Products
Insight Platform Solutions
XDR & SIEM
INSIGHTIDR
Threat Intelligence
THREAT COMMAND
Vulnerability Management
INSIGHTVM
Dynamic Application Security Testing
INSIGHTAPPSEC
Orchestration & Automation (SOAR)
INSIGHTCONNECT
Cloud Security
INSIGHTCLOUDSEC
More Solutions
Penetration Testing
METASPLOIT
On-Prem Vulnerability Management
NEXPOSE
Application Monitoring & Protection
TCELL
Digital Forensics and Incident Response (DFIR)
Velociraptor
Insight Platform
Free Trial
Services
MANAGED SERVICES
Detection and Response
24/7 MONITORING & REMEDIATION FROM MDR EXPERTS
Vulnerability Management
PERFECTLY OPTIMIZED RISK ASSESSMENT
Application Security
SCAN MANAGEMENT & VULNERABILITY VALIDATION
OTHER SERVICES
Security Advisory Services
PLAN, BUILD, & PRIORITIZE SECURITY INITIATIVES
Product Consulting
QUICK-START & CONFIGURATION
Training & Certification
SKILLS & ADVANCEMENT
Penetration Services
TEST YOUR DEFENSES IN REAL-TIME
IoT Security Testing
SECURE EVERYTHING CONNECTED TO A CONNECTED WORLD
Premium Support
PRIORITY HELP & FASTER SOLUTIONS
Support & Resources
SUPPORT
Support Portal
CONTACT CUSTOMER SUPPORT
Product Documentation
EXPLORE PRODUCT GUIDES
Release Notes
DISCOVER THE LATEST PRODUCT UPDATES
Contact Us
TALK TO SALES
RESOURCES
Fundamentals
FOUNDATIONAL SECURITY KNOWLEDGE
Blog
THE LATEST INDUSTRY NEWS AND SECURITY EXPERTISE
Resources Library
E-BOOKS, WHITE PAPERS, VIDEOS & BRIEFS
Extensions Library
PLUGINS, INTEGRATIONS & DEVELOPER COMMUNITY
Partners
RAPID7 PARTNER ECOSYSTEM
Webcasts & Events
UPCOMING OPPORTUNITIES TO CONNECT WITH US
Vulnerability & Exploit Database
SEARCH THE LATEST SECURITY RESEARCH
Company
OVERVIEW
About Us
OUR STORY
Leadership
EXECUTIVE TEAM & BOARD
News & Press Releases
THE LATEST FROM OUR NEWSROOM
Careers
JOIN RAPID7
COMMUNITY & CULTURE
Social Good
OUR COMMITMENT & APPROACH
Rapid7 Cybersecurity Foundation
BUILDING THE FUTURE
Diversity, Equity & Inclusion
EMPOWERING PEOPLE
Open Source
STRENGTHENING CYBERSECURITY
Public Policy
ENGAGEMENT & ADVOCACY
Research
Sign In
Documentation
InsightConnect
AppSpider
Insight Agent
InsightAppSec
InsightCloudSec
InsightConnect
Insight Platform
InsightIDR
Insight Network Sensor
InsightOps
InsightVM
Metasploit
Nexpose
tCell
Managed Services
Products
Insight Platform Solutions
XDR & SIEM
INSIGHTIDR
Threat Intelligence
THREAT COMMAND
Vulnerability Management
INSIGHTVM
Dynamic Application Security Testing
INSIGHTAPPSEC
Orchestration & Automation (SOAR)
INSIGHTCONNECT
Cloud Security
INSIGHTCLOUDSEC
More Solutions
Penetration Testing
METASPLOIT
On-Prem Vulnerability Management
NEXPOSE
Application Monitoring & Protection
TCELL
Digital Forensics and Incident Response (DFIR)
Velociraptor
Insight Platform
Free Trial
Services
MANAGED SERVICES
Detection and Response
24/7 MONITORING & REMEDIATION FROM MDR EXPERTS
Vulnerability Management
PERFECTLY OPTIMIZED RISK ASSESSMENT
Application Security
SCAN MANAGEMENT & VULNERABILITY VALIDATION
OTHER SERVICES
Security Advisory Services
PLAN, BUILD, & PRIORITIZE SECURITY INITIATIVES
Product Consulting
QUICK-START & CONFIGURATION
Training & Certification
SKILLS & ADVANCEMENT
Penetration Services
TEST YOUR DEFENSES IN REAL-TIME
IoT Security Testing
SECURE EVERYTHING CONNECTED TO A CONNECTED WORLD
Premium Support
PRIORITY HELP & FASTER SOLUTIONS
Support & Resources
SUPPORT
Support Portal
CONTACT CUSTOMER SUPPORT
Product Documentation
EXPLORE PRODUCT GUIDES
Release Notes
DISCOVER THE LATEST PRODUCT UPDATES
Contact Us
TALK TO SALES
RESOURCES
Fundamentals
FOUNDATIONAL SECURITY KNOWLEDGE
Blog
THE LATEST INDUSTRY NEWS AND SECURITY EXPERTISE
Resources Library
E-BOOKS, WHITE PAPERS, VIDEOS & BRIEFS
Extensions Library
PLUGINS, INTEGRATIONS & DEVELOPER COMMUNITY
Partners
RAPID7 PARTNER ECOSYSTEM
Webcasts & Events
UPCOMING OPPORTUNITIES TO CONNECT WITH US
Vulnerability & Exploit Database
SEARCH THE LATEST SECURITY RESEARCH
Company
OVERVIEW
About Us
OUR STORY
Leadership
EXECUTIVE TEAM & BOARD
News & Press Releases
THE LATEST FROM OUR NEWSROOM
Careers
JOIN RAPID7
COMMUNITY & CULTURE
Social Good
OUR COMMITMENT & APPROACH
Rapid7 Cybersecurity Foundation
BUILDING THE FUTURE
Diversity, Equity & Inclusion
EMPOWERING PEOPLE
Open Source
STRENGTHENING CYBERSECURITY
Public Policy
ENGAGEMENT & ADVOCACY
Research
Sign In
Documentation
InsightConnect
AppSpider
Insight Agent
InsightAppSec
InsightCloudSec
InsightConnect
Insight Platform
InsightIDR
Insight Network Sensor
InsightOps
InsightVM
Metasploit
Nexpose
tCell
Managed Services
Release Notes
Docs Menu
Welcome
What is InsightConnect?
