2. What’s New in LogRhythm ® Version 5.1
Dear LogRhythm Customers,
I am pleased to introduce LogRhythm 5.1, the latest version of our award winning software. I think you will be
very happy with the extensive list of new features, capabilities, and improvements introduced. As I think you‟ll
come to appreciate, LogRhythm 5.1 is far from a typical minor release.
I think this release provides a great balance between core “blocking and tackling” capabilities with leading edge
innovation. We have long felt our log data collection and management infrastructure is second-to-none. We
continue to invest in this area by adding significant new log collection capabilities including native support for
SNMP traps and the latest version of Netflow. We have invested in improving our reporting infrastructure by
providing you the ability to create your own templates for determining exactly how you want a report to look.
In addition, you can select to use your company logo instead of ours for presentation in a report. We have
introduced new meta-data fields and significantly enhanced how some derived meta-data values are determined.
We also introduced a variety of new capabilities and improvements for easing the administration of your
LogRhythm deployment.
On more of the leading-edge innovation front, we have introduced a number of new features that I am
personally very excited about. We‟ve added Geolocation, the ability to see where hosts contained in log
messages physically reside. While some of our competitors have capabilities in this area, what excites me is
that we introduce Geolocation at the log and event layer whereas others have only focused at the event layer.
This provides great forensic context for every log message, context that provides a wealth of capabilities today
and more in the future. One of those capabilities is leveraged in another new feature called Network
Visualization. This is a very powerful visual analysis tool that provides a visual depiction of host-to-host
relationships across boundaries such as location.
One thing I feel has always differentiated us is our focus on filling the “visibility gaps”. While logs do provide
tremendous visibility on their own, often they don‟t provide the complete story. A core capability of the
LogRhythm System Monitor is to fill in these gaps at the endpoint. Two new powerful forensic visibility
capabilities have been introduced in 5.1. Process Monitor provides independent monitoring of processes
running on a host, when they start, and when they stop. Network Monitor provides independent monitoring of
listening services, inbound connections, and outbound connections to/from a host. These capabilities, combined
with existing endpoint monitoring features (i.e., File Integrity Monitor, DataLoss Defender), provide powerful
and unequaled forensic awareness and visibility at the host.
I hope you find LogRhythm 5.1 as exciting as we do. The LogRhythm engineering team has worked hard to
bring you another quality software release we are very proud of.
Sincerely,
Chris Petersen
CTO, VP Engineering, Co-founder
3. What’s New in LogRhythm ® Version 5.1
Overview
This document provides a brief description of new features and the most significant improvements introduced in
LogRhythm 5.1. Please refer to the Release Notes for the complete list of new features, improvements, modifications, and
known issues found in LogRhythm 5.1.
System Monitor Features and Improvements
New Operating System Support
We have added support for the following operating systems and Linux distributions:
HP-UX
Linux Debian
Linux Ubuntu
New Collection Interfaces, Capabilities, and Improvements
SNMP Trap Listener
The Windows System Monitor now includes an integrated SNMP Trap Listener. SNMP versions 1, 2 and 3 are
supported.
Netflow v9
The Windows System Monitor now supports Netflow v9 in addition to version 1 and 5. This provides support for the
latest version of Netflow shipping with Cisco products. Netflow v9 is also compatible with a variety of non-Cisco
products.
Recursive Flat File Collection
This capability allows for the collection of flat files matching a specific file name pattern that reside in root or child
directories. This is ideal for applications (i.e., web servers) that generate new directories containing log files on a daily or
weekly basis.
Integrated Syslog Server for UNIX and Linux System Monitor
The Windows System Monitor has always had an integrated Syslog Listener for receiving UDP and TCP based Syslog.
This same capability has been added in UNIX and Linux versions of the System Monitor. This is ideal for extending the
collection infrastructure in *NIX-centric environments where a single agent can collect and forward Syslog from the
entire environment.
Checkpoint Firewall/VPN Secure Configuration Verification (SCV) Support
The Windows System Monitor now supports collection of logs generated via Checkpoint‟s Secure Configuration
Verification module.
Windows Remote Event Log Connection Optimization
The number and frequency of new connections required to collect Event Logs remotely has been significantly reduced.
