{"users":[{"id":9,"username":"holly_wilsey","name":"Holly Wilsey","avatar_template":"/user_avatar/discuss.rapid7.com/holly_wilsey/{size}/78_2.png","trust_level":2},{"id":48,"username":"rapid7_bot","name":"Rapid7 Bot","avatar_template":"/user_avatar/discuss.rapid7.com/rapid7_bot/{size}/70_2.png","admin":true,"moderator":true,"trust_level":1},{"id":46631,"username":"sraj1","name":"sraj","avatar_template":"/letter_avatar_proxy/v4/letter/s/97f17d/{size}.png","trust_level":1},{"id":54733,"username":"pkm1","name":"pkm","avatar_template":"/letter_avatar_proxy/v4/letter/p/d26b3c/{size}.png","trust_level":1},{"id":57417,"username":"hmalone","name":"hmalone","avatar_template":"/letter_avatar_proxy/v4/letter/h/bc8723/{size}.png","trust_level":1},{"id":7808,"username":"Darrick_Hall","name":"Darrick Hall","avatar_template":"/user_avatar/discuss.rapid7.com/darrick_hall/{size}/2530_2.png","admin":true,"trust_level":2},{"id":15413,"username":"zack_jones","name":"Zack Jones","avatar_template":"/user_avatar/discuss.rapid7.com/zack_jones/{size}/2195_2.png","trust_level":2},{"id":45812,"username":"mmarsili","name":"Marco Marsili","avatar_template":"/user_avatar/discuss.rapid7.com/mmarsili/{size}/2694_2.png","trust_level":2},{"id":56780,"username":"rcrawford_cloud","name":"rcrawford (cloud)","avatar_template":"/letter_avatar_proxy/v4/letter/r/d26b3c/{size}.png","trust_level":1},{"id":1427,"username":"Eric-Wilson","name":"Eric Wilson","avatar_template":"/user_avatar/discuss.rapid7.com/eric-wilson/{size}/2531_2.png","admin":true,"moderator":true,"trust_level":4},{"id":30233,"username":"bhealey","name":"bhealey","avatar_template":"/letter_avatar_proxy/v4/letter/b/58956e/{size}.png","trust_level":1},{"id":4889,"username":"randy_s","name":"Randy S","avatar_template":"/user_avatar/discuss.rapid7.com/randy_s/{size}/1264_2.png","trust_level":2},{"id":13140,"username":"sgroeneveld","name":"sgroeneveld","avatar_template":"/letter_avatar_proxy/v4/letter/s/a8b319/{size}.png","trust_level":2},{"id":46943,"username":"rkotadiya","name":"rkotadiya","avatar_template":"/letter_avatar_proxy/v4/letter/r/65b543/{size}.png","trust_level":1},{"id":42925,"username":"rrdaniels","name":"rrdaniels","avatar_template":"/letter_avatar_proxy/v4/letter/r/8491ac/{size}.png","trust_level":1},{"id":6199,"username":"matthew_gardiner1","name":"Matthew Gardiner","avatar_template":"/letter_avatar_proxy/v4/letter/m/278dde/{size}.png","trust_level":1},{"id":295,"username":"brandon_mcclure","name":"Brandon McClure","avatar_template":"/user_avatar/discuss.rapid7.com/brandon_mcclure/{size}/182_2.png","trust_level":2},{"id":8146,"username":"Michael-Cochran-Rapid7","name":"Michael Cochran","avatar_template":"/letter_avatar_proxy/v4/letter/m/a9a28c/{size}.png","trust_level":2},{"id":3376,"username":"craig_wassel","name":"Craig Wassel","avatar_template":"/letter_avatar_proxy/v4/letter/c/5e9695/{size}.png","trust_level":1},{"id":55989,"username":"hrsingh","name":"hrsingh","avatar_template":"/letter_avatar_proxy/v4/letter/h/6bbea6/{size}.png","trust_level":1},{"id":49982,"username":"jlai1","name":"jlai","avatar_template":"/letter_avatar_proxy/v4/letter/j/58f4c7/{size}.png","trust_level":1},{"id":49130,"username":"emp2077","name":"mpatton","avatar_template":"/letter_avatar_proxy/v4/letter/e/ea5d25/{size}.png","trust_level":1},{"id":44936,"username":"btabb","name":"btabb","avatar_template":"/letter_avatar_proxy/v4/letter/b/5f8ce5/{size}.png","trust_level":1},{"id":10647,"username":"2tSecurity","name":"Eric Hatt","avatar_template":"/user_avatar/discuss.rapid7.com/2tsecurity/{size}/2724_2.png","trust_level":2},{"id":55853,"username":"jjjfff","name":"jF","avatar_template":"/letter_avatar_proxy/v4/letter/j/b9bd4f/{size}.png","trust_level":1},{"id":52990,"username":"jgalambos1","name":"jgalambos","avatar_template":"/letter_avatar_proxy/v4/letter/j/da6949/{size}.png","trust_level":1},{"id":52728,"username":"pl207","name":"","avatar_template":"/letter_avatar_proxy/v4/letter/p/8baadc/{size}.png","trust_level":1},{"id":395,"username":"ilovesoar","name":"IloveSOAR","avatar_template":"/user_avatar/discuss.rapid7.com/ilovesoar/{size}/358_2.png","trust_level":1},{"id":49963,"username":"rhouidi","name":"rhouidi","avatar_template":"/letter_avatar_proxy/v4/letter/r/6f9a4e/{size}.png","trust_level":1},{"id":49042,"username":"pkm","name":"pkm","avatar_template":"/letter_avatar_proxy/v4/letter/p/49beb7/{size}.png","trust_level":1},{"id":30311,"username":"mcolford","name":"Matt