Automated LogRhythm Case Ownership Reconciliation
Every hour, WebRun opens LogRhythm, checks every open case for an assigned analyst, posts the list of unclaimed cases to Slack, and escalates any unclaimed critical severity case to Telegram.
How do I catch LogRhythm SIEM cases that nobody has claimed?
WebRun checks LogRhythm every hour for open cases with no assigned analyst or no update in 4 hours, posts the unclaimed list to Slack, and escalates any unclaimed critical severity case to Telegram. It only reads case ownership, so assigning and closing a case stays with your SOC team.
- No open case sits unclaimed without the team knowing
- Critical gaps get a separate Telegram escalation within the hour
- Assigning and closing a case always stays a human decision
Built for SOC analysts · security operations · MSSPs · incident response teams
What does WebRun do on every run?
The exact actions WebRun takes, in order - in plain language, so you can adjust anything.
-
WebRun signs in and gets to work
Opens
logrhythm.comin a real browser with your saved login - no setup, no API keys. -
1
LogRhythm - check open case ownership
logrhythm.com
WebRun opens LogRhythm to check open case ownership. - Open the LogRhythm case management queue
- Check every open case for an assigned analyst and current status
- Flag cases with no owner or with no status update in the last 4 hours
Done when Every open case has a checked owner and last update time.
-
2
Slack - post unclaimed cases
slack.com
WebRun opens Slack to post unclaimed cases. - Post the list of unclaimed or stalled cases to the SOC Slack channel
- Include the case severity and how long it has gone unclaimed
- Leave assigning the case to the on shift lead
Done when Every unclaimed or stalled case is visible in Slack.
-
3
Telegram - escalate critical gaps
telegram.org
WebRun opens Telegram to escalate critical gaps. - If an unclaimed case is critical severity, escalate it to the on call Telegram channel
- Keep the escalation to the case ID, severity, and how long it has waited
- Skip escalation for anything below critical severity
Done when Every unclaimed critical case has been escalated to Telegram.
How is each run configured?
Secure by default
Connect once, stays signed in
WebRun signs in once and keeps each session in a persistent environment, so every run picks up right where it left off.
Every action is checked against this policy before it runs.
Questions, answered
Will WebRun assign a case to an analyst itself?
No. WebRun only flags which cases have no owner. Assigning, investigating, or closing a case is done by your SOC lead or analyst in LogRhythm.
How long can a case go unclaimed before it's flagged?
Any open case with no status update in the last 4 hours is flagged as stalled, in addition to any case with no assigned analyst at all.
What makes a case get escalated to Telegram instead of just Slack?
Only unclaimed cases that LogRhythm itself rates critical severity get the extra Telegram escalation, so on call staff are not paged for lower priority gaps.
Related templates
Put this on autopilot.
Turn it on in minutes - or have our team set it up for you.