Forum Discussion

Antony_Hawkins's avatar
Antony_Hawkins
Icon for Employee rankEmployee
2 years ago

LM Portal Integration Events - EventSource to alert on Alerting Integration failures

What: It’s an EventSource that calls recent Alert Integration events from the LM API (endpoint: /setting/integrations/auditlogs) , and alerts on any non-2xx responses. Why: Mostly because these fa...
Antony_Hawkins's avatar
Antony_Hawkins
Icon for Employee rankEmployee
2 years ago

You could create a datasource to query the logs and push them to your SIEM’s API log ingestion endpoint (assuming it has one). You would want to use the script cache to carry forward the timestamp of the last log sent during the previous poll. You can use this as an example.

That’s for Audit logs or Collector logs, I presume?

There is no API endpoint to extract logs from LM Logs.

For the Audit Logs question, there is also a Community LogSource, “LM Audit Logs”, Locator: 43W643, that may be of interest.