InsightIDR Integration

The integration with Rapid7's InsightIDR provides InsightCloudSec with the ability to export cloud event data to InsightIDR for historical logging, analysis, and further investigation.

To learn more about working specifically with InsightIDR, including setup of InsightIDR, check out the InsightIDR documentation.

Configuration in InsightIDR

As part of the InsightCloudSec integration, there are a few configuration steps you must complete in InsightIDR before you can send data.

These steps assume you have deployed and configured a Collector following the steps found here & that you have registered your Collector with your instance of InsightIDR based on those instructions.

Public Collector IP

The Collector must have a public IP address to properly enable the integration in InsightCloudSec.

  1. Once you have your Collector in InsightIDR, you will need to create a new data source.

    • This data source should be of type Custom Logs as seen below.
    • This allows the integration to send structured logs to IDR via the Collector.
    • You will need to configure a public Collector to listen on a network port and then select UDP as the profile, as shown below, and take note of the port you select. You will need the port information when you configure the integration inside InsightCloudSec.
  2. Click Save when you have completed the Add Event Source details.

Configuration in InsightCloudSec

Refer to the steps below to set up the integration within InsightCloudSec

  1. Navigate to Administration > Integrations and locate the InsightIDR tile.
  2. Click Edit on the InsightIDR tile.
  3. Provide the public Collector IP and the UDP port the Collector is listening on. You will need to ensure that all firewall, security groups, etc., rules are in place within the cloud/network location where the Collector is hosted. This allows communication between the InsightCloudSec instance and the Collector.
  4. Optionally, select the Send Product API Activity checkbox to enable InsightCloudSec to send API activity to your InsightIDR instance, e.g., Compliance Report generation, custom Insight creation, etc.
  5. Click Save to submit and save the integration settings.

Creating a Bot Using Your InsightIDR Integration

InsightCloudSec includes Bot actions that include an action that exports a pre-formatted data block that includes Bot Name, filter information, and resource information.

From within the Bots form, during Step 4 you will be allowed to select Actions. Search for IDR to locate the Bot action titled "InsightIDR Event". Using this Bot action allows the default InsightIDR parser to handle data from InsightCloudSec without additional InsightIDR configuration.

At the time of writing the Actions specific to InsightIDR include:

  • Insight IDR Custom Event: Log a custom event into an InsightIDR collector
  • Insight IDR Event: Log a pre-canned event into an InsightIDR Collector (mentioned above)

Product name to be replaced

You may observe that some components, screen captures, or examples use our former product name, DivvyCloud. This doesn't affect the configuration or the product's functionality, and we will notify you as we replace these component names.

An example of the Insight IDR Event Bot action output is shown below.

Bot Action Sample Output

Configuration of InsightCloudSec Data in InsightIDR

Once you have your Collector and event sources configured, you should be able to trigger the Bot(s) to see logs flowing into the Collector.

From your InsightIDR installation, click into the Collectors and then choose View raw log data. For more information on configuration in InsightIDR, refer to the documentation found here.

Log Analysis

After verifying the logs are flowing into InsightIDR, you can start to build out the dashboard using elements of the log files as search parameters.