9ad2a3dccbf8de070571e354685ac25f9686e05ef60cf5548b0a3ac2080","title":"Troubleshoot Threat Activity Map","path":"/lrsiem/docs/troubleshoot-threat-activity-map","children":[]},{"id":"ci_6071ab17f17f2d3f89c4063c737a93018a99ae2554aa5c5051c991ac958bff0f","title":"Zoom In and Out on the Map","path":"/lrsiem/docs/zoom-in-and-out-on-the-map","children":[]}]},{"id":"ci_a65d990d15b07fd7fc434bd4a3abfdb5de133f0f5bc470138216d43ab3aaef3f","title":"Customize Dashboard Widgets","path":"/lrsiem/docs/customize-dashboard-widgets","children":[{"id":"ci_ad5b5afe6222e25a26637ddef49ed917ae0a9e5983796fb65227d6172a12d4f2","title":"Add Widgets","path":"/lrsiem/docs/add-widgets","children":[]},{"id":"ci_0570c5c00459d2f22d740d89213678ae59bc3cd00120d2cc66d04ff59997fb95","title":"Configure Widget Settings","path":"/lrsiem/docs/configure-widget-settings","children":[]},{"id":"ci_c2d9c61965abe7b71dd4abf80a185ca4cf2d7d348fdbff2a7e994ce7a4868a06","title":"Copy Widgets","path":"/lrsiem/docs/copy-widgets","children":[]},{"id":"ci_61b5e20de7fe8003a876c0dc9f01c50751c2db0161003ef8186e1aea0561ffc1","title":"Delete Widgets from a Dashboard Layout","path":"/lrsiem/docs/delete-widgets-from-a-dashboard-layout","children":[]},{"id":"ci_f96b6ebbeee1f440796239bcfeb9a0c4c1aa27459c7b23927c1081ee3a70977f","title":"Move Widgets","path":"/lrsiem/docs/move-widgets","children":[]},{"id":"ci_85c1e79c96492e41fb27251e8907bf12e5b244cc4a3d38db18a59357718df563","title":"Rename Widgets","path":"/lrsiem/docs/rename-widgets","children":[]},{"id":"ci_2e46c461be87938ccbe9d3209b44e1e3b4edcf6416fed3b0443c667c0579ec27","title":"Resize Widgets","path":"/lrsiem/docs/resize-widgets","children":[]}]},{"id":"ci_a18b05721f00479ef03f63f05429b3756277908f77d33546d8d3758c0b92f272","title":"Component Status Widget","path":"/lrsiem/docs/component-status-widget","children":[]},{"id":"ci_c07bf8aadfe14dd1a71b142a92325bc8a17c0b000ef2fe22938d060c68e0da0b","title":"Current Processing Rate Widgets","path":"/lrsiem/docs/current-processing-rate-widgets","children":[]},{"id":"ci_fd12e4923286ad85715657bc4dc1a4c334b07c1da9abec3eb6282808657c8fb1","title":"Data Processing Trend Widgets","path":"/lrsiem/docs/data-processing-trend-widgets","children":[]},{"id":"ci_26c3e3d95b669e09f434d78f4f1a1b0b9de763af0b7505157e01d5a6cc5ca515","title":"Metric Widget","path":"/lrsiem/docs/metric-widget","children":[{"id":"ci_c35e95212d0307c3cdf3197e1b34aed20dac633b1f92ae98875f186cab9c7ed4","title":"Configure Metric Widget Settings","path":"/lrsiem/docs/configure-metric-widget-settings","children":[]}]},{"id":"ci_5b12c3c8935ca539e787dcdeea82194a9c84c224397382754a0b6aead18e2b58","title":"Node-Link Graph Widgets","path":"/lrsiem/docs/node-link-graph-widgets","children":[]},{"id":"ci_9934af26fc6f1c099c4a8a289352c7e4cf406a1f1f415c3af3d81050f5a88898","title":"System Database Usage Widget","path":"/lrsiem/docs/system-database-usage-widget","children":[]},{"id":"ci_4159de1abeaf15e0d667fbc3e6b2359ad9b89a339cb9b477479284f9ed97c14a","title":"Timeline Widget","path":"/lrsiem/docs/timeline-widget","children":[]},{"id":"ci_0f883fa9bf96aca808cc9c6f442fea03d376fc2d35bdc3394933b85707eda5ce","title":"TopX Widgets","path":"/lrsiem/docs/topx-widgets","children":[{"id":"ci_32ebf4b3dca18d485d593025bca1de092f9c21c444baf8a5e731b7cb45462493","title":"Configure TopX Widget Data Settings","path":"/lrsiem/docs/configure-topx-widget-data-settings","children":[]},{"id":"ci_3eae41444ec5cb7811918e213169880abef6863734d5409740b0f187e4702ba1","title":"Configure TopX Widget Graph & Options Settings","path":"/lrsiem/docs/configure-topx-widget-graph-options-settings","children":[]},{"id":"ci_89a77bfdba5ee50d3bda11406aea7aac0ffe4029da9c5c98fc36da508d2c196b","title":"Drill into Chart Metadata from the Dashboards","path":"/lrsiem/docs/drill-into-chart-metadata-from-the-dashboards","children":[]},{"id":"ci_39269d6b8c8ff2e959f262c398f67d2dd3c7adea9bd22701c895b8bfa55b17fc","title":"Filter Data by Time Range on the Dashboards and Analyze