Skip to content

Integrating SailPoint with LogRhythm

LogRhythm is a Security Information and Event Management (SIEM) platform that centralizes log collection, threat detection, and security operations workflows. The LogRhythm Admin Service exposes administrative APIs for managing TrueIdentities, collections of identifiers (such as logins and email addresses) that comprise a single identity in the deployment. This document provides instructions to configure a new direct connection to a LogRhythm source. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The LogRhythm connector supports the following:

Account Management

  • Aggregate Users

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

  • Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
  • Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Prerequisites

Ensure the following prerequisites are met before proceeding with the configuration:

  • An administrator account with permission to issue and manage API access tokens in the LogRhythm deployment.
  • A valid API key and bearer access token issued from LogRhythm.
  • For more information about token issuance, authentication details, and endpoint specifications, refer to the LogRhythm Register Third-Party Applications documentation.

Required Permissions

  • The API key and access token must be issued by a LogRhythm administrator who can register third-party applications and manage API tokens in the LogRhythm Admin Service.
  • A LogRhythm administrator role is required to mint and rotate the credentials used by this connector.
  • For more information about the LogRhythm API, refer to the following resources:

Note

The linked document is not maintained by SailPoint and is subject to change without notice.