LogRhythm Incidents

The OpenCTI LogRhythm Incidents connector imports cases and their alarm evidence from LogRhythm SIEM into OpenCTI. It periodically pulls cases through the LogRhythm Case API, converts each attached alarm (a detection) to a STIX 2.1 Incident, and converts the case (a case-management artifact) to a STIX 2.1 Case-Incident that references those Incidents through its object_refs. Paired with the existing LogRhythm stream connector (which feeds LogRhythm lists from OpenCTI), it provides the import side of a bidirectional integration.