This results in overall performance improvements and reduces the number of logs written to the Windows Security Event
log as a result of remote collection activity.
4. What’s New in LogRhythm ® Version 5.1
Windows 1252 Codepage Extended ASCII support
Log messages containing Extended ASCII characters for languages included in the Windows 1252 codepage will be
collected and presented in native language. This includes the following languages:
Afrikaans Finnish Malay
Basque French Norwegian
Catalan Galician Portuguese
Danish German Spanish
Dutch Icelandic Swahili
English Indonesian Swedish
Faroese Italian
New Forensic Visibility and Awareness Features
A tenet of LogRhythm‟s vision is to provide profound visibility into the operating environment. We do this to help our
customers better understand the environment as it affects or is impacted by security, operations, and compliance/audit
events. In LogRhythm 5.1, we have introduced two significant features that provide forensic awareness into the activity
of a host.
Network Connection Monitor
This feature provides an audit trail of connections to and from the host on which the System Monitor is installed. We also
detect and log listening services. This is an optional capability available in System Monitor Lite that can provide constant
or on-demand visibility into how a host is interacting on the LAN, WAN and Internet.
Use Case
Deploy System Monitors and enable Network Connection Monitor on servers in a DMZ and alert on unauthorized
connections from DMZ hosts to hosts on the Internet or inside the trusted network.
Use Case
Deploy System Monitors and enable Network Connection Monitor on key servers and alert if observe network
connection initiating directly from the Internet or other unauthorized networks.
Process Monitor
This feature provides an audit trail of processes running on a host. Logs are generated whenever a new process or
program starts or a previously running process or program stops. This is an optional capability available in System
Monitor Lite that can provide constant or on-demand visibility into what processes and applications a host is running.
Use Case
Deploy System Monitors and enable Process Monitor on key servers. Create a whitelist of authorized programs
and alert if any program is observed not in the approved whitelist.
Use Case
Deploy System Monitors and enable Process Monitor on user desktops. Create a blacklist of high-risk
unauthorized programs (i.e., BitTorrent) and alert if such programs are observed on monitored hosts.
5. What’s New in LogRhythm ® Version 5.1
System Monitor Feature Matrix
System Monitor System Monitor
Lite Pro
Windows UNIX Windows UNIX
Timestamp Normalization X X X X
Collection Scheduling X X X X
Compressed Data Transmission X X X X
Encrypted Data Transmission X X X X
Flat File Log Collection X X X X
Recursive Flat File Log Collection New! 5.1 New! 5.1 New! 5.1 New! 5.1
Windows Event Log Collection X X
Remote Windows Event Log Collection X X
Integrated UDP Syslog Server X New! 5.1 X New! 5.1
Integrated TCP Syslog Server X New! 5.1 X New! 5.1
Integrated Netflow Server v1 and v5 X
Integrated Netflow Server v9 New! 5.1
Integrated SNMP Trap Receiver New! 5.1
Remote Checkpoint Firewall Log Collection (via LEA) X
Remote Cisco IDS Log Collection (via (SDEE) X
Remote Database Log Collection (UDLA) X
System Performance Monitoring X X X X
Data Loss Defender X X
File Integrity Monitoring X X
Process Monitor New! 5.1 New! 5.1 New! 5.1 New! 5.1
Network Connection Monitor New! 5.1 New! 5.1 New! 5.1 New! 5.1
User Activity Monitoring X X X X
New Meta-data Fields and Resolution Enhancements
In 5.1, new meta-data fields have been introduced. We also improve how some derived values are determined. These are
very significant changes in terms of what information is presented for every log message and event. These new fields and
enhancements provide immediate value from an analysis, reporting, and alerting standpoint. They have also been
implemented to prepare for additional automated and visual analysis capabilities planned in future releases.
NOTE: It is very important the Administrator of LogRhythm understands how the configuration of your
deployment affects how these fields are determined and as a result, their usefulness throughout the product.
Please refer to online help to learn more or contact support for additional information.
