Rapid7 InsightIDR

Classifies Rapid7 InsightIDR incidents

Maps incoming InsightIDR alert fields.

Rapid7’s InsightIDR is your security center for incident detection and response, authentication monitoring, and endpoint visibility. Together, these form Extended Detection and Response (XDR). InsightIDR identifies unauthorized access from external and internal threats and highlights suspicious activity so you don’t have to weed through thousands of data streams.

This playbook queries Rapid7 InsightIDR SIEM for indicators associated with HTTP requests, including HTTP request methods, user agents, URIs, and Ja3.

Note that multiple search values should be separated by commas only (without spaces or any special characters).

This playbook facilitates threat hunting and detection of IOCs within Rapid7 InsightIDR SIEM logs utilizing four sub-playbooks. The sub-playbooks query Rapid7 InsightIDR SIEM for different indicators including files, traffic, HTTP requests, and execution flows indicators.

Note that multiple search values should be separated by commas only (without spaces or any special characters).

Supported IOCs for this playbook:

• MD5
• SHA1
• SHA256
• IP Address
• URLDomain
• Registry Value
• Registry Key
• Registry Hives
• Command Line
• File Name
• Process Name
• HTTP Request Methods
• User Agent
• Port Number
• File Path
• Geolocation
• Email Address
• CIDR
• URI
• Ja3
• FileType

This playbook queries Rapid7 InsightIDR SIEM for traffic indicators, including URLs, domains, ports, IP addresses, IP ranges (CIDR), email addresses, and geolocations.

Note that multiple search values should be separated by commas only (without spaces or any special characters).

This playbook queries Rapid7 InsightIDR SIEM for file indicators, including MD5 hashes, SHA256 hashes, SHA1 hashes, file names, file types, and file paths.

Note that multiple search values should be separated by commas only (without spaces or any special characters).

This playbook queries Rapid7 InsightIDR SIEM for execution flow indicators, including registry values, registry keys, registry hives, commands, processes name, and applications.

Note that multiple search values should be separated by commas only (without spaces or any special characters).

Classifies Rapid7 InsightIDR incidents

Maps incoming InsightIDR alert fields.

Rapid7’s InsightIDR is your security center for incident detection and response, authentication monitoring, and endpoint visibility. Together, these form Extended Detection and Response (XDR). InsightIDR identifies unauthorized access from external and internal threats and highlights suspicious activity so you don’t have to weed through thousands of data streams.

This playbook facilitates threat hunting and detection of IOCs within Rapid7 InsightIDR SIEM logs utilizing four sub-playbooks. The sub-playbooks query Rapid7 InsightIDR SIEM for different indicators including files, traffic, HTTP requests, and execution flows indicators.

Note that multiple search values should be separated by commas only (without spaces or any special characters).

Supported IOCs for this playbook:

• MD5
• SHA1
• SHA256
• IP Address
• URLDomain
• Registry Value
• Registry Key
• Registry Hives
• Command Line
• File Name
• Process Name
• HTTP Request Methods
• User Agent
• Port Number
• File Path
• Geolocation
• Email Address
• CIDR
• URI
• Ja3
• FileType

This playbook queries Rapid7 InsightIDR SIEM for file indicators, including MD5 hashes, SHA256 hashes, SHA1 hashes, file names, file types, and file paths.

Note that multiple search values should be separated by commas only (without spaces or any special characters).

This playbook queries Rapid7 InsightIDR SIEM for traffic indicators, including URLs, domains, ports, IP addresses, IP ranges (CIDR), email addresses, and geolocations.

Note that multiple search values should be separated by commas only (without spaces or any special characters).

This playbook queries Rapid7 InsightIDR SIEM for execution flow indicators, including registry values, registry keys, registry hives, commands, processes name, and applications.

Note that multiple search values should be separated by commas only (without spaces or any special characters).

This playbook queries Rapid7 InsightIDR SIEM for indicators associated with HTTP requests, including HTTP request methods, user agents, URIs, and Ja3.

Note that multiple search values should be separated by commas only (without spaces or any special characters).