7.26.0 7.25.0 7.24.0 7.23.0 7.22.0 7.21.0 7.20.0 7.19.0 7.18.0
7.26.0 7.25.0 7.24.0 7.23.0 7.22.0 7.21.0 7.20.0 7.19.0 7.18.0
Breadcrumbs

Install or Upgrade LogRhythm Echo

Prerequisites for LogRhythm Echo v.2.0.14

  • LogRhythm SIEM 7.26.0 or later.

  • (Recommended) Latest LogRhythm Knowledge Base.

  • The LogRhythm Echo service installed on a Windows system with network connectivity to the LogRhythm Platform Manager (TCP/1433) and Data Processor (TCP/443).

  • Read/write access to the LogRhythm EMDB SQL Server database.

  • (Recommended) Use the LogRhythmECHO least-privilege account, now automatically provisioned.

  • The latest version of Chrome or Firefox browser. Internet Explorer is not supported.

  • (Optional) LogRhythm NetMon 3.x or later, for use cases that require PCAP replay. The NetMon’s management IP address, user name, and API key are required to access the PCAP Replay API.

Install Echo

  1. Download the signed LogRhythm Echo installer from the LogRhythm Community.

  2. Copy the installer to a Windows machine with network connectivity to the LogRhythm Platform Manager and the Data Processor.

  3. Run the installer as Administrator.

  4. After installation, start the Echo service using the Windows Services interface. Click Control Panel, click Administrative Tools, and then click Services.
    Alternatively, run the following from the command line:

    sc start LogRhythmECHO

Installation Notes

Before using a new Echo installation, perform the configuration steps in the Configure LogRhythm Echo section.

  • Echo installs to C:\Program Files\LogRhythm\LogRhythm ECHO.

  • The Echo software is a Windows Service called “LogRhythm ECHO.”

  • The Echo service can be started and stopped using the Windows Services interface, or from the command line using the following commands:

    sc start LogRhythmECHO
sc stop LogRhythmECHO

  • Access the Echo user interface by pointing a browser at https://<localhost>:33333.

Upgrade Echo

The Echo installer overwrites the local use case database. If you have created custom use cases, export and back them up before upgrading. As an additional safeguard, back up C:\Program Files\LogRhythm\LogRhythm ECHO\instance\usecase.db before uninstalling the existing version.

  1. Open the Echo web interface, and then click Configuration.

  2. Click Delete SIEM Configuration, and then click Confirm.

    This removes all Echo objects from the EMDB (Entity, Host, Agent, Log Sources, and GLPR).

  3. Uninstall the LogRhythm Echo application.
    Open the Windows Control Panel, click Programs and Features, click LogRhythm Echo, and then click Uninstall.

  4. Download the signed LogRhythm Echo installer from the LogRhythm Community.

  5. Copy the installer to the Windows machine where Echo will be installed.

  6. Run the installer as Administrator.

  7. After installation, start the LogRhythm Echo service using the Windows Services interface.
    Click Control Panel, click Administrative Tools, and then click Services.
    Alternatively, run the following from the command line:

    sc start LogRhythmECHO

  8. Open the Echo web interface, click Configuration, click Initialize Echo Configuration, and then follow the configuration steps. For more information, see Configure LogRhythm Echo.

  9. (Optional.) Copy any exported use case .zip files from C:\Program Files\LogRhythm\LogRhythm ECHO\export to C:\Program Files\LogRhythm\LogRhythm ECHO\usecaseimport\Custom.

  10. (Optional.) Alternatively, replace the C:\Program Files\LogRhythm\LogRhythm ECHO\instance\usecase.db with your backup post upgrade.