insightidr.help.rapid7.comInsightIDR Overview | InsightIDR Documentation

Products Insight Solutions InsightIDR User Behavior Analytics & SIEM InsightVM Vulnerability Management InsightAppSec Dynamic Application Security Testing InsightConnect Orchestration & Automation InsightOps Log Management DivvyCloud by Rapid7 Continuous Security and Compliance for Cloud More Solutions Metasploit Penetration Testing Nexpose Vulnerability Management On-Premises AppSpider Application Security On-Premises tCell by Rapid7 Application Monitoring & Protection Insight Cloud Free Trial Services SERVICES Managed Services Security Consulting Product Consulting Training & Certification Customer Success Support & Resources SUPPORT Support Portal CONTACT CUSTOMER SUPPORT Product Documentation EXPLORE PRODUCT GUIDES Release Notes DISCOVER THE LATEST PRODUCT UPDATES Contact Us TALK TO SALES RESOURCES Fundamentals FOUNDATIONAL SECURITY KNOWLEDGE Blog THE LATEST INDUSTRY NEWS AND SECURITY EXPERTISE Resources Library E-BOOKS, WHITE PAPERS, VIDEOS & BRIEFS Extensions Library PLUGINS, INTEGRATIONS & DEVELOPER COMMUNITY Partners RAPID7 PARTNER ECOSYSTEM Webcasts & Events UPCOMING OPPORTUNITIES TO CONNECT WITH US Vulnerability & Exploit Database SEARCH THE LATEST SECURITY RESEARCH Research Sign In Documentation InsightIDR AppSpider Insight Agent InsightAppSec InsightConnect Insight Cloud InsightIDR Insight Network Sensor InsightOps InsightVM Metasploit Nexpose tCell Rapid7 Services Products Insight Solutions InsightIDR User Behavior Analytics & SIEM InsightVM Vulnerability Management InsightAppSec Dynamic Application Security Testing InsightConnect Orchestration & Automation InsightOps Log Management DivvyCloud by Rapid7 Continuous Security and Compliance for Cloud More Solutions Metasploit Penetration Testing Nexpose Vulnerability Management On-Premises AppSpider Application Security On-Premises tCell by Rapid7 Application Monitoring & Protection Insight Cloud Free Trial Services SERVICES Managed Services Security Consulting Product Consulting Training & Certification Customer Success Support & Resources SUPPORT Support Portal CONTACT CUSTOMER SUPPORT Product Documentation EXPLORE PRODUCT GUIDES Release Notes DISCOVER THE LATEST PRODUCT UPDATES Contact Us TALK TO SALES RESOURCES Fundamentals FOUNDATIONAL SECURITY KNOWLEDGE Blog THE LATEST INDUSTRY NEWS AND SECURITY EXPERTISE Resources Library E-BOOKS, WHITE PAPERS, VIDEOS & BRIEFS Extensions Library PLUGINS, INTEGRATIONS & DEVELOPER COMMUNITY Partners RAPID7 PARTNER ECOSYSTEM Webcasts & Events UPCOMING OPPORTUNITIES TO CONNECT WITH US Vulnerability & Exploit Database SEARCH THE LATEST SECURITY RESEARCH Research Sign In Documentation InsightIDR AppSpider Insight Agent InsightAppSec InsightConnect Insight Cloud InsightIDR Insight Network Sensor InsightOps InsightVM Metasploit Nexpose tCell Rapid7 Services Release Notes Welcome InsightIDR Overview InsightIDR Quick Start Guide Setup and Deployment System Requirements Setting Up a Service Account Network and Environment Audit Foundational Event Sources Log Data Collection and Storage S3 Archiving Non-Admin Domain Controller Account Read-Only Domain Controllers Ports Used by InsightIDR Collector Overview Collector Requirements Collector Installation and Deployment Collector Troubleshooting Collector Proxy Configuration Insight Agent Endpoint Monitor Configure the Insight Agent to Send Logs Microsoft Windows Defender Antivirus Other Deployment Options Automation Get Started with Automation Insight Orchestrator Overview Configure Connections For Automation Automation Workflow Templates Automation Workflows Kill a Process Suspend or Disable a User Quarantine an Asset Create a ServiceNow or JIRA Ticket Automated Enrichment Workflows Enrich Alert Data with Open Source Plugins Alert Triggers Automation Troubleshooting Send InsightConnect Events to InsightIDR How To Manage Credentials Search Your Logs Transform Logs to Universal Event Format Delete and Reinstall a Collector