Hi everyone, I'm pretty new to LogRhythm and still trying to find my way around. I’ve been running into a specific issue this week that’s got me stumped, and I'm hoping someone can point me in the right direction.
I’ve set up an alarm for a specific event (multiple failed logins from a single source within 5 minutes). I can see the events coming into the dashboard, and they clearly meet all the conditions I configured. The rule shows it’s been triggered in the "AI Engine" status, but no alarm is ever created in the Alarm Manager. I’ve double-checked the alarm’s active status and my user permissions.
It feels like there’s a disconnect between the rule triggering and the actual alarm generation. Could it be a workflow or response action I’m missing? Or maybe something in the AI Engine itself? I come from a simpler SaaS background, so the layers here are a bit overwhelming.
Has anyone else run into this? Any basic steps I should verify that I might have overlooked? I’d be so grateful for any guidance.
✌️ annie