Pages","path":"/lrsiem/docs/filter-data-by-time-range-on-the-dashboards-and-analyze-pages","children":[]},{"id":"ci_46282b83aaa36a67f98489e205ff5c47c033f438da318865836e8bfc91446e5c","title":"Resize TopX Data Labels on Bar Charts","path":"/lrsiem/docs/resize-topx-data-labels-on-bar-charts","children":[]}]}]}]},{"id":"ci_dbc8181d3da9b52c96264dd446236770eeecede8348a49267acf8ecfff1df6ce","title":"LogRhythm Schema Dictionary and Guide","path":"/lrsiem/docs/logrhythm-schema-dictionary-and-guide","children":[{"id":"ci_ad085474e4d295404f0b8fe9a5c21007fb30df631217420b00a831b994a75e5a","title":"Application Tab","path":"/lrsiem/docs/application-tab","children":[{"id":"ci_0b74d9d173d29572c09dbfcf61486bc4f78744eab16cee843ec5a9322076a280","title":"Action [7.2]","path":"/lrsiem/docs/action-7-2","children":[]},{"id":"ci_8c516bc193683e527ea43fa2d9aba69f0d51edc70dd4b3f1b869da819d39467f","title":"Amount","path":"/lrsiem/docs/amount","children":[]},{"id":"ci_ac98479cd4b1330b24286bacda5ffaf8f15671d4363bfda6274383e979cb4c66","title":"Command","path":"/lrsiem/docs/command","children":[]},{"id":"ci_7ff1c87e4b4f4ad48366478bd83bac889825ae47a87996114631e6bbf5f084e3","title":"Hash [7.2]","path":"/lrsiem/docs/hash-7-2","children":[]},{"id":"ci_e902ba353aeb4a61053dc17a5dcb2154a21f061fc81958fac74f922a91290816","title":"IANA Protocol Name","path":"/lrsiem/docs/iana-protocol-name","children":[]},{"id":"ci_8a08cc056ee3600c21cf79ee845a03fc70071be0743bcd377d6b8a6765911726","title":"IANA Protocol Number","path":"/lrsiem/docs/iana-protocol-number","children":[]},{"id":"ci_f560912912435d93b3206628772d1758b3c54831db0ffd3178d1e257a3ec84dc","title":"Object","path":"/lrsiem/docs/object","children":[]},{"id":"ci_5ef4a3d3d45313067227271b634ece93270fa33e223e3df6994487101e201231","title":"Object Name","path":"/lrsiem/docs/object-name","children":[]},{"id":"ci_313d7d6bcfba62d8ba18bfe0958ff9900a671964c56efd7f60a82db8afa9c9d6","title":"Object Type [7.2]","path":"/lrsiem/docs/object-type-7-2","children":[]},{"id":"ci_0f82ff5b957ea742c0e95e92cfca38d29478320fe6943ea346e830120bc4da51","title":"Parent Process ID [7.2]","path":"/lrsiem/docs/parent-process-id-7-2","children":[]},{"id":"ci_acccea63388daf6dbbcebc6cab74ea7422a267ecb4e6373b4d5fab356b2b6c30","title":"Parent Process Name [7.2]","path":"/lrsiem/docs/parent-process-name-7-2","children":[]},{"id":"ci_848e0f4e322385a71318bc1bc7356119a62c2b26eaa35b13909fb1151c51db8b","title":"Parent Process Path [7.2]","path":"/lrsiem/docs/parent-process-path-7-2","children":[]},{"id":"ci_b5214093d56df8c72894cdde66b26e66477e6a48eb706b368460b6f68317c85d","title":"Policy [7.2]","path":"/lrsiem/docs/policy-7-2","children":[]},{"id":"ci_3b747f581a479faca269ad434eb6fc9a55ee303133c1713ba3b4339fa6207570","title":"Process ID","path":"/lrsiem/docs/process-id","children":[]},{"id":"ci_611376b4e4600e51fddbfdfa9244fdc91a5ff368773f2e214c393d54ac62b5c5","title":"Process Name","path":"/lrsiem/docs/process-name","children":[]},{"id":"ci_f8b08ab6cfe21a114d6cc17f6ae4ad76cc87ed57239805dd36ab5c220f2ee82e","title":"Quantity","path":"/lrsiem/docs/quantity","children":[]},{"id":"ci_9807b462a17e29b1469313291b5ef2b715f63ec33d0891800f4913eecb2fc5db","title":"Rate","path":"/lrsiem/docs/rate","children":[]},{"id":"ci_6d42e24f246998eff6740e7d21136ef271d05ad6c2d04d5da1904eb9310caeba","title":"Reason [7.2]","path":"/lrsiem/docs/reason-7-2","children":[]},{"id":"ci_a7e6de4194b8e4047548e8723d9db16052c20325ba5768564418847577816460","title":"Response Code [7.2]","path":"/lrsiem/docs/response-code-7-2","children":[]},{"id":"ci_28e7537dafde2d2562a080df2391bc62ae623e06bfc1890eee7cc854a6a2a5f2","title":"Result [7.2]","path":"/lrsiem/docs/result-7-2","children":[]},{"id":"ci_ba8bf2a2a3e424cde0e78101ada507f882a42334538a5bec9b12b852361582b7","title":"Session","path":"/lrsiem/docs/session","children":[]},{"id":"ci_32e0d4a42bc33d7605d32a9cbbda8cee0339aa6206d43f265e6dd7fad7a99783","title":"Session Type [7.2]","path":"/lrsiem/docs/session-type-7-2","children":[]},{"id":"ci_627346e07260b98d6ab255ffd672b5bf2d161a15cb6455e706ce0b4b8a2b85c6","title":"Size","path":"/lrsiem/docs/size","children":[]},{"id":"ci_aa605cadcdbd8040f1944b3f78ec2ab84d2a8909094d7a1a5616a92b18f0f909","title":"Status [7.2]","path":"/lrsiem/docs/status-7-2","children":[]},{"id":"ci_2e881bfa85877b96ef516c2446e7d3daf30e0b48e0a27279d67dce02b62ac01b","title":"Subject","path":"/lrsiem/docs/subject","children":[]},{"id":"ci_553f47242351c48683ce58b89c172f4206d0f4663692c918ac494bab78b32b85","title":"URL","path":"/lrsiem/docs/url","children":[]},{"id":"ci_3c11ec412c42b5a7becf58377c1f04ddc23c33dddbc0a96ebfe2ae45f2bd21e4","title":"User Agent [7.2]","path":"/lrsiem/docs/user-agent-7-2","children":[]},{"id":"ci_8f53720cfcf5708642d08503001de841977352035de090eb719bd4bd3b73427a","title":"Version","path":"/lrsiem/docs/version","children":[]}]},{"id":"ci_ef84421f3353169d327ae22486762c022958aecc78aa156e1f5e4aa47605f57e","title":"Kbytes/Packets Tab","path":"/lrsiem/docs/kbytes-packets-tab","children":[{"id":"ci_0f710f924a6b4684110c9a28011e0c3d6817f2e24b26d4ef866d56b90b1eb484","title":"[prefix] [Bits/Bytes] [blank/In/Out]","path":"/lrsiem/docs/prefix-bits-bytes-blank-in-out","children":[]},{"id":"ci_9ffdcae7c47d582c0d8bc9d97cecdf88ce5fc5cd02ef89ce68fe7ea0d7608334","title":"Packets [Total/In/Out]","path":"/lrsiem/docs/packets-total-in-out","children":[]}]},{"id":"ci_9809eb117d04ef39aaf7dc7b7036d0a344168e846e20aeb24e848e440f949179","title":"Classification Tab","path":"/lrsiem/docs/classification-tab","children":[{"id":"ci_18e1385d91a342f2103f1619ed3e69a41526a9989515c8e2a2de22cf01f1db92","title":"CVE [7.2]","path":"/lrsiem/docs/cve-7-2","children":[]},{"id":"ci_399f57e7b167e0b682d21a620acb7de9b1ba1b4ef8de6dc3ef1d9dc410fd18c0","title":"Severity","path":"/lrsiem/docs/severity","children":[]},{"id":"ci_60d3feb340fb20cfeea1b8ee6be5b70d63fe7ef4cbe534583e995a3807740b91","title":"Threat ID [7.2]","path":"/lrsiem/docs/threat-id-7-2","children":[]},{"id":"ci_d4a00cced81d6da3685fa799824ee3150afbc958605d237fc4f4f4918dd7f4e7","title":"Threat Name [7.2]","path":"/lrsiem/docs/threat-name-7-2","children":[]},{"id":"ci_68d4e11446f1ce18d9a4c51ea59699ea58137236a3e57e8bc0ecf83087a623f0","title":"Vendor Info [7.2]","path":"/lrsiem/docs/vendor-info-7-2","children":[]},{"id":"ci_63e2bfa4edae868e6949d88739e9ea14c3540c83732b769d52bd483bfed5147c","title":"Vendor Message ID","path":"/lrsiem/docs/vendor-message-id","children":[]}]},{"id":"ci_078eeacd9e0df522540ba14fb54a77605b532b9ff07021ff821b4fae3ae6405e","title":"Host Tab","path":"/lrsiem/docs/host-tab","children":[{"id":"ci_f52493e6a3f1d3ff6cec0432489fa079a1ca00ee07f17a8042bb556f7f7f3168","title":"DIP/DestinationIP/Impacted IP","path":"/lrsiem/docs/dip-destinationip-impacted-ip","children":[]},{"id":"ci_2b96b57256c7172f8dd70b24b9f5ce648d7d1fc66daa48d06558c787f92f379f","title":"DIPv4","path":"/lrsiem/docs/dipv4","children":[]},{"id":"ci_d96bd1fd1250621c1e0e36f6d8aa39b1da28f372b799cc9a9029ea0c6f5c616f","title":"DIPv6","path":"/lrsiem/docs/dipv6","children":[]},{"id":"ci_24e3685370d05985b4c6e315f22513425e397483392c4adb61eca64ae674b9b3","title":"DIPv6E","path":"/lrsiem/docs/dipv6e","children":[]},{"id":"ci_2dbb7087e8a22d777b05a3da24eefdd304b1f9370d3039f58f675d4a9486832b","title":"Impacted Hostname","path":"/lrsiem/docs/impacted-hostname","children":[]},{"id":"ci_db87e206116efc33acfdbd81664e2e1efe50bdbb85953230a393c5e88cdb423e","title":"Impacted Hostname or IP","path":"/lrsiem/docs/impacted-hostname-or-ip","children":[]},{"id":"ci_7e213f2b7987339880146af69dbcb4b0617c85baf78e32c085310bebcfc4371e","title":"Impacted Interface","path":"/lrsiem/docs/impacted-interface","children":[]},{"id":"ci_3a1a37f7562784b798207837353cf4c59913a344d7afed72756e4247d573b28e","title":"Impacted MAC Address","path":"/lrsiem/docs/impacted-mac-address","children":[]},{"id":"ci_11c3cb7fa6a00c9285ea5063e91da40d083c2e9d46e2a04fadf62dcff26cef7a","title":"Impacted NAT IP","path":"/lrsiem/docs/impacted-nat-ip","children":[]},{"id":"ci_ea8febf2f86349e932cdd36e045a8f8c88c8c2b6a82274e7c475153853321e1e","title":"IP Address (Origin)","path":"/lrsiem/docs/ip-address-origin","children":[]},{"id":"ci_31dd8c26271cd4c5350e2567fb21ea643e5bc26c99dc78356c3feacc5f9499ea","title":"Origin Hostname","path":"/lrsiem/docs/origin-hostname","children":[]},{"id":"ci_3304089d9a5ddc853654bb69be4a8e1d1e68f16f3220f918d6832dadf59a8102","title":"Origin Hostname or IP","path":"/lrsiem/docs/origin-hostname-or-ip","children":[]},{"id":"ci_7a8c9981dc3a5040256d471759819abcc5d74dc36ee2687f2c2d1170edf77dd0","title":"Origin Interface","path":"/lrsiem/docs/origin-interface","children":[]},{"id":"ci_5f04be66f5d00848cb144bfc66e333c9f39f5ba38747bb567612cf8c7252dfc0","title":"Origin MAC Address","path":"/lrsiem/docs/origin-mac-address","children":[]},{"id":"ci_56d82d2c559935444f95448c4d8e1c61c7f3aa82ce26b15ac8435e47f97d5c21","title":"Origin NAT IP","path":"/lrsiem/docs/origin-nat-ip","children":[]},{"id":"ci_ab2ff695242416bf0ca92dc8cd351a414fad14859e574c9ad1d012f22cf97442","title":"Serial Number [7.2]","path":"/lrsiem/docs/serial-number-7-2","children":[]},{"id":"ci_435d2c803668427a050d5d7e119f7b3de774435ff1d50dba368dc5d51660ad1b","title":"SIPv4","path":"/lrsiem/docs/sipv4","children":[]},{"id":"ci_289ff5b83142e3f2a3144913d2d4ef8de6e79f279ead8d680eb904baa2db4b26","title":"SIPv6","path":"/lrsiem/docs/sipv6","children":[]},{"id":"ci_c17e6e8ee187569d0129ab61a44f6f80828b0ad621d54eae39fcd6e75ae55f4b","title":"SIPv6E","path":"/lrsiem/docs/sipv6e","children":[]}]},{"id":"ci_9cfc2144d283879e5f8b302841e8c5599d207976375bc96599db66fe2ed4050c","title":"Identity Tab","path":"/lrsiem/docs/identity-tab","children":[{"id":"ci_2770619046e92d9c9b1ae33fa47bd29f8bab2c484c1dfc21ad805a2f96646f0b","title":"Account > User (Impacted)","path":"/lrsiem/docs/account-user-impacted","children":[]},{"id":"ci_9d0a65c744bde9b9b83684903fe829674dbb97ae44a81498c3079975cc947268","title":"Group","path":"/lrsiem/docs/group","children":[]},{"id":"ci_be78148ea9c54dfb70925c43218e1f4ca5f283590448bd5d76729888213b6356","title":"Login > User (Origin)","path":"/lrsiem/docs/login-user-origin","children":[]},{"id":"ci_a29452ff09cbd0535daad2bfd71d4fe993a299970ac7e9ae5faec96a21508818","title":"Recipient","path":"/lrsiem/docs/recipient","children":[]},{"id":"ci_1dd8df733eae503ef3e9137606ba082d5165e2a995d69c94dc81fdbd8acfa582","title":"Sender","path":"/lrsiem/docs/sender","children":[]}]},{"id":"ci_ba8dc598932e28dc66de7c9e71d4a6c8f103c917f72119de61755a7d3d318f3c","title":"Location Tab","path":"/lrsiem/docs/location-tab","children":[]},{"id":"ci_b6fac860a387d3495388ae742280c6c105988ad9f3277fde513383111efea8dd","title":"Log Tab","path":"/lrsiem/docs/log-tab","children":[]},{"id":"ci_054a71b77fcf5d3a6e01007de52ae7232003a4ff3a027b49071110fdb1f3a12b","title":"Network Tab","path":"/lrsiem/docs/network-tab","children":[{"id":"ci_334ef778ad545e92d0abe8bf6f179e7185a6dab3edc294da2a08ec219b1766e1","title":"Domain (Origin) [7.4]","path":"/lrsiem/docs/domain-origin-7-4","children":[]},{"id":"ci_7a00528915d914ec104eb491bbda188f8e08be7d21bc71d6c1aad5c91fa1aa08","title":"Domain [7.2] (Domain (Impacted))","path":"/lrsiem/docs/domain-7-2-domain-impacted","children":[]},{"id":"ci_b9f1284006203d2929d0eefed023b253e8d327346f45e8bc59c5f6c7f636ba68","title":"Impacted NAT Port","path":"/lrsiem/docs/impacted-nat-port","children":[]},{"id":"ci_7abce270d7db5fa846e97c30201facafd40cbd022d9782aff993b503e096992f","title":"Impacted Port","path":"/lrsiem/docs/impacted-port","children":[]},{"id":"ci_741beee7d41159089da79d80c7247995d34158e96d2561cbf36c2bec82c52af7","title":"Origin NAT Port","path":"/lrsiem/docs/origin-nat-port","children":[]},{"id":"ci_8c9d433219b6bbc2e965569db2b836c198ce86c283f76b12d404cb000552f955","title":"Origin Port","path":"/lrsiem/docs/origin-port","children":[]}]},{"id":"ci_506b0002931f80e43204591484dc9734f1c6d9e296552befcb43b704f98777b5","title":"Other MPE Fields","path":"/lrsiem/docs/other-mpe-fields","children":[{"id":"ci_15cb8aef25f073b178a097d976af027283ca9b13a18eef408e2f1f7db3fec467","title":"[Tag1-Tag5]","path":"/lrsiem/docs/tag1-tag5","children":[]},{"id":"ci_a12ddd3998e3f982ad51a09635e4513bb662a78544698565170a29d0b995eeeb","title":"Items