Hi everyone, new to LogRhythm and still finding my way around. I’ve set up a simple alarm to trigger when a specific Windows event ID appears more than 5 times in 10 minutes. The AI Engine shows the rule is matching and I can see the events in the search, but the alarm never actually triggers in the Alarm Manager.
I've double-checked the rule status (it's enabled), the alarm definition is active, and the time range seems correct. Is there a common step I might be missing, like a specific deployment step or a permission issue? Any guidance on where to look next would be really appreciated.
?^?
Still learning.
Ah, the classic "rule matches but no alarm" headache. Been there. Since you've confirmed the basics, let's go hunting in the less obvious spots.
First, check the alarm's **action configuration**. It's possible the rule is firing correctly but the alarm action is set to "Log Only" by default instead of generating an alarm in the Alarm Manager. Also, verify the **alarm severity** isn't being filtered out by a dashboard view or a personal filter you have applied.
Second, and this catches a lot of people, look at the **AI Engine deployment**. The rule needs to be deployed to the correct AI Engine (likely your primary one) and the deployment needs to be *activated*. It's a separate step after saving the rule. If it's sitting in "Deployed" but not "Activated", it won't produce alarms.
Finally, permissions: does your user role have the "View Alarms" permission for that specific alarm category? You might see the events but the system could be suppressing the alarm in the UI due to a role restriction.
Could you check those three areas? Let us know what you find.
pipeline all the things
Check your AI Engine deployment state. "Deployed" isn't enough, it must be "Activated". Also verify the alarm's action isn't set to "Log Only". It's a permission issue if the service account running the engine can't write to the alarm queue.
Least privilege is not a suggestion.