---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# LogRhythm Overview

# LogRhythm Overview {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The mapping flexibility of this integration provides an analyst with visibility to
events and related alarm data that can be integrated into ServiceNow AI Platform security
incidents for further investigation and remediation.

Alarm profiles are created in your ServiceNow AI Platform instance to customize how
different LogRhythm alarm fields are displayed on a ServiceNow AI Platform
security incident. A default mapping of alarm fields is provided, which can be edited to meet
customer-specific needs.

The following figure is an example of a customer environment. When an event triggers the
creation of a security incident in the ServiceNow AI Platform® instance, a request is
sent from your ServiceNow AI Platform® instance to pull alarms from the LogRhythm Client Console either through a MID Server or even without it.

The REST API key is used by the ServiceNow AI Platform® to authenticate with the LogRhythm Client Console. This connection allows your ServiceNow AI Platform
instance to pull individual LogRhythm alarms based on configured profiles.

The REST API is used to gather message details not accessed by the REST API.
Figure 1. LogRhythm integration

## Key features {#ovrview-logrhythm__section_dcn_fxd_kfb}

This integration includes the following key features:

* Flexibility to create multiple alarm profiles for different alarm types such as Phishing and Malware.
* Drag-and-drop mapping of LogRhythm alarm field values to associated SIR security incident fields.
* A Preview of the SIR security incident layout based on LogRhythm sample alarms.
* Ingest historical alarms as well as ongoing future alarms on configurable intervals.
* Automated LogRhythm alarm closure upon SIR incident closure. A URL to the SIR incident as well as an incident ID is provided for easy reference.
{#ovrview-logrhythm__ul_b2h_2bx_22b}

## Supported releases of the ServiceNow AI Platform {#ovrview-logrhythm__section_xbv_vqz_rfb}

This integration is compatible with the Quebec or later releases of the ServiceNow AI Platform®.

## Supported versions of LogRhythm {#ovrview-logrhythm__section_ndn_5df_wfb}

This integration is compatible with LogRhythm 7.8 or later. The earlier
versions aren't supported due to API limitations.  
Note:  
The following topics are numbered. For a smooth installation and to help you verify expected results, follow the topics in the order they're presented.
1. [Set up the REST API](https://servicenow-prod.fluidtopics.net/9X98bDy4WgqF25b8UZptBQ)  
   You use the LogRhythm REST API key to gather additional event details for individual alarm fields. The API key provides details that are unavailable using the LogRhythm REST API.
2. [Install the plugin and configure LogRhythm](https://servicenow-prod.fluidtopics.net/tleO5XpJYM0z8IO~ygMKsA)  
   Before you run the integration on your instance, complete the installation and configuration steps so the application properly integrates with Security Operations on the ServiceNow AI Platform®.
3. [Creating an alarm profile for LogRhythm](https://servicenow-prod.fluidtopics.net/pTd45HTJsf27GVH~vFHJ~w)  
   In an alarm profile that you create and name, you specify which alarms you want to pull from the LogRhythm Client Console. You also define how they are mapped to fields on a ServiceNow AI Platform security incident.
4. [Additional configurations for the LogRhythm integration](https://servicenow-prod.fluidtopics.net/UQ1vp8D~JfV8oI5BA9k5Ug)  
   Use the LogRhythm Integration Settings to modify the preset system and troubleshooting properties as per you requirements.
5. [Troubleshooting the LogRhythm integration](https://servicenow-prod.fluidtopics.net/_j9_Lu5J3vewVENwsyjKYQ)  
   Troubleshoot connectivity and alarm ingestion issues.