Analytics
What the exam tests
Analytics tests how LogRhythm turns normalized events into detections: AI Engine rule logic, rule types, severity and confidence, and tuning.
Core rules
- The AI Engine evaluates normalized events against AI Engine rules. Rule types include event, threshold, sequence, and correlation.
- Sequence rules require ordered events within a time window; threshold rules count events; correlation rules combine conditions.
- AI Engine rule matches are consumed by Alarm Rules to create actionable Alarms.
- Rule settings include severity, confidence, rate, and suppression. Tuning reduces false positives without deleting the rule.
- Use drill-down from an alarm to inspect underlying events and confirm whether normalization is correct.
- Analytics depends on clean parsing; a parser bug looks like a detection bug.
Worked example
A brute-force rule fires constantly for a service account. Reasoning: check whether the account is expected to authenticate from many hosts; inspect events for failed versus successful logons; confirm the rule threshold and time window; add a scoped exception for the service account, or narrow the rule to external source IPs. Do not disable the rule globally.
Traps
- Confusing AI Engine rules with Alarm Rules.
- Setting severity only on the AI Engine rule while the Alarm Template controls alarm severity.
- Building rules on unparsed or misnormalized fields.
- Using broad suppression that hides real activity instead of scoped exceptions.
- Forgetting that rule order and time windows change sequence results.