New Meta-Data Fields
Origin & Impacted Entity
The Origin Entity is the Entity to which the Origin Host is associated. The Impacted Entity is the Entity to which the
Impacted Host is associated. Because Entities typically map to physical operating locations or classes of systems, these
two fields provide very useful context in terms of understanding the Entity from which the action (i.e., attack, logon)
originated and the Entity impacted by the action. The introduction of these fields enable analysis, reporting and alerting
based on the Entity in which the Origin or Impacted Host resides.
6. What’s New in LogRhythm ® Version 5.1
Use Case
Report and alert on authentication activity across Entity boundaries. For instance if each entity were a separate
business unit, this report would be of authentications between business units.
Origin & Impacted Network
The Origin Network is the network to which the Origin Host is associated. The Impacted Network is the Network to
which the Impacted Host is associated. These two fields provide very useful context when analyzing Host-to-Network
and Network-to-Network relationships. The introduction of these fields enable analysis, reporting and alerting based on
the Network in which the Origin or Impacted Host resides.
Use Case
Report and alert on network traffic between untrusted and trusted networks. For instance, if you had created a
DMZ Network and a Production Servers Network, you could alert on any activity originating from the DMZ
Network targeting any host in the Production Servers network.
Origin & Impacted Zone
The Origin Zone is the Zone (Internal, External, DMZ) in which the Origin Host resides. The Impacted Zone is the Zone
in which the Impacted Host resides. The introduction of these fields enable analysis and reporting based on the Zone in
which the Origin or Impacted Host resides.
Origin & Impacted Location
The Origin Location is the location in which the Origin Host resides. The Impacted Location is the location in which the
Impacted Host resides. Location can be presented or considered for filtering at the Country, Region, or City level. These
fields are introduced as part of the new Geolocation feature described below and enable analysis, reporting, and alerting
based on geographic location
Meta-Data Field Resolution Enhancements
The approach for deriving the following fields has been modified and improved in LogRhythm 5.1. Although these
improvements should not negatively affect an existing deployment, it is important to understand how these fields are
determined based on your configuration.
Known Origin Host Origin Zone*
Known Impacted Host Impacted Zone*
Known Origin Network* Direction
Known Impacted Network*
* NOTE: Although these fields are listed as new in 5.1, the fields did exist in previous versions. However, they were
minimally exposed or completely hidden from the end-user. In 5.1 how these fields are determined has changed
and the fields are visible and usable directly by the end-user.
Log Analysis Features and Improvements
Geolocation
Ever wonder where an attack originated from geographically or where data was sent to? With LogRhythm Geolocation
wonder no more. LogRhythm‟s Geolocation capability can provide city level location awareness for every Origin and
Impacted Host represented in a log message. This capability is implemented at the Log Manager layer meaning EVERY
log collected by LogRhythm can have Geolocation information assigned. Geolocation information is assigned to a log
based on static assignment and automatic resolution.
Static location assignment is available to all 5.1 users. This capability allows you to assign specific locations to Known
Hosts and Networks that will be used during log processing to assign location to Origin and Impacted Hosts.
7. What’s New in LogRhythm ® Version 5.1
Automatic location resolution requires a separate software license purchased on an annual subscription basis. Automatic
location resolves public IP addresses to the last known physical location. The list of last known locations is provided via
the LogRhythm knowledge base and updated periodically. Country-level resolution accuracy is 99.9% with city level
resolution accuracy around 95%. Annual license fees for this functionality are $1,000, $2,500 and $5,000 for
LR500/LRX1, LR1000/LRX2 and LR2000/LRX3 XM and LM models respectively. If you are interested in licensing this
capability, please contact your LogRhythm Customer Relationship Manager at (303) 413-8745.
Geolocation information is available in Personal Dashboard, Investigator, and Tail. It is also available in Reports
targeting the Event Manager or Log Managers. Geolocation information is not currently available in Log Miner or
LogMart. Geolocation criteria can be specified for searches and for reports. Criteria can also be specified for Alarm
Rules and Global Log Processing Rules.
Use Case
Report and alert on remote authentication activity originating from locations outside expected states and/or
countries.
Use Case
Report and alert on data transfers from sensitive servers to locations outside known and authorized geographic
operating locations.
