insightidr.help.rapid7.comInsightIDR Overview | InsightIDR Documentation

Products NEW Cloud Migration with Unlimited Risk Coverage Cloud Risk Complete Explore Offer Insight Platform Solutions Next-Gen SIEM INSIGHTIDR Cloud Security INSIGHTCLOUDSEC Vulnerability Management INSIGHTVM Threat Intelligence THREAT COMMAND Dynamic Application Security Testing INSIGHTAPPSEC Orchestration & Automation (SOAR) INSIGHTCONNECT More Solutions Penetration Testing METASPLOIT On-Prem Vulnerability Management NEXPOSE Digital Forensics and Incident Response (DFIR) Velociraptor Services NEW MDR with Unlimited Incident Response Managed Threat Complete Explore offer MANAGED SERVICES Managed Detection and Response 24/7 MONITORING & REMEDIATION FROM MDR EXPERTS Managed Vulnerability Management PERFECTLY OPTIMIZED RISK ASSESSMENT Managed Application Security SCAN MANAGEMENT & VULNERABILITY VALIDATION OTHER SERVICES Product Consulting QUICK-START & CONFIGURATION Training & Certification SKILLS & ADVANCEMENT Penetration Services TEST YOUR DEFENSES IN REAL-TIME IoT Security Testing SECURE EVERYTHING CONNECTED TO A CONNECTED WORLD Premium Support PRIORITY HELP & FASTER SOLUTIONS Support & Resources SAVE THE DATE Take command of your attack surface on May 21 TAKE COMMAND | Virtual Summit Register Today SUPPORT Support Portal CONTACT CUSTOMER SUPPORT Product Documentation EXPLORE PRODUCT GUIDES Release Notes DISCOVER THE LATEST PRODUCT UPDATES Contact Us TALK TO SALES RESOURCES Fundamentals FOUNDATIONAL SECURITY KNOWLEDGE Blog THE LATEST INDUSTRY NEWS AND SECURITY EXPERTISE Resources Library E-BOOKS, WHITE PAPERS, VIDEOS & BRIEFS Extensions Library PLUGINS, INTEGRATIONS & DEVELOPER COMMUNITY Webcasts & Events UPCOMING OPPORTUNITIES TO CONNECT WITH US Vulnerability & Exploit Database SEARCH THE LATEST SECURITY RESEARCH Company OVERVIEWOUR STORY Leadership EXECUTIVE TEAM & BOARD News & Press Releases THE LATEST FROM OUR NEWSROOM Careers JOIN RAPID7 Our Customers Their Success Stories Partners Rapid7 Partner Ecosystem Investors Investor Relations COMMUNITY & CULTURE Social Good OUR COMMITMENT & APPROACH Rapid7 Cybersecurity Foundation BUILDING THE FUTURE Diversity, Equity & Inclusion EMPOWERING PEOPLE Open Source STRENGTHENING CYBERSECURITY Public Policy ENGAGEMENT & ADVOCACY Boston Bruins Our Partnership RESEARCH Sign In Documentation InsightIDR AppSpider Insight Agent InsightAppSec InsightCloudSec InsightConnect Insight Platform InsightIDR Insight Network Sensor InsightOps InsightVM Metasploit Nexpose tCell Managed Services Threat Command Products NEW Cloud Migration with Unlimited Risk Coverage Cloud Risk Complete Explore Offer Insight Platform Solutions Next-Gen SIEM INSIGHTIDR Cloud Security INSIGHTCLOUDSEC Vulnerability Management INSIGHTVM Threat Intelligence THREAT COMMAND Dynamic Application Security Testing INSIGHTAPPSEC Orchestration & Automation (SOAR) INSIGHTCONNECT More Solutions Penetration Testing METASPLOIT On-Prem Vulnerability Management NEXPOSE Digital Forensics and Incident Response (DFIR) Velociraptor Services NEW MDR with Unlimited Incident Response Managed Threat Complete Explore offer MANAGED SERVICES Managed Detection and Response 24/7 MONITORING & REMEDIATION FROM MDR EXPERTS Managed Vulnerability Management PERFECTLY OPTIMIZED RISK ASSESSMENT Managed Application Security SCAN MANAGEMENT & VULNERABILITY VALIDATION OTHER SERVICES Product Consulting QUICK-START & CONFIGURATION Training & Certification SKILLS & ADVANCEMENT Penetration Services TEST YOUR DEFENSES IN REAL-TIME IoT Security Testing SECURE EVERYTHING CONNECTED TO A CONNECTED WORLD Premium Support PRIORITY HELP & FASTER SOLUTIONS Support & Resources SAVE THE DATE Take command of your attack surface on May 21 TAKE COMMAND | Virtual Summit Register Today SUPPORT Support Portal CONTACT CUSTOMER SUPPORT Product Documentation EXPLORE PRODUCT GUIDES Release Notes DISCOVER THE LATEST PRODUCT UPDATES Contact Us TALK TO SALES RESOURCES Fundamentals FOUNDATIONAL SECURITY KNOWLEDGE Blog THE LATEST INDUSTRY NEWS AND SECURITY