Rapid7 InsightIDR (v2.0.11)
Rapid7 InsightIDR is a Cloud-Based SIEM that detect and respond to security incidents.
- Author
- Cortex XSOAR
- Support
- xsoar
- URL
- https://www.paloaltonetworks.com/cortex
- Categories
- Analytics & SIEM
Integrations (1)
- Rapid7 InsightIDR
Layouts (1)
- Rapid7 InsightIDR - Layout
Playbooks (5)
- Rapid7 InsightIDR - Execution Flow Indicators Hunting
- Rapid7 InsightIDR - File Indicators Hunting
- Rapid7 InsightIDR - HTTP Requests Indicators Hunting
- Rapid7 InsightIDR - Indicators Hunting
- Rapid7 InsightIDR - Traffic Indicators Hunting
README
Overview
Rapid7 InsightIDR is a cloud-based SIEM that provides real-time alerting and investigation tools to detect and respond to security incidents.
The Rapid7 InsightIDR integration can significantly improve your organization’s incident response capabilities and overall security posture.
This integration was integrated and tested with version 1.0.0 of Rapid7 InsightIDR.
What does this pack do?
-
Fetch investigations automatically from InsightIDR and populate incident fields in Cortex XSOAR.
-
Retrieve and manage investigations, as well as assign users to investigations.
-
Create, update, and delete threat indicators within InsightIDR lists.
-
Execute queries and download logs stored in the InsightIDR instance.
This pack includes the following playbooks:
-
Rapid7 InsightIDR - Indicator Hunting - queries Rapid7 InsightIDR for various indicators and returns the results.
-
Rapid7 InsightIDR - Traffic Indicators Hunting - queries Rapid7 InsightIDR for traffic indicators and returns the results.
-
Rapid7 InsightIDR - HTTP Requests Indicators Hunting - queries Rapid7 InsightIDR for HTTP requests indicators and returns the results.
-
Rapid7 InsightIDR - File Indicators Hunting - queries Rapid7 InsightIDR for file indicators and returns the results.
-
Rapid7 InsightIDR - Execution Flow Indicators Hunting - queries Rapid7 InsightIDR for execution flow indicators and returns the results.