Network Visualization
A new tool has been added to Investigator for visually describing the relationships between hosts as represented in log
data. This tool maps the relationships between hosts as contained within configurable containers such as Zone (i.e., DMZ,
Internal), Location, and Network. Failure and security conditions are depicted with red links. Line width represents the
relative amount of activity between related hosts or host containers. “Mousing” over hosts or host containers provides
summary statistics such as kilobytes of traffic, packet counts, and log counts. This tool provides a revolutionary new way
of looking at log data containing information on host-to-host interactions.
The following screenshot depicts Port 80 and 443 traffic.
8. What’s New in LogRhythm ® Version 5.1
New Investigator and Personal Dashboard Charts
Two new charts have been added to Investigator and Personal Dashboard:
Logs by Day and Hour
Logs by Day of Week and Hour of Day
Use Case
Analyze VPN activity by day and hour of day to visually see the frequency and pattern of VPN authentications.
Identify anomalous trends in VPN activity based on daily averages and/or time-of-day.
9. What’s New in LogRhythm ® Version 5.1
New Investigator Meta-Data Charts
Three new charts have been added to the Meta-data Statistics tool within Investigator. These three charts provide a visual
display of every unique meta-data value compared to all other values across the number of logs, the amount of data
sent/received, and the number of packets sent/received. These charts are designed to provide visual trending and easy
identification of anomalous activity. Following is a screenshot of the three new charts for a meta-data statistics pain
configured to show Impacted Host.
Impacted Hosts by Log Count
Impacted Host by KBytes In/Out
Impacted Host by Items In/Out
Time-based Drill-Down Improvements
An improved drill-down mechanism has been introduced for all charts that show activity by time. In previous versions of
LogRhythm, you were able to drill down on an individual point representing a time range. In 5.1, this capability remains
and added is the ability to select a range of time. In any time-based chart simply click and hold the left mouse button and
drag the mouse to the right until at the end of the range. Release the left mouse button and double click into the
highlighted area to drill-down.
10. What’s New in LogRhythm ® Version 5.1
Reporting New Features and Improvements
Custom Report Templates
You can now create your own report templates if the provided out-of-the box templates do not suit your organization‟s
needs. Both detail and summary templates can be created via a Wizard based tool. All log message properties can be used
with a variety of grouping and sorting options. The result is near infinite possibilities in terms of what you want included
in a report. This capability combined with LogRhythm‟s previous reporting capabilities provides near limitless reporting
options.
11. What’s New in LogRhythm ® Version 5.1
Custom Report Branding
You can now replace the LogRhythm logo that is printed on reports to an image of your choosing. This is done by
selecting File > Options from the Report Center and checking the „Use Custom Logo‟ checkbox.
Event Management New Features and Improvements
Batch Alarm Record management
You can now select multiple alarms in Alarm Viewer and edit their status/comments in batch.
12. What’s New in LogRhythm ® Version 5.1
Personal Dashboard Shared Filters
The filtering function within Personal Dashboard has been significantly improved. Filters are easier to create and manage
with more powerful filtering options. In addition, Personal Dashboard Filters can be shared across the LogRhythm user
base.
Use Case
Configure shared Personal Dashboard Filters for security analyst team and helpdesk operations. When these
users access their Personal Dashboard, the events displayed are automatically filtered based on their job
function.
Administration New Features and Improvements
Batch System Monitor Agent Editing
All properties of a System Monitor can now be edited in batch. This simplifies the administration of deployments where
large numbers of System Monitors are deployed.
Batch Host and Network Editing
Hosts and Networks can now be edited in batch. The following properties are available for batch editing:
Zone
Location
Risk Level
Threat Level
Right Click Add Host
Ever wished you could add a host from a log message you are analyzing to LogRhythm‟s list of Known Hosts? Wish no
more. A new context menu is available off Log/Event lists. Simply select the log or event containing the host you wish to
add and select to add Origin or Impacted Host as a Known Host.
•
LogRhythm Headquarters LogRhythm EMEA LogRhythm Asia Pacific Ltd.
3195 Sterling Circle Siena Court, The Broadway 8/F Exchange Square II
Boulder, CO Maidenhead Berkshire SL6 1NJ 8 Connaught Place, Central,
80301 United Kingdom Hong Kong
303-413-8745 +44 (0) 1628 509 070 +852 2297 2812
