LogRhythm LRSA case studies
LogRhythm LRSA · Put your knowledge to work in context.
The LogRhythm Security Administrator (LRSA) is a practitioner-level credential for the people who run a self-hosted LogRhythm SIEM day to day: SOC analysts who tune it, engineers who deploy and maintain it, and administrators responsible for log sources, analytics and incident workflow. Candidates typically already work inside the platform - adding data sources, building and adjusting rules, triaging alarms, and producing reports for auditors or management - and want independent evidence of that operational competence. The LogRhythm LRSA case studies are 5 cases and about 2,372 words.
1Syslog Onboarding with Skewed Event Times
Your team is onboarding a new perimeter firewall that sends syslog over UDP to a LogRhythm Mediator at roughly 3,000 events per second. The log source appears in the Client Console and records are searchable, but almost every record has an Origin Date equal to collection time, not the firewall's event time.
502 words, about 3 min2Password-Spray Alarm Storm
Your SOC has an Alarm Rule that fires when a single account has five failed logons in ten minutes. During a password-spray attempt, 1,200 failed logons hit 20 accounts from 300 source IPs in eight minutes.
508 words, about 3 min3Indexer Capacity and Tiered Retention
Your LogRhythm deployment has one Data Indexer with 18 TB usable capacity and ingests about 350 GB per day. All log sources currently have 90-day index retention.
457 words, about 2 min4Impossible Travel Rule with Service Accounts and NAT
An AI Engine rule named Impossible Travel fires when the same user authenticates from two countries within two hours. It produces about 60 alarms per day.
450 words, about 2 min5Repeated C2 Alarms Closed Without a Case
At 09:12, an alarm fires for a workstation beaconing to a known command-and-control domain. Over the next two hours, three more alarms fire for the same host with different destination domains.
455 words, about 2 min