InsightConnect is Rapid7’s security orchestration and automation response (SOAR) solution. InsightConnect helps you accelerate, streamline, and integrate your time-intensive security processes, without little to no coding required by your security team. When you use InsightConnect, you can run your multi-solution processes automatically, and free up your security team’s bandwidth to tackle other challenges.
Workflows seamlessly map your security stack into automated processes with APIs, Insight products, and over 240 plugins. When you need to involve your team, InsightConnect centralizes data from your security tools so your team can take efficient action.
InsightConnect workflows are the security processes you’ll automate, like disabling users in Active Directory or investigating a phishing email reported by a member of your team. Workflows are made of triggers, which kick-start the automation, and steps, which map to your security processes and integrate your tools. Once they’re configured, you can connect your tools and collect data for future auditing or reporting
InsightConnect has over 240+ plugins, or easy-to-install integrations that synchronize with existing tools in your security stack. You can import them in-product and use them right away.
When your security processes require manual action, InsightConnect aggregates data from your tools and gives them to your security team for easy analysis. Human decision steps pause your workflow until a member of your team provides expert input.
When you run an active InsightConnect workflow, it create a job, which contain the artifacts, output data, and logs from the single workflow execution. Create reports and audit your security with job details.
InsightConnect works with your other Insight products via Insight Orchestrators.
An orchestrator is an embedded tool that is installed in your environment and accesses on-prem products, services, and tools. If you have these across different networks, you’ll need to install an Orchestrator on each network.
The Insight Orchestrator also enables the Automation capability across the Insight platform, which allows Insight products to use InsightConnect workflows. InsightIDR and InsightVM are the current supported products.