EXPERTISE Resources Library E-BOOKS, WHITE PAPERS, VIDEOS & BRIEFS Extensions Library PLUGINS, INTEGRATIONS & DEVELOPER COMMUNITY Webcasts & Events UPCOMING OPPORTUNITIES TO CONNECT WITH US Vulnerability & Exploit Database SEARCH THE LATEST SECURITY RESEARCH Company OVERVIEWOUR STORY Leadership EXECUTIVE TEAM & BOARD News & Press Releases THE LATEST FROM OUR NEWSROOM Careers JOIN RAPID7 Our Customers Their Success Stories Partners Rapid7 Partner Ecosystem Investors Investor Relations COMMUNITY & CULTURE Social Good OUR COMMITMENT & APPROACH Rapid7 Cybersecurity Foundation BUILDING THE FUTURE Diversity, Equity & Inclusion EMPOWERING PEOPLE Open Source STRENGTHENING CYBERSECURITY Public Policy ENGAGEMENT & ADVOCACY Boston Bruins Our Partnership RESEARCH Sign In Documentation InsightIDR AppSpider Insight Agent InsightAppSec InsightCloudSec InsightConnect Insight Platform InsightIDR Insight Network Sensor InsightOps InsightVM Metasploit Nexpose tCell Managed Services Threat Command Release Notes Docs Menu Getting Started with InsightIDR InsightIDR Overview Essential | Quick Start Guide Advanced | Quick Start Guide Ultimate | Quick Start Guide Setup and Deployment System Requirements Setting Up a Service Account Network and Environment Audit Core Event Sources Log Data Collection and Storage Data Archiving Non-Admin Domain Controller Account Read-Only Domain Controllers Ports Used by InsightIDR Collector Overview Collector Requirements Collector Installation and Deployment Collector Troubleshooting Collector Proxy Configuration Insight Agent Configure the Insight Agent to Send Additional Logs Microsoft Windows Defender Antivirus Velociraptor Integration Endpoint Scan FIM Recommendations Other Deployment Options Automation Get Started with Automation Get Started with Automation for Legacy Detection Rules and Basic Detection Rules Triggers for Legacy Detection Rules and Basic Detection Rules Insight Orchestrator Overview Configure Connections For Automation Automation Workflow Templates Automation Workflows Kill a Process Suspend or Disable a User Quarantine an Asset Create a ServiceNow or JIRA Ticket Automated Enrichment Workflows Enrich Alert Data with Open Source Plugins Get Started with On Demand Response Actions Automation Troubleshooting Send InsightConnect Events to InsightIDR How To Manage Credentials Search Your Logs Transform Logs to Universal Event Format Delete and Reinstall a Collector Deploy Deception Technology Investigate an Asset or User Manage Event Sources Edit Event Sources Copy Event Sources to a New Collector Export Data Access AWS Resources with EC2 IAM Roles Monitor Your Security Operations Activities Concepts and Usage Rapid7 Resource Names Detection Rules Modify Detection Rules Modify Legacy Detection Rules Custom Detection Rules Custom Detection Rules FAQ Detection Library Create and Manage Basic Detection Rules Basic Detection Rule Details Basic Detection Rules and InsightConnect Notable Events Alerts Take Action on an Alert Investigations Create an investigation Analyze an investigation Schedule endpoint queries Close an investigation Multi-Customer Investigations Investigate Threat Command Alerts Velociraptor Assets on Your Domain Mark an Asset as Restricted or Allow an Asset Manage your Processes and Hashes Exploitable Vulnerabilities Lateral Movement Dashboards and Reports R7 Managed: Endpoint Visibility Validation Dashboard Deception Technology Honeypot Honey Users Honey Files Honey Credentials Honey Alerts Troubleshooting Honeypots AWS Honeypots File Access Activity Monitoring File Integrity Monitoring File Integrity Monitoring for Linux Search Logs for FIM Events Log Search Log Sets You Can Search Components for Building a Query Keys to Use in Your Queries Example Queries Use Variables in Queries Tips and Tricks for Building Queries Leverage Enhanced Endpoint Telemetry Data Create Custom Parsing Rules Legacy Log Search Glossary Network Rules Network Zones and Policies Owned and Ignored Domains Firewall Rules IP Addresses Network...