Colford","avatar_template":"/letter_avatar_proxy/v4/letter/m/5f9b8f/{size}.png","trust_level":1},{"id":32080,"username":"Sean","name":"Sean","avatar_template":"/user_avatar/discuss.rapid7.com/sean/{size}/2224_2.png","trust_level":2},{"id":28582,"username":"orowan","name":"orowan","avatar_template":"/letter_avatar_proxy/v4/letter/o/ea666f/{size}.png","trust_level":1},{"id":41304,"username":"jschavemaker","name":"jschavemaker","avatar_template":"/letter_avatar_proxy/v4/letter/j/d78d45/{size}.png","trust_level":1},{"id":52919,"username":"imedina","name":"imedina","avatar_template":"/letter_avatar_proxy/v4/letter/i/4da419/{size}.png","trust_level":1},{"id":40196,"username":"bdroege","name":"bdroege","avatar_template":"/letter_avatar_proxy/v4/letter/b/ecd19e/{size}.png","trust_level":1}],"primary_groups":[],"flair_groups":[],"topic_list":{"can_create_topic":false,"more_topics_url":"/c/insightconnect/10?page=1","per_page":30,"top_tags":["InsightConnect","workflow-building","workflows","InsightIDR","InsightVM","insightconnect-updates","plugin-requests","microsoft_teams","servicenow","research","tips-and-tricks","active_directory_ldap","plugin-releases","python_3_script","azure_ad_admin","gmail","crowdstrike_falcon","microsoft_office365_email","sentinelone","fortinet_fortigate","jira","microsoft_office365_email_security","microsoft_sccm","Microsoft_Teams_URL_Analysis","splunk","thehive","timers","advanced_regex","api_trigger","datetime","json"],"topics":[{"fancy_title":"The Ultimate InsightConnect Resource List - Start Here!","id":13922,"title":"The Ultimate InsightConnect Resource List - Start Here!","slug":"the-ultimate-insightconnect-resource-list-start-here","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2022-07-25T18:42:55.755Z","last_posted_at":"2022-07-25T18:43:44.154Z","bumped":true,"bumped_at":"2022-07-25T18:42:55.837Z","archetype":"regular","unseen":false,"pinned":true,"unpinned":null,"excerpt":"Welcome to the ultimate InsightConnect resource thread! :coffee:  :twisted_rightwards_arrows: \nIf you’re looking for some information on how to get started with InsightConnect, or you just want to browse the resources we…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":2746,"like_count":6,"has_summary":false,"last_poster_username":"holly_wilsey","category_id":10,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":9,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"About the InsightConnect category","id":1089,"title":"About the InsightConnect category","slug":"about-the-insightconnect-category","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2020-06-05T21:54:52.113Z","last_posted_at":"2020-06-05T21:54:52.123Z","bumped":true,"bumped_at":"2020-06-05T21:55:11.601Z","archetype":"regular","unseen":false,"pinned":true,"unpinned":null,"excerpt":"Discussions related to InsightConnect and everything that comprises it - plugins, workflows, and even tips on getting started.","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":765,"like_count":0,"has_summary":false,"last_poster_username":"rapid7_bot","category_id":10,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":48,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Need Help Generating Named CSV File from Surface Command Workflow","id":57437,"title":"Need Help Generating Named CSV File from Surface Command