### Enable and Start IPsec Service Source: https://docs.logrhythm.com/lrsiem/docs/configure-ipsec-on-linux-machine Enables the IPsec service to start on boot and starts the service immediately. ```bash systemctl enable ipsec ``` -------------------------------- ### Start LogRhythm System Monitor Service Source: https://docs.logrhythm.com/lrsiem/docs/startup-and-shutdown-system-monitors-on-linux Use this command to start the LogRhythm System Monitor service if the automated startup scripts were installed. ```bash /etc/init.d/scsm start ``` -------------------------------- ### Start Stunnel Client and Server Source: https://docs.logrhythm.com/lrsiem/docs/configure-logrhythm-dpawc Manually start the stunnel application with its configuration file. This must be done each time the machine restarts. ```bash C:\Program Files\LogRhythm\LogRhythm FIPS\stunnel.exe C:\Program Files\LogRhythm\LogRhythm FIPS\lrdpawc_stunnel.conf ``` -------------------------------- ### Verify Installed LogRhythm Packages Source: https://docs.logrhythm.com/lrsiem/docs/add-a-data-indexer-node List all installed packages on the system and filter for LogRhythm related components. This command is used to verify that all necessary LogRhythm services, tools, and libraries are present and at the correct versions after installation or upgrade. ```bash sudo yum list installed | grep -i logrhythm ``` -------------------------------- ### Manually Start LogRhythm System Monitor Source: https://docs.logrhythm.com/lrsiem/docs/startup-and-shutdown-system-monitors-on-linux If control scripts are not installed, manually start the scsm process as a background task from its directory. ```bash ./scsm & ``` -------------------------------- ### Execute PreInstall.sh Script Source: https://docs.logrhythm.com/lrsiem/docs/add-a-data-indexer-node Run the PreInstall.sh script to set up password-less SSH authentication for the logrhythm user. ```bash sh /home/logrhythm/Soft/PreInstall.sh ``` -------------------------------- ### Run Data Indexer Installer Source: https://docs.logrhythm.com/lrsiem/docs/add-a-data-indexer-node Execute the Data Indexer installer with the hosts file, plan.yml, cluster name, and the --force switch. The --force switch is required when upgrading to the same version. ```bash sudo sh LRDataIndexer-.x86.64.run --hosts --plan --es-cluster-name --force ``` ```bash sudo sh LRDataIndexer-10.0.0.121-1.x86_64.run --hosts /home/logrhythm/Soft/hosts --plan /home/logrhythm/Soft/plan.yml --es-cluster-name mycluster --force ``` -------------------------------- ### Query with Escaped Special Character (Wildcard) Source: https://docs.logrhythm.com/lrsiem/docs/basic-queries Escape special characters like '*' with a backslash (\) when they are part of the term value. This example searches for usernames starting with 'jon'. ```lucene login:"jon\*" ``` -------------------------------- ### Check Elasticsearch Service Status Source: https://docs.logrhythm.com/lrsiem/docs/add-a-data-indexer-node Use this command to get the current status of the Elasticsearch service on a specific node. This is useful for initial troubleshooting if services are not starting as expected. ```bash sudo systemctl status elasticsearch ``` -------------------------------- ### FIM Configuration for *.exe Files Source: https://docs.logrhythm.com/lrsiem/docs/create-inclusions-and-exclusions-for-fim This configuration example shows how to monitor all *.exe files within a directory structure up to a specified depth. Changes to matching files will be recorded based on the monitored item's configured flags. ```plaintext *.exe ``` -------------------------------- ### Install Libreswan and Dependencies Source: https://docs.logrhythm.com/lrsiem/docs/configure-ipsec-on-linux-machine Installs necessary development packages and Libreswan on a Red Hat-based system. Ensure