LogRhythm Echo

Echo v.2.0.14

LogRhythm users need a straightforward way to:

• Test the AI Engine (AIE) and Alarm rules that their analysts develop so they know that Alarms will generate as expected and that users can reliably and repeatedly replicate the inputs to the rule.

• Verify out-of-the-box (OOTB) AIE, Alarm, and Message Processing Engine (MPE) content, MPE rule regression and performance testing, and system load and stress testing.

• Demonstrate LogRhythm’s capabilities to prospects, customers, partners, and system integrators.

• Seamlessly author new use cases as needed to demonstrate or verify system behaviors—such as ransomware, financial fraud, and data exfiltration—that are specific to the target environment.

LogRhythm Echo provides these capabilities. Echo is a standalone Windows application with web and command line interfaces that simulates a LogRhythm System Monitor Agent and allows users to replay native raw logs and PCAPs into LogRhythm for demonstration, validation, and verification purposes. Easy to install, configure, and use, Echo leverages out-of-the-box log source types and processing rules to enable users to quickly build, demo, validate, verify, and tear down security use cases. Echo comes with more than 30 use cases ready for replay, and users can create, modify, and share use cases using the web interface or a text editor.

Features

Echo’s features allow users to:

• Load more than 30 verified, consistent, proven use cases that are easy to understand and explain.

• Use out-of-the-box content for log source types, processing rules, AIE rules, and Alarm rules. Automatically create and delete required objects in the Platform Manager database.

• Quickly build, validate, demo, and tear down security use cases to test their LogRhythm deployment.

• Edit the included use cases and create new ones.

• Employ exotic log source types to create compelling and targeted security use cases.

• Use the LLX File Browser to add raw logs from the deployment to use cases.

• Import and export use cases, including raw logs and PCAPs, to share with other users.

• Bulk import and deploy multiple use cases, including 20+ optional MITRE ATT&CK content packs and ZIP-based use case packages.

• On-demand and continuous/predetermined use case replay.

• Use case log replay through a simulated Agent in native formats, such as APIs, Syslog, NetFlow, Check Point, flat files, and more. There are no custom log source types, raw logs, or special tags required.

• Select and validate Message Processing Engine (MPE) policies (including Custom) during log configuration and testing.

• Run use cases by invoking the REST API from the command line (for instance, using cURL) or your favorite scripting language (such as PowerShell).

LogRhythm Echo Release Notes

LogRhythm Echo was updated to version 2.0.14 with the release of LogRhythm SIEM 7.26.0 on 1 October 2026.

New Features/Enhancements

New Least-Privilege Account

The lrecho least-privilege account has been replaced with a new LogRhythmECHO account that includes all required permissions for adding and removing configurations as part of the Echo upgrade process.

For information on changing the default password for this account, refer to LogRhythm Default Passwords.

LogRhythm Echo Bulk Importer

The Bulk Importer allows administrators to quickly deploy multiple use cases from pre-defined directories, making it easier to restore custom content after upgrades and deploy an optional MITRE ATT&CK expansion pack.

For more information on the bulk importer, refer to Manage LogRhythm Echo Use Cases.

MITRE ATT&CK Use Cases

The available LogRhythm Echo use case library has been expanded with 20 MITRE ATT&CK-aligned use cases designed to accelerate validation, testing, and demonstration activities. These optional use cases are automatically available through the Bulk Importer function. Additional MITRE ATT&CK use cases and content can be developed and customized through LogRhythm Professional Services, with more than 280 potential detection scenarios available for implementation.

For more information on these use cases, refer to LogRhythm Echo Use Cases.

Resolved Issues

The following issues have been resolved in LogRhythm Echo 2.0.14.