topic Re: Cortex XSOAR integration with Logrhythm SIEM in Cortex XSOAR Discussions

Cortex XSOAR integration with Logrhythm SIEM

PShastrakar — Fri, 02 Feb 2024 07:06:11 GMT

We were recently having use case for a SIEM integration with cortex XSOAR. We have an on-premise LogRhythm SIEM server which we need to integrate with our Cortex XSOAR.

I have gone through the official XSOAR documentation for the integration but it wasn't of much help. Has anyone done the integration and made any playbooks?

Kindly share the process steps and if you had faced any errors please share how you overcame them.

Thanks !

#CortexXSOAR

Re: Cortex XSOAR integration with Logrhythm SIEM

RahulVijaydev — Fri, 02 Feb 2024 21:52:08 GMT

Hello,

What problems are you currently experiencing with the integration setup? Can you share some context around the issue/error you are seeing?

Thanks,

Rahul Vijaydev

Re: Cortex XSOAR integration with Logrhythm SIEM

PShastrakar — Sat, 03 Feb 2024 05:24:05 GMT

We have deployed LR SIEM on-prem, so we are facing multiple issues around the integration. We have done some trial and error so the errors have sometimes changed. But the majority errors were,

- Issue with connectivity to the on-prem server URL. We have verified that the server is reachable from the network. ( <requests.exceptions.ConnectionError>)

- API calls. While running the test it give either Error in API call [401] or [404]. We have followed the document for this one & created REST API from LR console, still it is giving an error.