Managed Threat Complete Advanced: Quick Start Guide

Access these Rapid7 products on the Insight Platform:

Core products

Collaborate with these Rapid7 resources to extend your security operations:

Customer Advisor Support Center

All customers can contact the Customer Advisor Support Center to quickly get help with common issues. The Customer Advisor Support Center can help with questions about security best practices and product functionality (for example, setting up Active Response for remote containment).

Managed Detection and Response Security Operations Center (MDR SOC)

The MDR SOC handles routine detection and response on behalf of your company, providing continuous security coverage. Working alongside your team in InsightIDR, the MDR SOC provides extra support for triaging alerts and responding to investigations. Learn more about Managed Detection and Response.

Incident Response Consultants

Rapid7's Incident Response Consultants are a dedicated group that lead incident response for complex or high-impact incidents in your environment. As experienced incident response professionals, this team also provides ongoing training and support to the MDR SOC.

All customers can contact the Incident Response Consultants for help with active incidents.

Threat Intelligence Detection and Engineering

As the first vulnerability management provider to become a CVE Numbering Authority, Rapid7 has a unique understanding of the modern threat landscape, including attackers' ability to compromise your environment. The Threat Intelligence Detection and Engineering team develops the detection mechanisms to uncover vulnerabilities, exploits, and attack campaigns in your environment.

Rapid7 Labs

Rapid7 Labs tracks adversaries, shares proprietary, curated intelligence and research, and builds trusted open-source communities. You can leverage the work done by Rapid7 Labs to stay up to date on the latest zero day vulnerabilities.

Dedicated Managed Detection and Response (MDR) Customer Advisor

The Customer Advisory team is your strategic partner who works with you—from initial technology deployment through incident response and ongoing security consultation—to guide your organization's security maturity. Throughout your Managed Threat Complete service term, your Customer Advisor (CA) will frequently communicate with your team to provide updates on service delivery, reporting, metrics, technology health, and to ensure Rapid7 is helping you address your security goals. Additionally, your CA will work closely with Rapid7’s MDR SOC team to understand and convey information relevant to any investigations and incidents.

Your Rapid7 services teams generate these reports, which you can access through the Services Portal:

Core reports

Advanced and Ultimate reports

Rapid7's products and services send you these notifications through email:

Emergent threat response notifications

MDR SOC notifications

InsightIDR product notifications

Complete these steps:

1. Deploy your first Insight Agent. The Insight Agent gives you endpoint visibility and detection by collecting live system information—including basic asset identification information, running processes, and logs—from your assets and sending this data back to the Insight Platform for analysis. Refer to the Insight Agent documentation for instructions.
2. Provide input on your Onboarding Success Plan. After you receive your Onboarding Success Plan from Rapid7, review it to understand its scope. Share any feedback or adjustments with Rapid7 to ensure that you and your partners are aligned on your onboarding goals and how success will be measured.

Rapid7 completes these action items:

1. Introduce your Rapid7 team. You can expect your Rapid7 Account Executive (AE) to contact you with an official welcome email, which your Customer Success Manager (CSM) is copied on. From this welcome email, you schedule a kickoff call with your Rapid7 team, including your AE, CSM, and Sales Engineer (SE). As a Managed Threat Complete customer, you have access to these Rapid7 resources.
2. Refine your Onboarding Success Plan. Your Rapid7 team documents your goals for Managed Threat Complete in an Onboarding Success Plan. Your CSM may already understand your goals and metrics for success based on conversations with other members of your Rapid7 team, but you can collaborate with your CSM to refine the Onboarding Success Plan together.
3. Schedule services. You can expect an email from your Rapid7 CSM to schedule enablement sessions. The topics of these sessions are:
   • Managed Detection and Response Session 1 - Insight Platform setup; validate network sensor; Orchestrator overview.
   • Managed Detection and Response Session 2 - Event source setup; validate deception technology (review and discussion); review InsightIDR settings.
   • Active Response Session - Configure response actions for LDAP user containment; configure response actions for endpoint containment.
   • InsightVM Session - Implement hosted console configuration or review existing InsightVM console to determine the best migration process to execute.

Complete these steps:

1. Deploy more Insight Agents in your environment. Refer to the Insight Agent documentation for instructions. To gain full visibility of your environment, an Insight Agent must be present on every asset in your environment.
2. Watch the Service Launch video. The Service Launch video is available at: https://engage.rapid7.com/viewer/660fff85b6882eee29d3fca6
3. Watch the Incident Response Planning Workshop video. The video is available at: https://academy.rapid7.com/mtc-essentials-webinar-incident-response-planning-workshop
4. Familiarize yourself with the Customer Advisor Support Center (CASC). All customers can contact the CASC to quickly get help with common issues. The CASC can help with questions about security best practices and product functionality (for example, setting up Active Response for remote containment).