In","path":"/lrsiem/docs/items-in","children":[]},{"id":"ci_a2f19020c4d1060eb32a8fa9e987b3f82a0070b88b6b77f416f190fb5c8b616d","title":"Items Out","path":"/lrsiem/docs/items-out","children":[]}]},{"id":"ci_dc33bf57ca21a66703724a3d46273e74e9d222a99f82274752f27038cb68dfca","title":"Derived Data","path":"/lrsiem/docs/derived-data","children":[{"id":"ci_61ecd089a0664c3aae302d24b244a6665404ee3d8f4ffbdca4d7fe42b267e60e","title":"Identity-Derived Data","path":"/lrsiem/docs/identity-derived-data","children":[]},{"id":"ci_ece5c88042cec0eb4a2b6a432e0ec87972480ddd2226f74d847ae04775a77d8f","title":"Log-Derived Data","path":"/lrsiem/docs/log-derived-data","children":[]}]}]},{"id":"ci_19c70be468c35358471e94b67a6da613d7f36efc1bbf847af827e5546426f2d2","title":"Other LogRhythm Applications","path":"/lrsiem/docs/other-logrhythm-applications","children":[{"id":"ci_869465f70e1215ce5b08a03268d514fb24de19818011a1fe509cd1657bf361a2","title":"Threat Intelligence Service","path":"/lrsiem/docs/threat-intelligence-service","children":[{"id":"ci_452ac891b5590ac320a7686f66b7ed0c6bd18f61c9d830651a54e24fabe266c0","title":"Install and Deploy the Threat Intelligence Service","path":"/lrsiem/docs/install-and-deploy-the-threat-intelligence-service","children":[{"id":"ci_145fefefff6f79045092714580e327121d4d01e84552d644b8abc505d1cbe972","title":"Run the Threat Intelligence Service Installer","path":"/lrsiem/docs/run-the-threat-intelligence-service-installer","children":[]},{"id":"ci_b884853b0fdd63b7e7e8eef848aece2c1a5053e46d0ac514428597d22aa31c6e","title":"Modify, Repair, or Remove the Threat Intelligence Service","path":"/lrsiem/docs/modify-repair-or-remove-the-threat-intelligence-service","children":[]},{"id":"ci_042491cdde08735479f95c493be02898b68be69008b0f587ba98da916354a8dd","title":"Enable and Import the Threat Intelligence Service Modules","path":"/lrsiem/docs/enable-and-import-the-threat-intelligence-service-modules","children":[]},{"id":"ci_fd5e2d68df1ca1092710404020a37fc2bf1eb48583e461fa16f850fe247836af","title":"Associate Vendor Lists with LogRhythm Lists","path":"/lrsiem/docs/associate-vendor-lists-with-logrhythm-lists","children":[]},{"id":"ci_1966530c4504513e6805d5ee35a5bde3ea7261eb9b7653ab75fd6229742fbfa6","title":"Enable Threat List AIE Rules","path":"/lrsiem/docs/enable-threat-list-aie-rules","children":[]},{"id":"ci_3c7b9594e40c4851302368818936f87d2a0b8c648e55e7df5cbc56c12752f2f1","title":"Start the LogRhythm Threat Intelligence Service","path":"/lrsiem/docs/start-the-logrhythm-threat-intelligence-service","children":[]},{"id":"ci_b154569da0b717bd0d71555d0ffd5881200e0fd26918b0fe886ae9e775dd7aa6","title":"Vendor Lists","path":"/lrsiem/docs/vendor-lists","children":[{"id":"ci_75a2fafb7b9d0cbdb0661d097518e92109e2fb7892dd22ff47f387737eac521e","title":"BrightCloud","path":"/lrsiem/docs/brightcloud","children":[]},{"id":"ci_25fbfd35ef32b957fad63f607fbbb3a8d166faa98600887062b8b9a86bb21f4d","title":"CrowdStrike","path":"/lrsiem/docs/crowdstrike","children":[]},{"id":"ci_7cf12b907b4a6a54111bcc119374cc403afbd882562987b8b95b5c3d84d3a27e","title":"Cisco AMP Threat Grid","path":"/lrsiem/docs/cisco-amp-threat-grid","children":[]},{"id":"ci_5b41b4040ee38777f4ea9257e1d37c17d30e4067546a1400960a838db3b948f7","title":"Symantec","path":"/lrsiem/docs/symantec","children":[]},{"id":"ci_5d6c882c16bf7cde350a85df7d0e9db19c8dd11a9f0f1bc2f27d093a858bde6f","title":"Open Source","path":"/lrsiem/docs/open-source","children":[]},{"id":"ci_8b05b72510d395d64ec84ff4357878f64e1b87f874be1249db9a313f64cd1499","title":"Custom Providers","path":"/lrsiem/docs/custom-providers","children":[]}]}]},{"id":"ci_5fdc70a4e13231620b91588d0088e6f4f819437ff3ee2f486dfa39dbb02b05ec","title":"Threat Intelligence Service User Guide","path":"/lrsiem/docs/threat-intelligence-service-user-guide","children":[{"id":"ci_f60552dc528c0edcdcc9484509b79cbef90a6985fcc6c5a5c5ca681483c37741","title":"Launch the Service