Cloudmersive Private Cloud can send the outcome of every virus scan to LogRhythm (or any
webhook-capable SIEM or log collector) as an HTTPS POST. Each scanned file produces one event
containing the scan result metadata, which LogRhythm can ingest, index, and alert on.

This feature is off by default and is enabled per node from the Cloudmersive Management
Portal.

Prerequisites

• A Cloudmersive Private Cloud deployment running the Virus Scan API.
• Administrator access to the deployment in the Cloudmersive Management Portal
  (portal.cloudmersive.com).
• A LogRhythm HTTP ingestion endpoint that can receive JSON webhook POSTs — for example, an Open
  Collector Webhook Beat endpoint — and, if your endpoint requires authentication, its bearer
  token. Any standard webhook receiver URL works the same way.

We recommend using an HTTPS endpoint so scan outcome data and the bearer token are encrypted in
transit.

Step-by-Step Setup

1. Sign in to the Cloudmersive Management Portal.

2. Navigate to Private Cloud and select the deployment (node) you want to configure.

3. Click Configure, then open the Advanced configuration page.

4. Scroll to the Virus Scan API → Logging section.

5. Check Log Virus Scan Outcomes to Webhook / LogRhythm.

6. In Webhook URL, enter your LogRhythm ingestion endpoint URL, for example:

   https://collector.example.com:8085/webhook

7. (Optional) In Webhook Bearer Token, enter the token for your endpoint. When provided, it
   is sent on each request in the Authorization: Bearer <token> header. Leave it blank if your
   endpoint does not require authentication.

8. Click Save Changes.

The node picks up the new configuration automatically — allow up to approximately 10 minutes for
the setting to propagate, or restart the node service to apply it immediately.

Verifying the Integration

1. Submit a test file to the node's virus scan endpoint (for example, POST /virus/scan/file).
2. In LogRhythm, confirm that a scan outcome event arrived at your ingestion endpoint.
3. To generate a detection event safely, scan the industry-standard EICAR test file and confirm
   the corresponding not-clean outcome appears in LogRhythm.