LogRhythm SIEM Platform Administration
What the exam tests
Platform administration covers the LogRhythm deployment model and day-2 tasks that keep it healthy: component roles, licensing, user and role security, entity structure, retention, backup, and upgrades.
Core rules
- Know the component roles: Platform Manager is the management web UI; Data Processor parses and normalizes; Data Indexer stores indexed data; AI Engine evaluates rules; System Monitor collects from hosts; GlusterFS provides distributed storage.
- A distributed deployment separates roles; an all-in-one combines them. Placement affects throughput and fault tolerance.
- Licensing is capacity-based (MPS); monitor license usage in Platform Manager.
- Use roles and groups for least privilege; separate admin, analyst, and read-only duties.
- Retention is set per log source type or entity and affects storage planning; index retention differs from archive.
- Back up configuration and verify restore, not just backup completion.
Worked example
A Data Indexer reports low disk. Reasoning: check retention and index size first; confirm whether a recent retention change or a log surge caused growth; verify GlusterFS health and replication; only then add capacity. Changing retention without checking legal and archive requirements is a common error.
Traps
- Treating Platform Manager as the same console as the Client Console.
- Forgetting that Entity structure drives data visibility and reporting.
- Assuming an agent is required for every source; syslog and file collection are alternatives.
- Changing retention to fix disk without confirming archive and compliance needs.