Manager","path":"/lrsiem/docs/launch-the-service-manager","children":[]},{"id":"ci_5a28b36265f9b56409648674d3f4a99962f451e59acac8c4b078136741ea4f60","title":"Configure the Connection to LogRhythm","path":"/lrsiem/docs/configure-the-connection-to-logrhythm","children":[]},{"id":"ci_a4a42ac23b02b70662deb56b7137be08275a28931f8fe7a376b42f6c18c96f4e","title":"Configure Proxy Settings","path":"/lrsiem/docs/configure-proxy-settings","children":[]},{"id":"ci_3f20bf29d8a65dae26ed604e6afc2eebf2adac5d3a6600b21f0ee7aedc4fc9bf","title":"Configure Vendor Threat Feeds","path":"/lrsiem/docs/configure-vendor-threat-feeds","children":[]},{"id":"ci_76388e1a546b98b9b1df7e1af8cdbe9812ffe897ed5025e074a1a068aae9da57","title":"Add a Custom STIX/TAXII Provider","path":"/lrsiem/docs/add-a-custom-stix-taxii-provider","children":[{"id":"ci_bf8819a7ac82621df097008317ed2cd799c91d0dc0335fddb6520b8d0d0118a7","title":"Add a STIX Feed in TIS","path":"/lrsiem/docs/add-a-stix-feed-in-tis","children":[]},{"id":"ci_9290d1d8df50700e5466b3d3a37827ec40bfdde24766a5892273f2d6f72bf628","title":"Configure CustomObjectType in STIX/TAXII Feeds in TIS","path":"/lrsiem/docs/configure-customobjecttype-in-stix-taxii-feeds-in-tis","children":[]}]},{"id":"ci_3ea43d7453e7ceaf14bb97b014deb888d15b770b3ab58effc24dbfb61a0fff93","title":"Start and Stop the Service","path":"/lrsiem/docs/start-and-stop-the-service","children":[]},{"id":"ci_fb3eb8629f0aaa5965aa645da28adbd9b2bda6e92781b7b2c7b2af05fd6d43a2","title":"Configure the Threat Intelligence Service Whitelist","path":"/lrsiem/docs/configure-the-threat-intelligence-service-whitelist","children":[]},{"id":"ci_05668b0679c7e1db77096acb427e48919d40471fb99be11f68eb9733d14f4b32","title":"URL Normalization","path":"/lrsiem/docs/url-normalization","children":[]},{"id":"ci_f4f8b591c683449787405bbd1287fbf58970fcfa482dbce3e7c1f68399f1d742","title":"Request Response Logging","path":"/lrsiem/docs/request-response-logging","children":[]},{"id":"ci_80e561ed7a5286dd354a14ec1bac5e0feabf3221c3b4656029620fe838c93cd1","title":"View Log Files","path":"/lrsiem/docs/view-log-files","children":[]},{"id":"ci_1eb433680a5defe9817cde9210c63684efa274c8b403c9eef9b481f1f0ac618d","title":"Troubleshoot the Threat Intelligence Service","path":"/lrsiem/docs/troubleshoot-the-threat-intelligence-service","children":[{"id":"ci_8c21236235390e6afd0c50d5ed9e9c7af4da6bddce9e9786c46d6208208b0c1d","title":"Firewall Blocking Open Source URLs in TIS","path":"/lrsiem/docs/firewall-blocking-open-source-urls-in-tis","children":[]},{"id":"ci_50f1bc1510d3f8f41b4682bc7037efa190cb17c6509fc606367bef5409968232","title":"Log Files in TIS","path":"/lrsiem/docs/log-files-in-tis","children":[]},{"id":"ci_08c0203d16e9816a2153cb0abc87148ea3cf96cfc921da49c0c8d159162c6f5a","title":"Resource Utilization in TIS","path":"/lrsiem/docs/resource-utilization-in-tis","children":[]},{"id":"ci_1e8b0193aede82e27ddaf7e170250a4c6d34fbdf1dea1afbc934cc89e0c60603","title":"Threat Intelligence Service Will Not Start","path":"/lrsiem/docs/threat-intelligence-service-will-not-start","children":[]}]}]}]},{"id":"ci_1c15eb26283dc1abfbc34ded36a82cb3766a81abc317b622141d0bc1a7e21d47","title":"LogRhythm Echo","path":"/lrsiem/docs/logrhythm-echo","children":[{"id":"ci_3d1280072640ed822914a55fd9607e4976d6965fef2afb63c7c6604d1eb70ecb","title":"Install or Upgrade LogRhythm Echo","path":"/lrsiem/docs/install-or-upgrade-logrhythm-echo","children":[]},{"id":"ci_eb9c048641900ae7e93e59298affab3c44069b8c98bf94556bcbb0188a6c67de","title":"Configure LogRhythm Echo","path":"/lrsiem/docs/configure-logrhythm-echo","children":[]},{"id":"ci_3d6ec7bafc0baea7e760507d21ce0cb32c22a959e7fa1fec98f329ecd8b9b04f","title":"Manage LogRhythm Echo Use Cases","path":"/lrsiem/docs/manage-logrhythm-echo-use-cases","children":[]},{"id":"ci_181c6ae3ce78219812a8a855da02468c912f6fffbf1a07e7a4d196868334944c","title":"Run LogRhythm Echo Use Cases","path":"/lrsiem/docs/run-logrhythm-echo-use-cases","children":[]},{"id":"ci_96fb7379bfa75059f509efab017ab3ed4caa5ea72485943632f3aa1254fd57b1","title":"Schedule