Rapid7 completes these action items:

1. Begin continuously monitoring assets with the Insight Agent. With the Insight Agent deployed on your assets, you gain access to all relevant security information about your endpoints. Refer to the Insight Agent documentation to learn more about how the Insight Agent works.
2. Investigate alerts, validate incidents, and eliminate false positives. During this step, your Rapid7 team reviews the alerts in your environment to determine if they require further investigation or if they are false positives. This validation is essential for Rapid7 to establish your environment's baseline activity.

Complete these steps:

1. Read the Managed Threat Complete deployment handbook. You will receive the Managed Threat Complete deployment handbook in your welcome email from Rapid7.
2. Get change control approval. Follow any required change control processes in your environment to secure approval so that you can make the required network configuration changes. Change control approvals will vary based on your environment, but may pertain to firewall rules and service accounts.
3. Provision servers for Collectors, Scan Engines, and the Insight Orchestrator. You must configure a dedicated server for each Collector, Scan Engine, and Insight Orchestrator that you deploy in your environment. Refer to the requirements for each component:
   • Collector Requirements
   • Scan Engine Requirements
   • Insight Orchestrator Requirements
4. Complete firewall rules. You must configure your firewall based on the requirements for each component. Refer to the documentation:
   • Collector firewall Requirements
   • Security Console and Scan Engine firewall requirements
   • Insight Orchestrator Network Connectivity Requirements
5. Set up a service account. To begin collecting log data, refer to the InsightIDR documentation for instructions on how to set up a service account.

Complete these actions alongside your Rapid7 team:

1. Configure InsightIDR. Follow the instructions in the InsightIDR Ultimate Quick Start Guide to set up InsightIDR.
2. Configure the InsightVM hosted console. The Managed Operations team will build out the console for you. Your Rapid7 team will provide instructions and lead you through this configuration process.
3. Set up the InsightConnect Orchestrator and Active Response. Follow the InsightConnect documentation to install and activate the Orchestrator. The Managed Operations team will help you set up Active Response. Review the Active Response 2.0 requirements and the on demand response actions.
4. Verify that all Insight product configurations follow best practices. If you have already configured these Insight products, confirm with your Rapid7 team that each of the configurations are working as expected. Your Product Security Consultant can help you verify that your Insight products are set up for success.

Rapid7 completes these action items:

1. Continuously monitor your environment. With a global services organization headquartered in Washington, DC, Rapid7 prides itself on recruiting and retaining top talent from some of the most elite intelligence agencies and cyber hubs in the world. These security experts work as an extension of your teams. Rapid7 offers close collaboration and coaching for companies that seek a deeply engaged partnership, but can also take control for companies that need immediate support quickly. Our expert SOC team of detection and response analysts monitors your environment for malicious activity, investigates incidents, and responds to threats. This always-on SOC keeps their eyes on your environment around the clock, allowing your team to focus on other strategic security initiatives, while Rapid7 triages and investigates on your behalf. If something happens, Rapid7 seamlessly pivots over into incident response.
2. Assess your security posture. To build the foundation for your security program and relationship with Rapid7, Rapid7 creates a Security Posture Assessment report, which hunts for potential avenues for a future breach and assess your current security posture. The report provides remediation and mitigation recommendations to reduce risks, as well as critical insights and benchmarks for your current security program. If the Security Posture Assessment finds that there is an active compromise, the incident response process will be initiated immediately. Note that the Security Posture Assessment is performed only once the Insight Agent is deployed to 80% or more of your environment.
3. Perform hypothesis-driven threat hunts. Your Rapid7 team conducts human-led threat hunts across your environment as new Threat Third Parties (TTPs) emerge. With access to thousands of customer environments, a security research team, and open source communities, Rapid7 stays ahead of attacker behavior as new breach techniques emerge. Typically, these hunts happen multiple times a month. If a breach is detected during a hunt, Rapid7 will immediately pivot into incident response. Additionally, as Rapid7 teams note emerging TTPs and conduct hunts across customer environments, Rapid7 writes new detections for all customers (MDR, Managed Threat Complete, and InsightIDR).
4. Create ongoing reports. Your Rapid7 team creates a Monthly Service Report that provides metrics and context about threat detection and incident response activities conducted in the previous month, along with information about the health of detection and response controls in your environment.
5. Validate solution implementation. Your Rapid7 team will confirm that all parts of the Managed Threat Complete offering are working as expected—from your point of view as a customer, and our point of view as your security operations center. Once validated, your onboarding is complete.