packet forwarding is enabled before proceeding. ```bash yum -y update yum -y install libnss3-dev libnspr4-dev pkg-config libpam0g-dev libcap-ng-dev libcap-ng-utils libselinux1-dev libcurl4-nss-dev flex bison gcc make yum install wget ``` ```bash yum install libreswan ``` -------------------------------- ### Match Start of String/Line with ^ Source: https://docs.logrhythm.com/lrsiem/docs/regular-expression-characters-and-practices Use ^ to assert the position at the start of the string or the start of a line in multi-line mode. Requires the multi-line flag for line-based matching. ```regex ^ ``` -------------------------------- ### CrowdStrike FalconHost Executable with Arguments Example Source: https://docs.logrhythm.com/lrsiem/docs/command This log entry from CrowdStrike FalconHost demonstrates an executable with its associated command-line arguments. ```log 12 15 2016 00:19:05 1.1.1.1 CEF:0|CrowdStrike|FalconHost|1.0|ScanResults|AV Scan Results In A Detection Summary Event|3| externalID=022222222222222222ea584f3783f5b1eee9 cn2Label=ProcessId cn2=1482087830222222 shost= USABLDRRECFLOW01suser=Pete.Store fname=upnp.exe filePath=\\Device\\HarddiskVolume1\\Users\\pete.store\\AppData\\Local\\Temp fileHash=13804f8dc4e72ba103d5e34de895c9db cs1Label=CommandLine cs1="C:\\Users\\ALVINF~1\\AppData\\Local\\Temp\\upnp.exe" -a 1.1.1.1 1604 1604 TCP sntdom=safaware cs2Label=ScanResultEngine cs2=TrendMicro cs3Label=ScanResultName cs3=TROJ_GEN.R0FBC0CI116 cn4Label=ScanResultVersion cs4=1.1.1.12 cs6Label=FalconHostLink cs6=https://falcon.crowdstrike.com/activity/detections/detail/02c60e7a579b4fea584f3783f5b1eee9/222222222 cn3Label=Offset cn3=1066392 ``` -------------------------------- ### Verify Installed LogRhythm Data Indexer Version Source: https://docs.logrhythm.com/lrsiem/docs/add-a-data-indexer-node Check the currently installed version of the LogRhythm Data Indexer on an existing node. This helps ensure you are using the correct version before proceeding with the installation. ```bash cat /usr/local/logrhythm/version ``` -------------------------------- ### Install FIPS Packages on CentOS Source: https://docs.logrhythm.com/lrsiem/docs/put-linux-centos-into-fips-mode Installs the 'prelink' and 'dracut-fips' packages required for FIPS mode. ```bash $ yum -y install prelink dracut-fips ``` -------------------------------- ### Change Directory to Soft Folder Source: https://docs.logrhythm.com/lrsiem/docs/add-a-data-indexer-node Navigate to the Soft directory where the installer files are located. ```bash cd /home/logrhythm/Soft ``` -------------------------------- ### Start LogRhythm Echo Service via Command Line Source: https://docs.logrhythm.com/lrsiem/docs/install-or-upgrade-logrhythm-echo Use this command to start the LogRhythm Echo service from the command line. Ensure you have administrative privileges. ```bash sc start LogRhythmECHO ``` -------------------------------- ### Proofpoint Spam Firewall Command Example Source: https://docs.logrhythm.com/lrsiem/docs/command In this Proofpoint Spam Firewall log, 'run' is identified as the command, distinct from the process. ```log 12 07 2011 14:19:10 1.1.1.1 Dec  7 14:19:10 filter_instance1 rprt s=11huq2222 m=1 x=pB7JJAlE02222 mod=access cmd=run rule=spamsafe duration=0.000 ``` -------------------------------- ### Example Syslog Data Received Source: https://docs.logrhythm.com/lrsiem/docs/system-monitor This is an example of the raw syslog message received by the LogRhythm Windows Agent. ```text <13>Dec 12 11:00:00 This is a syslog message ``` -------------------------------- ### Display Upgrade Checker Help Source: https://docs.logrhythm.com/lrsiem/docs/dx-upgrade-checker View the available commands and options for the UpgradeChecker executable. This is useful for understanding the tool's capabilities. ```powershell .\UpgradeChecker.exe --help ```