LogRhythm Echo Use Cases","path":"/lrsiem/docs/schedule-logrhythm-echo-use-cases","children":[]},{"id":"ci_b872979d5781d514a079e7a27faa49653aaacd0658ed042096a08efa1547f1b8","title":"LogRhythm Echo API","path":"/lrsiem/docs/logrhythm-echo-api","children":[]},{"id":"ci_cb657e8c3da49b31ad1171e128b9303b2a1e26deb430d805a986495b842ce64e","title":"LogRhythm Echo Troubleshooting","path":"/lrsiem/docs/logrhythm-echo-troubleshooting","children":[]},{"id":"ci_d867110affb3900e016ece2ba45191c86107f78e90e8c7683694fd232557a2aa","title":"LogRhythm Echo Use Case DB","path":"/lrsiem/docs/logrhythm-echo-use-case-db","children":[]},{"id":"ci_fecdc22d2a0989c1b43956e0ee827fc12a1eeee8c8504cf4b144c691eb8fa026","title":"LogRhythm Echo Use Cases and Their AIE Rules, Lists, and SmartResponses","path":"/lrsiem/docs/logrhythm-echo-use-cases-and-their-aie-rules-lists-and-smartresponses","children":[]}]},{"id":"ci_fe04397d563aa529cfe0e41209e8211a473db2bc1f1fe4a773569b52c8aa4f39","title":"LogRhythm Intelligence","path":"/lrsiem/docs/logrhythm-intelligence","children":[{"id":"ci_963fbf3be5352717b5e83043d0477ac6e81694db56170f6a4379b688b7b73f92","title":"LogRhythm Intelligence Threat Summary","path":"/lrsiem/docs/logrhythm-intelligence-threat-summary","children":[]},{"id":"ci_82057eecd5c1c2dcc1a99138fbd143b21f0bcf2857bf40b4354198b829399bef","title":"LogRhythm Intelligence Cloud Data Security","path":"/lrsiem/docs/logrhythm-intelligence-cloud-data-security","children":[]}]},{"id":"ci_9675f1a71b92d1c8fb54cf7de357dce2959a443290d4721876bc5590ec3c4e73","title":"LogRhythm Diagnostics Tool","path":"/lrsiem/docs/logrhythm-diagnostics-tool","children":[{"id":"ci_971e3326b0e4ea17eb3a41c540f941f12244f5f75f9eee55bb1238178ffa83bf","title":"Install the Diagnostics Agent and Diagnostics Tool","path":"/lrsiem/docs/install-the-diagnostics-agent-and-diagnostics-tool","children":[]},{"id":"ci_1b465d4c07113683dc9b151100807d1ea4731b3337f054a654a276788662f243","title":"Configure Collection on the Diagnostics Tool","path":"/lrsiem/docs/configure-collection-on-the-diagnostics-tool","children":[]},{"id":"ci_b66eeffb95b6dfd625c59bb255e5d9c1ef759b020b1b01c573b8e2a6472675cb","title":"Tabs in the Diagnostic Tool","path":"/lrsiem/docs/tabs-in-the-diagnostic-tool","children":[]},{"id":"ci_4ead98224a403f28e205bfafefe070550dee8eb90fa48331e3d8590f2742c6f2","title":"Log Files and Data Collected by the Diagnostic Tool","path":"/lrsiem/docs/log-files-and-data-collected-by-the-diagnostic-tool","children":[]},{"id":"ci_d5b8d7940e8e16934953f62394f9fbe8fe3b508061f7c20e43d064673036bcd1","title":"Detailed .zip File Contents From the Diagnostics Tool","path":"/lrsiem/docs/detailed-zip-file-contents-from-the-diagnostics-tool","children":[]}]},{"id":"ci_5e0ec72977f36979682ffdf42186b17cd9c804de4acc17b392ba33dadfd65cea","title":"TrueIdentity Sync Client User Guide","path":"/lrsiem/docs/trueidentity-sync-client-user-guide","children":[{"id":"ci_0a494be6d51e717f44d5d015e4bb4bad7e9de2b3dae80d04b27e3e48008745ff","title":"TrueIdentity Sync Client Release Notes","path":"/lrsiem/docs/trueidentity-sync-client-release-notes","children":[]},{"id":"ci_0ec25eb05798d3d663018a724fc7f2f4080558c9a3675e522fd8b4e9b870f157","title":"Install the TrueIdentity Sync Client","path":"/lrsiem/docs/install-the-trueidentity-sync-client","children":[]},{"id":"ci_3c385dba0ef543b1d48f3dce5caea192efd25dce127e3fef2659ebfc78b55274","title":"Create Custom Certificates","path":"/lrsiem/docs/create-custom-certificates","children":[]},{"id":"ci_50151b38bc5b398333c6a8c37e0fb70e3c915b3938aa80427b5bcee3202675e3","title":"Generate LR API Token","path":"/lrsiem/docs/generate-lr-api-token","children":[]},{"id":"ci_c696b6ebec1bc43a3ba5e1e04c36889fe6555fd3aee8197e9e65581f50b46b09","title":"Launch the TrueIdentity Sync Client","path":"/lrsiem/docs/launch-the-trueidentity-sync-client","children":[]},{"id":"ci_f902eaac84e94acfaff6f0750264dab56d14411ae94ed5c60f306366e5382cb1","title":"Add a TrueIdentity Sync