Products
- NEW
  Cloud Migration with Unlimited Risk Coverage
  Cloud Risk Complete
  Explore Offer
Services
- NEW
  MDR with Unlimited Incident Response
  Managed Threat Complete
  Explore offer
Support & Resources
Company
RESEARCH
Sign In

InsightIDR

Products
- NEW
  Cloud Migration with Unlimited Risk Coverage
  Cloud Risk Complete
  Explore Offer
Services
- NEW
  MDR with Unlimited Incident Response
  Managed Threat Complete
  Explore offer
Support & Resources
Company
RESEARCH

Sign In

Documentation
InsightIDR
Release Notes

Getting Started with InsightIDR

InsightIDR Overview
Essential | Quick Start Guide
Advanced | Quick Start Guide
Ultimate | Quick Start Guide

Setup and Deployment

System Requirements
- Setting Up a Service Account
Network and Environment Audit
Ports Used by InsightIDR
Collector Overview
Insight Agent
- Configure the Insight Agent to Send Additional Logs
- Microsoft Windows Defender Antivirus
Endpoint Scan
FIM Recommendations
Other Deployment Options

Automation

Get Started with ABA Automation
Get Started with UBA and Basic Detection Rule Automation
- Alert Triggers for UBA Detection Rules and Basic Detection Rules
Insight Orchestrator Overview
- Configure Connections For Automation
- Automation Workflow Templates
Automation Workflows
Automated Enrichment Workflows
- Enrich Alert Data with Open Source Plugins
Automation Troubleshooting
Send InsightConnect Events to InsightIDR

How To

Manage Credentials
Search Your Logs
Transform Logs to Universal Event Format
Delete and Reinstall a Collector
Deploy Deception Technology
Investigate an Asset or User
Manage Event Sources
- Edit Event Sources
- Copy Event Sources to a New Collector
Export Data
Access AWS Resources with EC2 IAM Roles
Monitor Your Security Operations Activities

Concepts and Usage

Rapid7 Resource Names
Detection Rules
Notable Events
Investigations
Investigate Threat Command Alerts
Assets on Your Domain
Dashboards and Reports
- R7 Managed: Endpoint Visibility Validation Dashboard
Deception Technology
File Access Activity Monitoring
File Integrity Monitoring
- File Integrity Monitoring for Linux
- Search Logs for FIM Events
Log Search
Network Rules
Network Traffic Analysis
Community Threats
Threats
- Utilize Existing Threats
- Add and Manage Threats
Users and Accounts on Your Domain
Quick Actions
Data Storage and Retention FAQs

Detection Library

Overview
ABA: Rules by Threat
ABA: Rules by Endpoint
UBA Detection Rules

InsightIDR REST APIs

InsightIDR REST APIs

Event Source Configuration

InsightIDR Event Sources
Data Collection Methods
Advanced Event Source Settings
Monitor Event Source Health
Event Source Troubleshooting
Auto Configure
Rapid7 Products
- InsightVM
- Metasploit
Active Directory
- Troubleshooting Active Directory
Advanced Malware
- FireEye NX
Cloud Services
Data Exporter
Microsoft SQL Database Audit Logs
DHCP
DNS
Email & ActiveSync
- OWA/ActiveSync
Firewall
IDS
Ingress Authentication
- Zscaler LSS
LDAP
- LDAP Troubleshooting
- AWS Managed Microsoft AD
Universal Event Sources
Raw Data
Log Aggregators
Third Party Alerts
Virus Scan
VPN
Web Proxy
Web Server Access
- Microsoft IIS

Administration

Monthly Data Usage
Browser Settings
Email Notifications
User Management
Single Sign-On

Release Notes

InsightIDR release notes

Support

Contact the Rapid7 Support team
Share an idea with Rapid7

Getting Started with InsightIDR

InsightIDR Overview
Essential | Quick Start Guide
Advanced | Quick Start Guide
Ultimate | Quick Start Guide

