| \n\nVerify that you have assigned the required ServiceNow AI Platform® and Security Incident Response \\(SIR\\) roles.\n\n | \n\nThe following roles are required for installation, configuration, and verification of expected results:- The system administrator \\(admin\\) installs the application plugin and assigns the security incident administrator \\(sn\\_si.admin\\) role.\n- The \\(sn\\_si.admin\\) oversees the following tasks:\n - Names, creates, and edits alarm profiles.\n - Maps and filters alarms – identifies specific LogRhythm alarms that create security incidents and configures how these alarm fields map to a ServiceNow AI Platform® security incident.\n - Previews security incident details for accuracy prior to finalizing the configuration.\n - Ingests historical alarms and schedules pulled alarms.\n - Assigns the security incident analyst \\(sn\\_si.analyst\\) role.\n - This role also has access to the Security Operations module.\n- The security incident analyst \\(sn\\_si.analyst\\) responds to security incidents that are created based on the alarm profile settings.\n\n |
| \n\nObtain a LogRhythm API user name and password and verify that you are using version LogRhythm 7.8 or later.\n\n | \n\nVisit the product website for information on API keys and to create an account: [LogRhythm Enterprise website](https://logrhythm.com/). The user accounts, credentials, and certificates must be configured properly prior to installing the application. The integration requires LogRhythm version 7.8 or later and the LogRhythm REST APIs.\n\n See [Set up the REST API](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/drilldown-api-lr.md).\n\n |
| \n\nVerify that you have installed and configured a MID Server.\n\n | \n\nA MID Server is required in your ServiceNow AI Platform environment. See the [ServiceNow Product Documentation website](https://www.servicenow.com/docs) for information about how to set up and configure MID Servers.\n\n |
| \n\nVerify that the ServiceNow core applications that are required to support the integration are installed and activated before you install the application for the integration.\n\n | \n\nFor the Rome release and later family releases, the Security Incident Response Dependency plugin \\(com.snc.si\\_dep\\) is required. This plugin automatically installs all the dependencies that are required to support the Security Incident Response product. Install and activate this plugin before you install and activate the other Security Operations applications required by the integration.\n\n Verify that the following Security Operations applications are installed and activated from the ServiceNow Store. If not installed, install and activate one application at a time in the following order to ensure a smooth installation.\n\n 1. Security Incident Response\n2. Security Integration Framework\n3. Security Support Common\n4. Security Support Orchestration\n\n For more information on setting up your ServiceNow AI Platform instance for the integration, see [Get entitlement for a Security Operations product or application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/entitle-secops-product.md) and [Activate a ServiceNow Store application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/activate-entitled-store-app.md).\n\n |
\n