InsightIDR Integration

The integration with Rapid7's InsightIDR provides InsightCloudSec with the ability to export cloud event data to InsightIDR for historical logging, analysis, and further investigation.

To learn more about working specifically with InsightIDR, including setup of InsightIDR, check out the InsightIDR documentation.

• For general information about Integrations (editing and deleting), refer to the Integrations Overview page.
• If you need help with this integration, contact us through the Customer Support Portal.

Configuration in InsightIDR

As part of the InsightCloudSec integration, there are a few configuration steps you must complete in InsightIDR before you can send data.

These steps assume you have deployed and configured a Collector following the steps found here & that you have registered your Collector with your instance of InsightIDR based on those instructions.

1. Once you have your Collector in InsightIDR, you will need to create a new data source.

   • This data source should be of type Custom Logs as seen below.
   • This allows the integration to send structured logs to IDR via the Collector.
   • You will need to configure a public Collector to listen on a network port and then select UDP as the profile, as shown below, and take note of the port you select. You will need the port information when you configure the integration inside InsightCloudSec.

2. Click Save when you have completed the Add Event Source details.

Configuration in InsightCloudSec

Refer to the steps below to set up the integration within InsightCloudSec

1. Navigate to Administration > Integrations and locate the InsightIDR tile.
2. Click Edit on the InsightIDR tile.
3. Provide the public Collector IP and the UDP port the Collector is listening on. You will need to ensure that all firewall, security groups, etc., rules are in place within the cloud/network location where the Collector is hosted. This allows communication between the InsightCloudSec instance and the Collector.
4. Optionally, select the Send Product API Activity checkbox to enable InsightCloudSec to send API activity to your InsightIDR instance, e.g., Compliance Report generation, custom Insight creation, etc.
5. Click Save to submit and save the integration settings.

Creating a Bot Using Your InsightIDR Integration

InsightCloudSec includes Bot actions that include an action that exports a pre-formatted data block that includes Bot Name, filter information, and resource information.

• For detailed step by step instructions check out Creating Bots.
• You can also check out Working with Bots (Best Practices & Examples) if you want to review some examples.

From within the Bots form, during Step 4 you will be allowed to select Actions. Search for IDR to locate the Bot action titled "InsightIDR Event". Using this Bot action allows the default InsightIDR parser to handle data from InsightCloudSec without additional InsightIDR configuration.

At the time of writing the Actions specific to InsightIDR include:

• Insight IDR Custom Event: Log a custom event into an InsightIDR collector
• Insight IDR Event: Log a pre-canned event into an InsightIDR Collector (mentioned above)

An example of the Insight IDR Event Bot action output is shown below.

Configuration of InsightCloudSec Data in InsightIDR

Once you have your Collector and event sources configured, you should be able to trigger the Bot(s) to see logs flowing into the Collector.

From your InsightIDR installation, click into the Collectors and then choose View raw log data. For more information on configuration in InsightIDR, refer to the documentation found here.

Log Analysis

After verifying the logs are flowing into InsightIDR, you can start to build out the dashboard using elements of the log files as search parameters.