Skip to content
AIR Knowledge Base

Rapid7 InsightIDR Integration

Step 1 - Creating A webhook for Rapid7 InsightIDR

  • Visit the Webhooks page in AIR,
  • Click the ”+ New Webhook” button in the upper right corner,
  • Provide a self-explanatory name,
  • Select “Rapid7 InsightIDR Webhook Parser” as the parser for this webhook,
  • Select an Acquisition Profile when the trigger activates this webhook,
  • Select the Ignore option or leave with its default value (defaults to 24 hours for recurrent alerts for a single endpoint),
  • Provide other settings such as Evidence Repository, CPU Limit, Compression & Encryption to use or let AIR configure them automatically based on the matching policy
  • Click the “Save” button.

Step 2: Create Triggers for InsightIDR

  • From the left menu, go to Data Collection and click Data Exporters.
  • Click Add Data Exporter.
  • Select Universal Webhook as the Data Exporter Type.
  • Choose your collector. You can also name your data exporter if you want. Provide the URL that you previously configured.
  • Add Content-Type: application/json for your webhook HTTP POST request.
  • Select the Alerts checkbox to export asset-specific alerts from InsightIDR.
    • Optionally, trust all certificates or self-signed certificates by selecting the Certificate Settings checkboxes.
  • Click Save

Please refer to Rapid7 documentation for more information.