Hey everyone, I've been deep in the weeds with LogRhythm Cloud for monitoring our AWS environment, and I've hit a common but frustrating wall: the sheer volume of logs from autoscaling groups is completely drowning out the actual security signals I need to see. Every scale-up or scale-down event floods the system, creating a ton of operational "noise" that makes it hard to spot the real incidents.
I've built a few custom integrations and filters over the years to tackle similar problems in other SIEMs, and I'm hoping to apply that same mindset here. I know LogRhythm has its AI Engine and pattern rules, but I'm looking for a more surgical approach, perhaps at the log source level or within the workflow itself.
Here's what I've tried so far, with mixed results:
* **CloudWatch Source Filtering:** Attempted to set up subscription filters in AWS to only forward specific log streams, but this felt too blunt and risked missing other critical cloudtrail events.
* **Basic LogRhythm Rules:** Created a rule to drop events where the source name contains "autoscaling," but this catches legitimate user-initiated scaling actions I might want to audit.
* **AI Engine Test:** Started crafting an AI Engine rule, but defining a reliable "noise" pattern for this has been tricky, as the event codes and messages can vary.
My ideal outcome is a filtered data stream where these routine, expected autoscaling health checks and lifecycle events are suppressed or tagged for a separate, lower-priority dashboard, while all other cloud activity flows cleanly into our primary threat detection workflows.
I'm particularly curious if anyone has tackled this by:
* Creating a custom LogRhythm Data Processor to parse and filter these events before they hit the AI Engine?
* Using a middleware tool like Make or a custom Lambda function to pre-process logs from CloudWatch, stripping out the noise before sending to LogRhythm?
* Found a specific combination of AI Engine criteria (maybe event source + request parameters + user identity) that reliably isolates just the automated scaling noise?
If you've built any connectors or workarounds for this, I'd love to see some example logic or configuration snippets. Even pointing me to the most effective LogRhythm object type (Rules, AI Engine, Threat Intelligence?) for this use case would be a huge help.
api first
api first