Get Started with InsightConnect
Learn Key Concepts
SOC Automation Success Plan
Days 1 through 15: Get Started with SOC Automation
Days 16 through 45: Link Alerts and Define Use Cases
Days 46 through 90: Customize and Activate Workflows
Supporting Resources
InsightVM + InsightConnect Automation Quick Start Guide
Use Case #1: Vulnerability Intelligence Gathering
Use Case #2: Vulnerability Risk Management Alerts
Use Case #3: Democratize Vulnerability Management
VM Automation Success Plan
Days 1 through 15: Get Started with VM Automation
Days 16 through 45: VM Triggers and Extending VM Use Casess
Days 46 through 90: Customize and Activate Workflows
Supporting Resources
Learn to Build Workflows
Introductory videos
Setup and Deploy an Orchestrator
What is the Insight Orchestrator?
Install and Activate an Orchestrator
System and Network Requirements
Deploying in AWS or Azure with RHEL8
Install Private CA Certificates
Configure an Orchestrator
Configure Proxies
Configure Static IP Address
Troubleshoot an Orchestrator
Command Line Help
Uninstall an Orchestrator
Concepts and Usage
Learn InsightConnect's foundational concepts
Course 1: Introduction to workflows
Course 2: Understand data in InsightConnect with workflow data basics
Course 3: Access data in InsightConnect with Handlebars
Course 4: Introduction to Format Query Language
Course 5: Introduction to loop data and loop outputs
Home Page Widgets
Workflows
Workflow Control Panel
Workflow Builder
Reusable Elements
Triggers
Input and Output Variables
Nested Variables
Quick Actions
Workflow Steps
Jobs
Most Popular Plugins
InsightConnect REST API
Plugins and Connections
Plugins
Use Plugins
Update Plugins
Cloud Plugins
Free and Open Source Service Plugins
Plugin Use Cases
HTTP Requests
Mass Delete with PowerShell
Python 2 or 3 Script
Connections
Create a Connection
Test a Connection
Troubleshoot a Connection
Connection Setup Guides
Active Directory LDAP
AWS Security Hub
Cisco ASA
CheckPoint NGFW
Fortinet FortiGate
Gmail
Insight Agent
InsightIDR
InsightVM
Jira
Microsoft Exchange
Microsoft InTune
Microsoft Office365
Microsoft Office 365 Email Security
Microsoft SCCM
Microsoft Teams
Microsoft Windows Defender ATP
Mimecast
Palo Alto Firewall
ServiceNow
Slack
VirusTotal
Workday
How To
Build a Workflow
Manage Workflows
Import and Export Workflows
Set Up Triggers
Set Up an API Trigger
Set Up an InsightIDR Alert Trigger
Set Up an InsightIDR Attacker Behavior Analytics (ABA) Alert Trigger
Set Up an InsightVM Events Trigger
Set Up a Plugin Trigger
Trigger Workflows with Slack ChatOps
Manage Global Artifacts
Configure Workflow Parameters
Use Workflow Steps
Use an Action Step
Use an Artifact Step
Use a ChatOps Step
Use a Decision Step
Use a Filter Step
Use a Helper Step
Use a Join Paths Step
Use a Loop Step
Use a Pattern Match Step
Use a Rapid7 Insight Solutions Step
Work with Variables
Format Query Language
Format JSON Input
Format Strings with Templates
Test a Workflow
Set Up the InsightConnect App for Splunk
Send InsightConnect Events to InsightIDR
InsightConnect Workflow Best Practices
Plugin Development
Getting Started
Create Custom Plugins
Plugin Development Videos
Plugin Tooling
Plugin Components
Plugin Spec
Running Plugins
SDK Guide
Regenerating Plugins
Style Guide
Error Handling in Integrations
Troubleshooting
Logo
Unit Test Generation
Unit Test Primer
Troubleshoot
Are you stuck?