Setup and Deployment

System Requirements
- Setting Up a Service Account
Network and Environment Audit
Ports Used by InsightIDR
Collector Overview
Insight Agent
- Configure the Insight Agent to Send Additional Logs
- Microsoft Windows Defender Antivirus
Endpoint Scan
FIM Recommendations
Other Deployment Options

Automation

Get Started with ABA Automation
Get Started with UBA and Basic Detection Rule Automation
- Alert Triggers for UBA Detection Rules and Basic Detection Rules
Insight Orchestrator Overview
- Configure Connections For Automation
- Automation Workflow Templates
Automation Workflows
Automated Enrichment Workflows
- Enrich Alert Data with Open Source Plugins
Automation Troubleshooting
Send InsightConnect Events to InsightIDR

How To

Manage Credentials
Search Your Logs
Transform Logs to Universal Event Format
Delete and Reinstall a Collector
Deploy Deception Technology
Investigate an Asset or User
Manage Event Sources
- Edit Event Sources
- Copy Event Sources to a New Collector
Export Data
Access AWS Resources with EC2 IAM Roles
Monitor Your Security Operations Activities

Concepts and Usage

Rapid7 Resource Names
Detection Rules
Notable Events
Investigations
Investigate Threat Command Alerts
Assets on Your Domain
Dashboards and Reports
- R7 Managed: Endpoint Visibility Validation Dashboard
Deception Technology
File Access Activity Monitoring
File Integrity Monitoring
- File Integrity Monitoring for Linux
- Search Logs for FIM Events
Log Search
Network Rules
Network Traffic Analysis
Community Threats
Threats
- Utilize Existing Threats
- Add and Manage Threats
Users and Accounts on Your Domain
Quick Actions
Data Storage and Retention FAQs

Detection Library

Overview
ABA: Rules by Threat
ABA: Rules by Endpoint
UBA Detection Rules

InsightIDR REST APIs

InsightIDR REST APIs

Event Source Configuration

InsightIDR Event Sources
Data Collection Methods
Advanced Event Source Settings
Monitor Event Source Health
Event Source Troubleshooting
Auto Configure
Rapid7 Products
- InsightVM
- Metasploit
Active Directory
- Troubleshooting Active Directory
Advanced Malware
- FireEye NX
Cloud Services
Data Exporter
Microsoft SQL Database Audit Logs
DHCP
DNS
Email & ActiveSync
- OWA/ActiveSync
Firewall
IDS
Ingress Authentication
- Zscaler LSS
LDAP
- LDAP Troubleshooting
- AWS Managed Microsoft AD
Universal Event Sources
Raw Data
Log Aggregators
Third Party Alerts
Virus Scan
VPN
Web Proxy
Web Server Access
- Microsoft IIS

Administration

Monthly Data Usage
Browser Settings
Email Notifications
User Management
Single Sign-On

Release Notes

InsightIDR release notes

Support

Contact the Rapid7 Support team
Share an idea with Rapid7

Detection Library

The Detection Library has moved!

You can now find the latest Attacker Behavior Analytics (ABA) detection rules here. To learn more about the alerts that are generated by our User Behavior Analytics (UBA) rules, check out our documentation on built-in alerts.

Did this page help you?

Concepts and Usage

Custom Detection Rules FAQ

Concepts and Usage

Create and Manage Basic Detection Rules

CUSTOMER SUPPORT

+1-866-390-8113 (Toll Free)

SALES SUPPORT

+1-866-772-7437 (Toll Free)

Need to report an Escalation or a Breach?

SOLUTIONS

XDR & SIEM Platform Managed Threat Complete Cloud Risk Complete

SUPPORT & RESOURCES

Product Support Resource Library Our Customers Events & Webcasts Training & Certification Cybersecurity Fundamentals Vulnerability & Exploit Database

ABOUT US

Company Diversity, Equity, and Inclusion Leadership News & Press Releases Public Policy Open Source Investors

CONNECT WITH US

Contact Blog Support Login Careers

Rapid7 Official Cybersecurity Partner of the Boston Bruins

© Rapid7

|

|

|

Trust