Group 11: Rapid7 InsightIDR, InsightVM, and InsightConnect

What is Rapid7 InsightIDR?

A SIEM and detection-and-response platform used for centralized logging, user behavior analytics, endpoint visibility, alerting, threat hunting, and investigations.

What is an InsightIDR investigation?

A collection of alerts, evidence, users, assets, and related activity associated with potentially suspicious behavior.

What is InsightIDR Log Search?

The capability used to search and analyze ingested security logs.

What is LEQL?

Rapid7’s Log Entry Query Language used to search, filter, group, and analyze log data.

What is an InsightIDR custom detection rule?

User-created logic that generates an alert when selected log conditions are met.

How should an InsightIDR alert be investigated?

Review the detection logic, affected users and assets, evidence timeline, underlying logs, authentication activity, endpoint processes, network connections, and related behavior.

What should I do when an InsightIDR alert lacks enough context?

Search the raw logs, expand the time range, pivot to related users and assets, consult endpoint or cloud tools, and request business context.

Why should I not rely only on the InsightIDR alert description?

The description may not contain enough evidence to determine intent, authorization, scope, or impact.

How can InsightIDR support threat hunting?

Analysts can search historical logs for suspicious users, processes, IP addresses, domains, authentication patterns, and other behaviors that did not trigger alerts.

What is Rapid7 InsightVM?

A vulnerability-management platform used to discover assets, identify vulnerabilities, prioritize risk, track remediation, and validate fixes.

What is an InsightVM scan engine?

The system that performs vulnerability scans against target assets.

What is an InsightVM site?

A configured collection of assets, credentials, scan templates, settings, and schedules.

What is an InsightVM remediation project?

A method for grouping, assigning, and tracking vulnerability-remediation work.

What is the difference between an InsightVM scan engine and Insight Agent?

A scan engine remotely assesses systems, while an installed agent collects local assessment information directly from the endpoint.

How should InsightVM findings be prioritized?

Consider exploitability, active exploitation, asset criticality, internet exposure, vulnerability age, available controls, and business impact.

How should an InsightVM false positive be investigated?

Review the scan evidence, verify the system version and patch status, consult vendor information, validate manually when possible, and rescan.

What is Rapid7 InsightConnect?

A security orchestration and automation platform used to connect tools and automate repeatable investigation and response processes.

What is an InsightConnect workflow?

A sequence of triggers, actions, decisions, loops, and integrations used to automate a process.

What is a workflow trigger?

The event or condition that starts an automation workflow.

What is a workflow action?

A step that performs a task, such as retrieving an alert, enriching an indicator, updating a case, or sending a notification.

What is a decision step?

A workflow step that selects a path based on conditions or values.

What is a loop step?

A workflow step that repeats actions for multiple items, such as alerts, users, assets, or indicators.

What is enrichment in security automation?

Automatically adding information such as threat intelligence, user details, asset context, or vulnerability information.

Why is human approval important in security automation?

High-impact actions such as account disabling or endpoint isolation could disrupt legitimate users and systems if performed incorrectly.

What is error handling in an automation workflow?

Detecting failures and routing them to retries, alternative paths, logging, or manual review.

What is deduplication?

Preventing the same alert, event, or record from being processed repeatedly.

What makes a security automation safe?

Narrow permissions, input validation, error handling, logging, human review for sensitive actions, and a recovery or rollback process.

How should an automation workflow be tested?

Use controlled data, validate every decision path, test missing fields and failures, confirm permissions, and evaluate potential business impact.

How can the value of an automation be measured?

Measure time saved, alerts processed, response speed, consistency, error reduction, false actions, and analyst feedback.

How should I explain the three Rapid7 products together?

InsightIDR detects and investigates security activity, InsightVM identifies and prioritizes vulnerabilities, and InsightConnect connects tools and automates repeatable security processe