LogRhythm LRSA study plan

Map the LogRhythm deployment architecture by diagramming the roles of Data Processor, Data Indexer, AI Engine, and Platform Manager from memory

Install or access a lab instance and log in to the Client Console, identifying each main module and its purpose

Configure a new user account with a role and confirm which permissions that role grants

Document the default port numbers and services used for inter-component communication

Configure system-level settings including time zone, retention, and storage policies in a lab

Create and apply a custom user role with least-privilege permissions, then test access with a second account

Practice backing up and restoring a configuration element, recording each step

Review license and health status pages and interpret what each indicator signals

Register a new log source type and a log source in the lab, binding it to the correct entity

Configure a collection method (agent or syslog) and verify events arrive with correct parsing

Use log source monitoring to confirm healthy event flow and diagnose a deliberately broken source

Classify log sources by criticality and assign them to the correct entity hierarchy

Create a custom log source type or adjust parsing for a non-standard format

Apply log source filters and rate limits and explain their operational tradeoffs

Configure entity and network hierarchy to support accurate alarming and reporting

Validate timestamp normalization and time-zone handling across at least two sources

Explain the rule pipeline from log processing to alarms and identify where each rule type executes

Create a custom correlation rule that fires on a defined multi-event condition

Tune a noisy rule using suppression, thresholds, or exclusions and measure the before/after event count

Configure an alarm and assign it to the correct notification pathway

Build a dashboard or report that surfaces top alarm trends over a defined period

Configure a notification target and confirm delivery of a test alarm

Create a case from an alarm and document the investigation steps taken

Define a false-positive classification workflow and apply it to three real alarms

Configure a scheduled report and verify it renders with accurate data

Use search and drill-down to reconstruct a timeline for a simulated incident

Document an incident response checklist covering triage, escalation, and evidence retention

Review platform health dashboards and identify at least two early-warning indicators

Complete a full timed practice exam and score each domain separately

Re-review the two weakest domains by redoing hands-on labs for those areas

Summarize key configuration parameters, rule types, and reporting concepts into a one-page cheat sheet

Verify lab environment stability and confirm all deliverables are collected for final review