Fully Manage AI Engine Rules with SIEM 7.26.0!

LogRhythm SIEM 7.26 expands the AI Engine REST API with two new capabilities that complete the rule management lifecycle.

Administrators can now create fully formed AIE rules, including top-level rule properties and initial rule block configurations, entirely through the API. Combined with the rule block management endpoints introduced in LogRhythm SIEM version 7.25.0, security teams can automate the complete end-to-end lifecycle of a threat detection rule, from initial creation through ongoing configuration and tuning, with no manual console interaction required. This enables the rollout of new detection rules across client deployments in response to active incidents, and allows security engineering teams to manage their entire threat detection catalog through automated CI/CD pipelines.

POST /lr-aie-api/aie/rules

Additionally, a new performance statistics endpoint also provides real-time metrics for any AIE rule, including CPU cost, memory consumption, and current and average event processing rates, data that was previously only accessible through the Windows Client Console. Administrators can integrate these metrics into external monitoring platforms, set up automated alerts for resource-intensive rules, and measure the performance impact of rule tuning changes without leaving a web-based workflow.

GET /lr-aie-api/aie/rules/stats/{engineId}