LogRhythm LRSA key terms

A configured representation of a device or application that sends log data to the platform, including its type, parsing method, and collection details. Each source must be registered before its logs can be normalized and analyzed.

A template that defines how a category of device or application logs is recognized, parsed, and classified. It bundles message definitions, sample logs, and default processing behavior shared by many individual log sources.

Software installed on a host to collect logs locally and forward them to a Data Collector or directly to the platform. It can read files, Windows event channels, and other local sources without requiring remote access.

A service that receives log traffic from agents, syslog senders, or other feeds and passes it to the platform for processing. It buffers and forwards events and can be deployed separately from the main platform nodes.

The mechanism by which events reach the platform, such as an installed agent, syslog reception, file transfer, or API ingestion. Choosing the right method affects reliability, parsing, and which fields are available.

A structured pattern that describes the format of a specific log message so the parser can extract fields such as source address, user, and result. It is the foundation of accurate normalization for a log source type.

The process of mapping raw vendor-specific log fields into a common schema of standard fields. Normalized data enables consistent searching, correlation, reporting, and alarm logic across heterogeneous sources.

A rule in the Message Processing Engine that evaluates parsed events and can enrich, modify, drop, or route them. Rules run in order and are commonly used to adjust fields or suppress unwanted noise before storage.

The normalized, platform-standard record produced after a raw log is parsed and mapped. It carries standard fields like origin, user, object, and result, and is what correlation rules and searches operate on.

A configuration that prevents matching events from being stored or counted, typically to reduce noise from repetitive or low-value messages. Suppression is applied during processing and should be scoped narrowly to avoid hiding evidence.

The set of rules governing how long raw logs and normalized events are kept before deletion or archival. Retention is usually tiered, with recent data online and older data moved to cheaper storage.

The process of moving older log and event data from primary storage to secondary or offline storage while keeping it recoverable for investigations and compliance. Restores may require re-indexing before the data is searchable.

The administrative console used to configure and manage platform components, including log sources, agents, and system settings. It is distinct from the analyst-facing client used for search and incident work.

The analyst-facing application used to search events, review alarms, manage cases, and run reports. It provides the primary workspace for day-to-day monitoring and investigation activities.

A logical grouping that represents an organizational unit, such as a department, site, or customer, used to scope data access and reporting. Users are granted rights per entity, enabling multi-tenant or segmented visibility.

A named set of permissions assigned to user accounts that determines which functions and data they can access. Roles typically separate administrative configuration duties from analyst monitoring and response duties.

A monitoring view that reports the status of platform services, data flow rates, and processing backlogs. Administrators use it to detect collection gaps, queue buildup, and failing components before they affect detection.

A buffering mechanism that holds events between collection and processing so that bursts or brief outages do not cause data loss. Persistent queue growth is a common warning sign of processing bottlenecks.

A logical condition evaluated against normalized events to detect activity of interest. Rules define the event criteria, grouping, and thresholds that determine when an alarm should be generated.

A rule whose match produces an alarm for analyst review, typically combining event criteria with grouping and a threshold. It defines severity, notification behavior, and the alarm's link to response workflow.

A notification generated when a rule's conditions are satisfied, presented to analysts for triage and response. Alarms carry severity, related events, and status, and are tracked through their lifecycle to closure.

The process of evaluating multiple events together, often across sources or over time, to detect patterns that individual events would not reveal. Correlation rules express these patterns as conditions, groupings, and thresholds.

A count or rate condition that must be met within a defined time window before a rule fires. Thresholds reduce noise by requiring repeated or aggregated activity rather than a single matching event.

A rule setting that partitions matching events by a field, such as source host or user, so thresholds and alarms are evaluated separately per value. It prevents unrelated activity from being merged into one alarm.

An alarm or detection that fires on legitimate activity rather than a genuine threat. Reducing false positives through tuning, suppression, and better thresholds is a core part of maintaining analyst trust in detection.

The ongoing adjustment of rules, thresholds, and suppressions to improve detection accuracy and reduce noise. Tuning is driven by alarm review outcomes and should be documented to preserve detection intent.

The lifecycle state of an alarm, such as open, in review, or closed, which indicates where it sits in the response workflow. Status changes are usually recorded with an owner and notes for auditability.

The initial assessment of an alarm to determine whether it represents a real incident, a benign event, or a duplicate. Triage prioritizes work by severity and impact and decides the next response action.

The workflow for grouping related alarms and evidence into a single investigation record with notes, tasks, and status. Cases provide an auditable trail of response actions from detection through resolution.

A confirmed security event requiring coordinated response, often represented by a case that consolidates related alarms and evidence. Incidents are tracked to resolution and may trigger notification and reporting obligations.

A documented sequence of response steps for a class of incident, guiding analysts through containment, investigation, and recovery. Playbooks standardize decisions and make response outcomes more consistent and measurable.

The query interface used to retrieve events and alarms by time range, field values, and keywords. Effective searching depends on normalized fields and on understanding how filters and time scopes are applied.

A configurable visual display of charts, counts, and status indicators built from event and alarm data. Dashboards give monitoring teams at-a-glance awareness of trends and current system conditions.

A scheduled or on-demand output that summarizes events, alarms, or operational metrics over a defined period. Reports support compliance evidence, trend analysis, and management visibility into security operations.

A reusable collection of values, such as IP addresses, users, or domains, referenced by rules to include or exclude activity. Lists centralize maintenance so a change applies everywhere the list is used.

Built-in reference content that explains log sources, message formats, and detection logic, helping administrators understand parsing and rule behavior. It is a starting point for configuration and troubleshooting rather than a guarantee of coverage.

The configuration that determines how timestamps from sources and the platform are interpreted and displayed. Mismatched time zones cause events to appear out of order and can break time-window correlation.

The addition of context to events, such as asset identity, user details, or geolocation, to make detections and investigations more meaningful. Enrichment can come from internal lookups or external threat intelligence feeds.