Deploy Deception Technology Investigate an Asset or User Integrate Other Rapid7 Products Integrate Metasploit Integrate InsightVM Copy Event Sources to a New Collector Export Data Access AWS Resources with EC2 IAM Roles Monitor Your Security Operations Activities Best Practices FIM Recommendations Concepts and Usage Alerts Create and Manage Custom Alerts Custom Alert Details Custom Alerts and InsightConnect Modify Built-In Alerts Attacker Behavior Analytics Detection Library Assets on Your Domain Restrict or Whitelist an Asset Asset Processes Exploitable Vulnerabilities Lateral Movement Dashboards and Reports Create and Manage Dashboards Generate and Manage Reports Add and Manage Cards Deception Technology Honeypot Honey Users Honey Files Honey Credentials Honey Alerts Troubleshooting Honeypots AWS Honeypots File Access Activity Monitoring File Integrity Monitoring File Integrity Monitoring for Linux Search Logs for FIM Events Log Search Use Visual Search Build a Query Use a Search Language Example Queries Loose Search Automatic Log Structuring Custom Parsing Tool Entry Inspector Enhanced Endpoint Telemetry Network Rules Network Zones and Policies Owned and Ignored Domains Firewall Rules IP Addresses Network Traffic Analysis Investigations Create and Manage Investigations Scheduled Forensics Add Data to Investigations InsightIDR REST API Platform Audit Logs API Threats Utilize Existing Threats Add and Manage Threats Users and Accounts on Your Domain Admin Accounts Non-Expiring and Service Accounts Shared and Linked Accounts Watchlist and Risky Users Account Tags Cold Storage Logs Audit Logging Detection Library Overview Attacker Behavior Analytics APT Groups BlackOasis BlackTech Blind Eagle BRONZE BUTLER Carbanak Cobalt Group Dark Caracal Darkhotel DarkHydrus Deep Panda DragonOK Dust Storm Elderwood Energetic Bear FIN Groups Gallmaker Gamaredon Group GCMAN Gorgon Group Group 5 Group 72 Honeybee KeyBoy Lazarus Group Leafminer Lotus Blossom Machete Mofang Molerats Muddywater Naikon NEODYMIUM Night Dragon Orangeworm Patchwork PLATINUM Poseidon Group Promethium Rancor Rocke RTM Sandworm Team Scarlet Mimic SilverTerrier Soft Cell Sowbug Stealth Falcon Stolen Pencil Strider Suckfly TA459 Taidoor The White Company Threat Group-1314 Thrip Turla Velvet Chollima Whitefly Windshift WIRTE Wizard Spider North Korean State-Sponsored Actor Windows Suspicious Process Event Source Configuration InsightIDR Event Sources Data Collection Methods Advanced Event Source Settings Auto Configure Active Directory Troubleshooting Active Directory Advanced Malware FireEye NX Cloud Services AWS CloudTrail API AWS CloudTrail SQS Microsoft Office 365 Box.com Duo Security Google Apps Google Cloud Platform Okta Salesforce Centrify SSO Idaptive SSO OneLogin Microsoft Azure Cisco AMP for Endpoints Mimecast Proofpoint TAP Zoom Pro Data Exporter HP ArcSight ServiceNow Universal Webhook Resilient Systems Microsoft SQL Database Audit Logs DHCP Microsoft DHCP Cisco IOS Cisco Meraki Infoblox Trinzic ISC dhcpd DHCP Troubleshooting DNS Microsoft DNS Cisco Umbrella ISC Bind9 DNS Troubleshooting Email & ActiveSync OWA/ActiveSync Firewall Sophos UTM SonicWALL Firewall Cisco ASA Palo Alto Check Point Fortinet Firewall Barracuda Firewall WatchGuard XTM Sophos XG Firewall Cisco FirePower Threat Defense pfSense Firewall Juniper Networks ScreenOS Forcepoint Firewall IDS McAfee IDS Security Onion Snort Cisco Firepower Sentinel IPS F5 Networks BIG-IP Local Traffic Manager LDAP LDAP Troubleshooting AWS Managed Microsoft AD Universal Event Sources Rapid7 Universal DHCP Rapid7 Universal Antivirus Rapid7 Universal Ingress Authentication Rapid7 Universal VPN Raw Data Generic Windows Event Log Custom Logs DivvyCloud AWS SQS NXLog Generic Syslog Syslog Logging Log Aggregators LogRhythm Splunk IBM QRadar Third Party Alerts AWS GuardDuty Carbon Black EDR Crowdstrike Falcon CyberArk Vault Cybereason DarkTrace Microsoft Defender ATP Netskope Palo Alto Networks Traps ESM Varonis DatAd...