LogRhythm integration release notes

  • Release version: Store
  • Updated June 11, 2026
  • 3 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of LogRhythm integration release notes

    The LogRhythm integration for ServiceNow Security Operations has undergone multiple updates to enhance security, usability, and functionality. This integration enables customers to ingest and manage security alarms from LogRhythm SIEM within ServiceNow, automate incident creation and closure, and maintain accurate configuration item mappings. The release notes detail version-specific fixes, feature additions, and improvements from 2018 through 2026.

    Show full answer Show less

    Key Features and Improvements

    • Security Enhancements: Upgraded dictionary-level fields to Strict Read-Only and replaced broad admin roles with the more restrictive snsi.admin role to enforce least-privilege access control.
    • Incident Management: Automated creation of Security Incident Records (SIRs) from LogRhythm alarms with improved field mapping, including support for multi-valued Configuration Item and Observable fields when multiple raw events are involved.
    • Alarm Profiles and Mapping: Support for multiple alarm profiles (e.g., phishing, malware) with drag-and-drop mapping of LogRhythm alarm fields to SIR fields. Includes a preview feature to validate incident layouts based on sample alarms.
    • Data Ingestion and Scheduling: Ability to ingest historical and ongoing alarms at configurable intervals, with fixes applied to scheduling scripts and date format handling to ensure reliable data retrieval.
    • UI and Workflow Updates: Migration of workflows to Flow Designer for enhanced automation, minor UI improvements to profile mapping pages, and added related lists and navigation links on incident forms to view raw base events and drilldowns.
    • API and Integration Improvements: Migration from REST to SOAP APIs, introduction of alarm By ID API, and improved error handling and logging for better integration stability.
    • Compliance and Compatibility: Recertification for ServiceNow New York version and resolution of password policy and access issues affecting security analysts.

    Practical Outcomes for ServiceNow Customers

    • Enhanced security through stricter access controls and read-only enforcement reduces risk of unauthorized changes in the integration.
    • Reliable and automated incident creation from LogRhythm alarms ensures timely and accurate security incident management within ServiceNow.
    • Improved mapping flexibility and user interface features simplify configuration and validation of alarm-to-incident field mappings.
    • Support for multiple alarm profiles and historical data ingestion allows tailored and comprehensive alarm management strategies.
    • Upgraded workflows and APIs provide better integration performance and easier maintenance.
    • Fixes to scheduling, data formats, and error handling improve overall stability and user experience.

    Version history for the Security Operations LogRhythm integration on the ServiceNow Store.

    Important:
    For details on system requirements and family compatibility, view the application listing on the ServiceNow Store website.

    Version history

    Version 11.2.3 - June 2026
    Fixed: Access issues for Security Analyst while querying tables.
    Version 11.2.2 - May 2026
    • Fixed:
      • SIRs are not created from SIEM ingestion due to "Secure Notes" access issue to the Crypto module since the Yokohama upgrade was fixed.
      • Access issues for Security Analyst on querying tables.
    Version 11.2.1 - December 2025
    • New:
      • Upgraded all dictionary-level read-only fields to Strict Read-Only to improve security and prevent unauthorized changes. This ensures the server consistently enforces read-only behaviour across all UIs, scripts, and integrations.
      • Replaced all occurrences of the admin role within the integration logic with the more restrictive sn_si.admin role to ensure proper access control and adherence to least-privilege principles.
    • Fixed:
      • System property "Max Security Incident can be created in a day" not working.
      • Schedule Script "LogRhythm Data Cleanup" not executing.
    Version 11.1.10 - April 2025

    Fixed:

    • CMDB_CI mapping getting failed for "Configuration Item" field on Logrhythm.
    • Configuring CI Under Mapping Screen SIR Not Getting Created.
    Version 11.1.9 - November 2024
    Changed: Migrated default workflows to flows using Flow Designer.
    Version 11.1.8 - April 2024
    Fixed: Misconfiguration of table/field ACLs is corrected.
    Version 11.1.5 - November 2023
    Changed: Minor UI updates to render the profile mapping page.
    Version 11.1.4 - May 2023
    Fixed: One-Time Retrieval was not working on the scheduling page in LogRhythm profile when we change the date format to DD-MM-YYYY, this is now fixed.
    Version 11.1.2 - September 2022
    • Fixed:
      • Error while checking and unchecking the Since date checkbox.
      • DeDup changes and Invalidate cache cleanup.
      • If no data is generated within seven days of any rule, then a Warning/Error message should be thrown saying 'No data found' as no alarms were generated recently other than Heartbeat missed.
      • Tooltip for Pull alarm button says 'This gets sample offense data from IBM Qradar server,' which needs to change to 'This gets sample alarms from Logrhythm.'
      • Improve the logging for LogRhythm Event Ingestion.
    Version 11.1.1 - May 2022
    • New: Migration of APIs from REST to SOAP.
    • Changed:
      • Updated the integration tile and introduced alarm By ID API in Profile and Scheduled Job.
      • Removal of alarm rule selection from profile set up.
      • An additional options section has been introduced in the profile.
    Version 11.0.9 - November 2021
    Fixed: Added additional password related policies
    Version 11.0.8 - August 2021
    Fixed: Resolved an issue with the mapping of alarm fields to SIR reference fields, while creating security incidents from alarms.
    Version 11.0.7 - February 2021
    Fixed: The LogRhythm date fields [YY-MM-DDTHH:MM:SS] now map correctly in the ServiceNow AI Platform using the Glide DateTime format.
    Version 11.0.6 - December 2020
    • New:
      • Added Related List on the Security Incident Form containing all raw base events related to the LogRhythm Alarm.
      • Mapping section of the Alarm Profile includes a search function to easily find Alarm Fields by name.
      • Added a navigation link to the LogRhythm Drilldown Event module to view the list of all raw base events.
      • Support for multi-valued field mappings of Configuration Item and Observable when multiple raw base events related to the LogRhythm Alarm contain different values for these mapped fields.
    • Fixed: Mid server routing is maintained based on configured selection(s) even in failure scenarios
    Version 5.0.4 - July 2019
    • New: Recertified for New York
    • Fixed: Improved exception handling when LogRhythm API returns error code
    Version 5.0.3 - November 2018
    • Flexibility to create multiple alarm profiles such as phishing and malware
    • Drag-and-drop mapping of LogRhythm alarm field values to associated SIR security incident fields
    • A preview of the SIR security incident layout based on sample alarms to validate configuration set-up
    • Ingest historical alarms as well as ongoing, future alarms on configurable intervals
    • Automated alarm close out upon incident closure, which includes a SIR security incident ID and URL for easy linking