Troubleshoot a Workflow
Troubleshoot a Failed Job
Troubleshoot a Plugin
Release Notes
InsightConnect release notes
Plugin Updates
Support
Contact the Rapid7 Support team
Share an idea with Rapid7
Community
Rapid7 Discussion Community
Welcome
What is InsightConnect?
Get Started with InsightConnect
Learn Key Concepts
SOC Automation Success Plan
Days 1 through 15: Get Started with SOC Automation
Days 16 through 45: Link Alerts and Define Use Cases
Days 46 through 90: Customize and Activate Workflows
Supporting Resources
InsightVM + InsightConnect Automation Quick Start Guide
Use Case #1: Vulnerability Intelligence Gathering
Use Case #2: Vulnerability Risk Management Alerts
Use Case #3: Democratize Vulnerability Management
VM Automation Success Plan
Days 1 through 15: Get Started with VM Automation
Days 16 through 45: VM Triggers and Extending VM Use Casess
Days 46 through 90: Customize and Activate Workflows
Supporting Resources
Learn to Build Workflows
Introductory videos
Setup and Deploy an Orchestrator
What is the Insight Orchestrator?
Install and Activate an Orchestrator
System and Network Requirements
Deploying in AWS or Azure with RHEL8
Install Private CA Certificates
Configure an Orchestrator
Configure Proxies
Configure Static IP Address
Troubleshoot an Orchestrator
Command Line Help
Uninstall an Orchestrator
Concepts and Usage
Learn InsightConnect's foundational concepts
Course 1: Introduction to workflows
Course 2: Understand data in InsightConnect with workflow data basics
Course 3: Access data in InsightConnect with Handlebars
Course 4: Introduction to Format Query Language
Course 5: Introduction to loop data and loop outputs
Home Page Widgets
Workflows
Workflow Control Panel
Workflow Builder
Reusable Elements
Triggers
Input and Output Variables
Nested Variables
Quick Actions
Workflow Steps
Jobs
Most Popular Plugins
InsightConnect REST API
Plugins and Connections
Plugins
Use Plugins
Update Plugins
Cloud Plugins
Free and Open Source Service Plugins
Plugin Use Cases
HTTP Requests
Mass Delete with PowerShell
Python 2 or 3 Script
Connections
Create a Connection
Test a Connection
Troubleshoot a Connection
Connection Setup Guides
Active Directory LDAP
AWS Security Hub
Cisco ASA
CheckPoint NGFW
Fortinet FortiGate
Gmail
Insight Agent
InsightIDR
InsightVM
Jira
Microsoft Exchange
Microsoft InTune
Microsoft Office365
Microsoft Office 365 Email Security
Microsoft SCCM
Microsoft Teams
Microsoft Windows Defender ATP
Mimecast
Palo Alto Firewall
ServiceNow
Slack
VirusTotal
Workday
How To
Build a Workflow
Manage Workflows
Import and Export Workflows
Set Up Triggers
Set Up an API Trigger
Set Up an InsightIDR Alert Trigger
Set Up an InsightIDR Attacker Behavior Analytics (ABA) Alert Trigger
Set Up an InsightVM Events Trigger
Set Up a Plugin Trigger
Trigger Workflows with Slack ChatOps
Manage Global Artifacts
Configure Workflow Parameters
Use Workflow Steps
Use an Action Step
Use an Artifact Step
Use a ChatOps Step
Use a Decision Step
Use a Filter Step
Use a Helper Step
Use a Join Paths Step
Use a Loop Step
Use a Pattern Match Step
Use a Rapid7 Insight Solutions Step
Work with Variables
Format Query Language
Format JSON Input
Format Strings with Templates
Test a Workflow
Set Up the InsightConnect App for Splunk
Send InsightConnect Events to InsightIDR
InsightConnect Workflow Best Practices
Plugin Development
Getting Started
Create Custom Plugins
Plugin Development Videos
Plugin Tooling
Plugin Components
Plugin Spec
Running Plugins
SDK Guide
Regenerating Plugins
Style Guide
Error Handling in Integrations
Troubleshooting
Logo
Unit Test Generation
Unit Test Primer
Troubleshoot
Are you stuck?
Troubleshoot a Workflow
Troubleshoot a Failed Job
Troubleshoot a Plugin
Release Notes
InsightConnect release notes
Plugin Updates
Support
Contact the Rapid7 Support team
Share an idea with Rapid7
Community
Rapid7 Discussion Community
Work with Variables
You can modify InsightConnect input and output variables to meet your needs in a variety of ways.
Learn how to format JSON object input variables
Learn about the InsightConnect query language used in Filter Steps and Automated Decisions
Learn how to use Handlebars templates to format strings and variables for Artifacts
Did this page help you?
Yes
No
How To
Use a Rapid7 Insight Solutions Step
How To
Format Query Language