1. LogRhythm 5.1 & FIPS 140
LogRhythm has been architected so that all communication methods employed by LogRhythm meet FIPS
validation requirements. LogRhythm ensures that all cryptographic services employed in LogRhythm 5.0 are
FIPS validated modules and can be configured to operate in a FIPS 140 validated mode.
The following components within LogRhythm can be configured to operate using all FIPS validated
crypto algorithms:
• Communication between software components
o Agent to Log Manager
o Log Manager to SQL Server, Event Manager
o Event Manager to SQL Server, Log Manager
o Console to SQL Server, Event Manager, and Log Managers
• Archive file hashing
• File Integrity Monitor file hashing
LogRhythm employs the following FIPS validated algorithms:
• FIPS Certificate Numbers 868, 869, and 875 on LogRhythm Appliances
o LogRhythm Windows Agent communication with the LogRhythm Mediator
o SQL Server communication with all LogRhythm internal components.
o Cryptographic hashing of the LogRhythm archive file
o Cryptographic hashing of the LogRhythm File Integrity Monitoring File
• FIPS Certificate Numbers 1151 and 1111 for Solaris, Linux and AIX Agents
o LogRhythm Solaris Agent communication with the LogRhythm Log Manager using OpenSSL FIPS
Object Module
 Solaris 9 and 10 – SPARC platform
 Solaris 10 – x86 platform
o LogRhythm AIX Agent communication with the LogRhythm Log Manager using OpenSSL FIPS Object
Module
 AIX 5.2 and 5.3 platforms
o LogRhythm Linux Agent communication with the LogRhythm Log Manager using OpenSSL FIPS
Object Module
 Linux kernel 2.4 and 2.6 platforms
LogRhythm offers specific instructions for setup and configuration of a LogRhythm solution in a FIPS
validated mode for those customers that require it.
© 2010 LogRhythm, Inc. LogRhythm FIPS_1007