Job","path":"/lrsiem/docs/add-a-trueidentity-sync-job","children":[]},{"id":"ci_166cb7a510bfdba019e22562dc886064fb159f01ea07b0035055cc0af6134dac","title":"View Synchronized TrueIdentities","path":"/lrsiem/docs/view-synchronized-trueidentities","children":[]},{"id":"ci_42f40922959a3912ad64d55b97bd7a2dee960276198caf03911ae1acfa340db6","title":"Troubleshoot the TrueIdentity Sync Client","path":"/lrsiem/docs/troubleshoot-the-trueidentity-sync-client","children":[]}]},{"id":"ci_ce47bf0e7a4208f729719f061364a23a823ab263f93cc4da8d86b712fcf3d748","title":"Using Kibana with LogRhythm SIEM","path":"/lrsiem/docs/using-kibana-with-logrhythm-siem","children":[]},{"id":"ci_442014e28af01bf43f05e83aa3950ccad0653e60f5b7e80ebfd51abf6c38c2f3","title":"DX Upgrade Checker","path":"/lrsiem/docs/dx-upgrade-checker","children":[]}]},{"id":"ci_e9c4536cc6a0529f99648d9380f5025c4631aab618e7d417be32836312cf1811","title":"Understand the LogRhythm Architecture","path":"/lrsiem/docs/understand-the-logrhythm-architecture","children":[{"id":"ci_d7f9b8532a69b7aa2408c73bea10922b732181d0f292e3485f6122612979f8e3","title":"Licensing","path":"/lrsiem/docs/licensing","children":[]},{"id":"ci_04e61c32c2c30ef52f475b5de7520081da636641ef9ed0665672613706b1c792","title":"Log Processing","path":"/lrsiem/docs/log-processing","children":[{"id":"ci_62bfc0f6f88d64ecbd0ea97958a9bc11455c8c5bd04f7ae9ae33a6c5b4bfa8b0","title":"Audit Classifications","path":"/lrsiem/docs/audit-classifications","children":[]},{"id":"ci_a3ad00ac3c0d1cdf54048cedd37a63756d2b704a29d228edcb3fe3ec49cdfacc","title":"Configuration and Log Processing","path":"/lrsiem/docs/configuration-and-log-processing","children":[]},{"id":"ci_8371c35230a58ee36c4f69497fd3f27c283c300b23c82e47e54429e71ad71e81","title":"Operations Classifications","path":"/lrsiem/docs/operations-classifications","children":[]},{"id":"ci_5b00b366e31d438886ccf094907a9fabfb3723d73dcd86755c3259c61fc8800e","title":"Security Classifications","path":"/lrsiem/docs/security-classifications","children":[]}]},{"id":"ci_3d92c5c056b60b11cd150bc245de927814bf4557838651d977a1b27ac672cc47","title":"Logs, Events, and Alarms","path":"/lrsiem/docs/logs-events-and-alarms","children":[]},{"id":"ci_4fa6ec7126bfd3f97b0ac27e17f9b95b2faeb4d1dba9fedb0186e32752acb3a6","title":"Networking and Communication","path":"/lrsiem/docs/networking-and-communication","children":[]},{"id":"ci_cd6484a45e114464cd5ff898aaefb779fc31caf27a15330ce599179ebde6a44c","title":"LogRhythm SIEM Databases","path":"/lrsiem/docs/logrhythm-siem-databases","children":[]},{"id":"ci_5707543ec6b7713a2c2ab2155ed18468f449cc247417b07441216ef03579d79a","title":"Component Reference","path":"/lrsiem/docs/component-reference","children":[]}]},{"id":"ci_1c216f21c1b198ce6298ece29e43be7078aadb9aed2ea3377f9fa6b5c3a01bfb","title":"Find More Information","path":"/lrsiem/docs/find-more-information","children":[{"id":"ci_53f6f21605cb2e5ab038cb348f0e101f2be8d46b423f8e01196683c40edf774b","title":"Customer Support Guide","path":"/lrsiem/docs/customer-support-guide","children":[]},{"id":"ci_241b80972e24f495eb083147b690cd4733615a861a7d2a4505ac2d283ee7922b","title":"Glossary of LogRhythm Products and Components","path":"/lrsiem/docs/glossary-of-logrhythm-products-and-components","children":[]},{"id":"ci_c740ee069d7da3d017198deee787115e9490b00c49b36931c9843bf9c8fb0494","title":"Open Source License Acknowledgements","path":"/lrsiem/docs/open-source-license-acknowledgements","children":[]},{"id":"ci_1ac7e51a7bd4e50b89cb6281962ff0f02844e835c7026aef52007876cc98e67d","title":"Upgrade FAQ and Determining the Correct Upgrade Path","path":"/lrsiem/docs/upgrade-faq-and-determining-the-correct-upgrade-path","children":[]},{"id":"ci_a570c79135b2bf7c732134497aa31a2091b4de2095b21c8a40f0b2405f59fd13","title":"End of Life Policies for Software and Hardware","path":"/lrsiem/docs/end-of-life-policies-for-software-and-hardware","children":[]}]},{"id":"ci_d9e2ef7f173b8e967e0e926e12f6846d9fd89b81d4088b1f34ab79063b87ed8e","title":"Download PDFs","path":"/lrsiem/docs/download-pdfs","children":[]}]