InsightIDR Event Sources

To send log events in InsightIDR, you can either forward them from a Security Information and Event Management system (SIEM) or you can collect the log events directly from an InsightIDR Event Source. It is also possible to combine these methods: you can forward some event types from the SIEM and then send the remaining ones directly. InsightIDR also supports generic event collection from a variety of sources and technologies and exporting events to another tool.

SIEM

You can use a SIEM tool or log aggregator to forward events from a source to InsightIDR. For all SIEM/log aggregation productions, follow the vendor documentation to forward the log/event data to a collector using standard syslog for both the log format and also the transport methodology.

Before your InsightIDR deployment, if you will be forwarding logs from your SIEM, you should be prepared to perform the necessary steps on the SIEM. You can either complete the setup before the deployment or complete the setup with your Rapid7 Consultant during the deployment.

InsightIDR supports the following log aggregators:

• HP ArcSight
• LogRhythm
• IBM QRadar
• Splunk

InsightIDR also supports:

• McAfee Enterprise Security Manager (formally known as Nitrosecurity)
• FireEye Threat Analytics Platform (TAP)

InsightIDR Event Sources

Event Sources can send data to InsightIDR in two ways:

• On-premises Rapid7 Collector - The benefits of using a Rapid7 Collector are normalization and data attribution. Review the Collector Overview for more information. Most Event Sources support the Rapid7 Collector. You can find the full list by navigating to Data Collection > Event Sources > Add Event Source and filtering by Collected By > Collectors.

• Cloud (Rapid7 Cloud Platform) - The benefits of cloud Event Sources are:

  • You can set up your Event Sources without the need for an on-premises collector. This saves you the time you would have spent installing the collector and the cost of maintaining the computer on which it's installed.
  • Event logs are directly ingested into the Rapid7 Platform. This cuts down on network traffic and means that your data reaches InsightIDR much faster.
  • Rapid7 can more easily provide support and maintenance if you need to troubleshoot an issue.

  You can find the full list of cloud Event Sources by navigating to Data Collection > Event Sources > Add Event Source and filtering by Collected By > Rapid7 Cloud Platform.

Event source types

The following collapsible sections list the Event Sources that are supported by InsightIDR organized by category:

Miscellaneous event collection and exporting

Rapid7 supports event collection from miscellaneous sources as well as exporting events to other tools. The following collapsible sections contain more information about each type of supported event collection or export method.