LogRhythm Incidents
自動配備
Siem And Analytics
Detection & Response Enablement
概要
Import LogRhythm cases (Case-Incidents) and their alarms (Incidents) into OpenCTI (bidirectional import side).
The OpenCTI LogRhythm Incidents connector imports cases and their alarm evidence from LogRhythm SIEM into OpenCTI. It periodically pulls cases through the LogRhythm Case API, converts each attached alarm (a detection) to a STIX 2.1 Incident, and converts the case (a case-management artifact) to a STIX 2.1 Case-Incident that references those Incidents through its object_refs. Paired with the existing LogRhythm stream connector (which feeds LogRhythm lists from OpenCTI), it provides the import side of a bidirectional integration.
基本情報
コネクター
External import
7.260706.0
0