LogRhythm Integration

Create API Key

Create an API key in LogRhythm with log ingestion permissions.

                # Create API Key in LogRhythm:
# 1. Log in to LogRhythm Web Console
# 2. Navigate to Admin → API Management
# 3. Click "Create API Key"
# 4. Configure the following:
#    - Name: DBaudit Integration
#    - Permissions: Log Ingestion, Case Management
#    - Expiration: Set appropriate expiration
# 5. Copy the generated API key

# LogRhythm API URL format:
# https://<platform-manager>:8501/lr-admin-api

# Required permissions:
# - logs.write - Log ingestion
# - cases.write - Case creation (optional)
# - entities.read - Entity lookup
              

Create Log Source

Create a log source in LogRhythm Deployment Manager for DB Audit events.

                # Create Log Source in LogRhythm Deployment Manager:
# 1. Open Deployment Manager
# 2. Navigate to Log Sources → New Log Source
# 3. Configure:
#    - Name: DB Audit
#    - Log Source Type: Flat File - DB Audit (custom)
#    - Collection Method: API
#    - Entity: Select your database entity
# 4. Configure Message Processing Engine (MPE) rules

# Custom Log Source Type creation:
# 1. Tools → Knowledge → Log Source Type Manager
# 2. New Log Source Type
# 3. Name: Flat File - DB Audit
# 4. Set parsing rules (see MPE configuration below)
              

Configure MPE Rules

Create Message Processing Engine rules to parse DB Audit events.

                // LogRhythm MPE (Message Processing Engine) Rules
// Create in Knowledge → MPE Rules

// Rule 1: DB Audit Event
Rule Name: DB Audit - Database Event
Log Source Type: Flat File - DB Audit

Base Rule Regex:
^\{"timestamp":"(?<timestamp>[^"]+)","event_type":"(?<eventtype>[^"]+)","severity":"(?<severity>[^"]+)",.*"database":"(?<database>[^"]+)".*"user":"(?<user>[^"]+)".*"client_ip":"(?<clientip>[^"]+)".*"type":"(?<action>[^"]+)".*"object":"(?<object>[^"]+)".*"rows_affected":(?<count>\d+).*\}$

Field Mappings:
- timestamp → Log Date
- eventtype → Classification
- severity → Priority
- database → Object
- user → Login
- clientip → Source IP
- action → Command
- object → Object Name
- count → Quantity

// Rule 2: Authentication Failure
Rule Name: DB Audit - Auth Failure
Log Source Type: Flat File - DB Audit

Base Rule Regex:
^\{"timestamp":"(?<timestamp>[^"]+)","event_type":"auth_failure".*"user":"(?<user>[^"]+)".*"client_ip":"(?<clientip>[^"]+)".*\}$

Classification: Authentication Failure
              

Configure in DB Audit

Add the LogRhythm integration in the DB Audit dashboard.

1. Navigate to Integrations → SIEM in DB Audit
2. Click Add SIEM Integration
3. Select LogRhythm as the provider
4. Enter your API URL and API key
5. Configure log source settings
6. Select event types to forward
7. Test the connection and save

Create AI Engine Rules (Optional)

Create AI Engine rules to detect suspicious database activity patterns.

                // LogRhythm AI Engine Rule
// AI Engine → Rules → New Rule

Rule Name: DB Audit - Suspicious Data Exfiltration
Description: Detects queries returning large amounts of sensitive data

// Rule Block 1: Large Data Access
Type: Log Count
Log Source Type: Flat File - DB Audit
Filter:
  - Classification: SELECT
  - Quantity > 10000
  - Object contains "pii" OR Object contains "customer"
Count Threshold: 1
Time Window: 5 minutes
Group By: Login, Source IP

// Rule Block 2: Same user, multiple databases
Type: Unique Values
Log Source Type: Flat File - DB Audit
Filter:
  - Classification: SELECT
  - Quantity > 1000
Unique Field: Object
Threshold: 3
Time Window: 15 minutes
Group By: Login

// Response Actions
Primary:
  - Create Case (Priority: High)
  - Notify SOC Team
  - Add to Threat List

Secondary (SmartResponse):
  - Block IP at Firewall
  - Disable Active Directory Account