LogRhythm SIEM
Log and alert platforms (SIEM) — LogRhythm
What is this product?
A SIEM built around field-based search (Host, User, Origin IP) instead of a complex query language, and it prioritises alerts with a Risk-Based Priority score.
About the company
A US SIEM vendor focused on mid-sized organisations, merged with Exabeam in 2024, known for simplifying analyst work rather than demanding complex queries.
What does an analyst do inside it?
- Opens the Case and reads the events attached to it.
- Searches with ready-made fields such as `Host: FIN-WS-014`.
- Runs a SmartResponse action to isolate a host or block an address.
- Changes case priority, or closes it with a written verdict.
Its search language
These examples are written in the syntax the product itself accepts.
- Host: FIN-WS-014
- Result: failure User: admin
The field names it uses
- Log Source
- Host
- User
- Origin IP
- Impacted IP
- Common Event
- Result
Practise it now
Pick this product inside the simulator and the field names, search language, severity wording and response actions all switch to match how it works.
Open the simulatorWhere does it show up in the job market?
Common at mid-sized companies and in manufacturing. Friendly to beginners because searching feels closer to filtering than to coding.
Tools in the same category
The content is educational and follows the product's style. ShiftZero is not affiliated with the vendor and does not run its software.