Insight Orchestrator overview

The Insight Orchestrator is a server in your network or cloud environment that integrates your tools and systems with InsightConnect.

When a workflow is running, the Insight Cloud keeps the overall workflow logic and data that is generated from each step. When a step is set to run on an orchestrator, the Insight Cloud delivers the input data and action instructions to the orchestrator. The orchestrator executes the action and passes the data output back up to the Insight Cloud. The Insight Cloud then proceeds to the next step in the workflow.

Credentials used in your connections are encrypted on the orchestrator itself.

The orchestrator uses Docker containers to run individual plugins. It is recommended that you do not log in to the orchestrator to view and manage Docker containers as it is not necessary, unless you have been directed to do so by the Rapid7 support team.

CentOS 7 orchestrator is no longer supported

On June 1, 2024, the CentOS 7 Insight Orchestrator reached end-of-life. As a result, orchestrators using this operating system will no longer receive security updates or patches from CentOS Linux.

To keep your environment secure, it is highly recommended that you install the new Ubuntu orchestrator or migrate to Ubuntu if you have existing CentOS 7 orchestrators in your environment.

Orchestrator installation

Decide which installation method works best for you:

Orchestrator placement

When deploying your orchestrator host, consider what you will need to integrate with InsightConnect. Your orchestrator should be placed in a central location that can easily communicate with on-premise systems such as Active Directory, InsightVM, firewall management consoles, etc. The orchestrator should also be able to communicate with cloud platforms like Microsoft Office 365, endpoint detection and response platforms, threat intelligence platforms, and of course the Insight Cloud.

Orchestrator security

The orchestrator has been designed to securely communicate with the Insight Cloud and to securely store sensitive connection configurations, including credentials. Every orchestrator generates two pairs of private and public keys for communication with the cloud.

  • The first credential pair is for encryption and decryption of credentials
  • The second credential pair is for generic elliptic curve signatures to sign and verify the requests

Credentials that you enter into InsightConnect or other Insight products that rely on InsightConnect for automation functionality are managed securely end-to-end. Initially, they are encrypted in-transit via TLS and are encrypted at rest in our systems using a public key that’s generated by the orchestrator and sent to the cloud. The private key never leaves the orchestrator—meaning the encrypted credential cannot be decrypted anywhere except locally on your orchestrator.

The encrypted credentials are sent from the Insight Cloud to the orchestrator on an as-needed basis to execute an action in a workflow. They are then decrypted in memory and passed to the plugins directly, where the plugin makes use of the data to connect to a third party system.

New credentials

Each time you create a new credential, it’s encrypted once for every orchestrator you have currently registered, even if that orchestrator is not yet configured to use that credential. This is done because once it’s encrypted, we lose the ability to make it available to any other orchestrator you may want to use it with later on. In this way, we make it slightly easier to reuse credentials between orchestrators without having to re-enter them.

However, any orchestrators that you add after entering a credential will not have access to the existing credential. Credentials can't be reshared without your express intervention by re-entering them.

Credentials and resetting orchestrators

If you reset an orchestrator, you’ll lose access to the credentials from the cloud unless you registered at least one other orchestrator prior to you entering the credentials the first time. This is because you’ve severed the tie between the orchestrator and credentials that was created when you entered the credentials initially. This is why you shouldn’t reset an orchestrator unless you’re advised to do so by a support representative.

Orchestrator-to-cloud communication

The Insight Orchestrator routinely communicates with InsightConnect servers in our cloud. Communication is always initiated in a single direction, orchestrator to cloud, and never the other way around. The Insight Cloud has no ability to directly communicate with the orchestrator installed on your environment.

These are the situations in which the orchestrator communicates with the cloud:

  • Heartbeat data: The orchestrator sends heartbeat data to inform the cloud that it’s still working and able to receive work. Heartbeat calls contain some metadata about the orchestrator and its health to help us support your orchestrator installations. The heartbeat call also returns a challenge token, which is used to sign requests. So if an orchestrator cannot send heartbeat data, it’s unable to communicate further with the cloud.
  • Work requests: The orchestrator requests work to be done by establishing a secure connection over TLS that then includes metadata about the orchestrator to identify it with the cloud. These requests are signed and verified.
  • Work results: Similar to work requests, the orchestrator responds with results from work that was done. These requests are signed and verified.

Orchestrator cards

You can view all of your orchestrators by going to Settings > Orchestrators in InsightConnect or navigate to Data Collection > Orchestrators from the Insight Platform Home. On the Orchestrators page, every orchestrator has a card that acts like a dashboard. These cards display orchestrator data, but also allow you to review the health of an orchestrator or delete any as needed.

Each orchestrator card displays:

  • Total number of events
  • Number of events currently processing
  • Total number of connections
  • CPU usage
  • Memory usage, in bytes
  • Storage usage, in bytes

Orchestrators have five states:

  • Healthy: Orchestrator is active and running properly
  • Warning: Orchestrator is running properly, but may require review
  • Error: Orchestrator is running, but you must review errors and troubleshoot them
  • Stopped: Orchestrator has stopped running
  • Activating: A newly installed orchestrator is activating and will not be available to run until activation completes

InsightIDR and InsightVM automation capabilities

The Insight Orchestrator enables the automation capabilities in InsightIDR and InsightVM. After you install an orchestrator---whether it's in InsightConnect, InsightVM, or InsightIDR---you can use specific templates and any custom workflows from InsightConnect within InsightVM or InsightIDR.

To enable a workflow for use in other Insight products, the workflow must be activated and must have an Insight Platform trigger.