Workflow","slug":"need-help-generating-named-csv-file-from-surface-command-workflow","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":"//forum-uploads-hub-prod-1-us-east-1-rapid7-com.s3.dualstack.us-east-1.amazonaws.com/original/2X/5/5f3faa1d5b2a5855ec734ba1b81725e3771a2566.png","created_at":"2026-09-08T10:55:44.580Z","last_posted_at":"2026-09-08T10:55:44.669Z","bumped":true,"bumped_at":"2026-09-08T10:55:44.669Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"We have a Surface Command saved query and would like to run it weekly (Automation→ Workflows→Snippets), generate the results as a CSV file. Currently, the CSV plugin only produces a downloadable csv_string artifact, and …","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":6,"like_count":0,"has_summary":false,"last_poster_username":"sraj1","category_id":20,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":46631,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Jobs in Running state for too long","id":57433,"title":"Jobs in Running state for too long","slug":"jobs-in-running-state-for-too-long","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-09-07T09:56:47.728Z","last_posted_at":"2026-09-07T09:56:47.822Z","bumped":true,"bumped_at":"2026-09-07T09:56:47.822Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hello everyone, \nWe have some workflows built in our environment. Few are event triggered, some are timer triggered and rest are for manual run by the analysts when required. Now we have been facing the this issue of wor…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":["InsightConnect","workflows"],"tags_descriptions":{},"views":15,"like_count":0,"has_summary":false,"last_poster_username":"pkm1","category_id":20,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":54733,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Workflows triggers (RRN/Payload)","id":57418,"title":"Workflows triggers (RRN/Payload)","slug":"workflows-triggers-rrn-payload","posts_count":3,"reply_count":0,"highest_post_number":3,"image_url":null,"created_at":"2026-08-28T14:56:04.117Z","last_posted_at":"2026-08-28T15:43:50.603Z","bumped":true,"bumped_at":"2026-08-28T15:43:50.603Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hello, I just wanted to confirm my understanding. Is it currently the case that there is no trigger which provides both the payload and the incident RRN together? \nFrom what I can see, the options are either: \n\n\nTrigger …","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":143,"like_count":1,"has_summary":false,"last_poster_username":"Darrick_Hall","category_id":20,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":57417,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":7808,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"AWS Inspector Findings Sync to Jira Tickets - ICON Workflow","id":57408,"title":"AWS Inspector Findings Sync to Jira Tickets - ICON Workflow","slug":"aws-inspector-findings-sync-to-jira-tickets-icon-workflow","posts_count":3,"reply_count":1,"highest_post_number":3,"image_url":null,"created_at":"2026-08-27T05:55:15.955Z","last_posted_at":"2026-08-27T15:32:41.230Z","bumped":true,"bumped_at":"2026-08-27T15:32:41.230Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"I figured that someone may need this. This snippet is a workflow that lives off of a specific Surface Command query that gets all AWS Inspector issues, aligns them to their hosts, and syncs tickets in Jira. It will autom…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":["workflows","workflow-building","queries","jira"],"tags_descriptions":{},"views":140,"like_count":1,"has_summary":false,"last_poster_username":"zack_jones","category_id":10,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster","user_id":15413,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":45812,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"ICONN PowerShell Plugin","id":57405,"title":"ICONN PowerShell Plugin","slug":"iconn-powershell-plugin","posts_count":3,"reply_count":1,"highest_post_number":3,"image_url":null,"created_at":"2026-08-25T11:51:51.713Z","last_posted_at":"2026-08-27T10:33:35.213Z","bumped":true,"bumped_at":"2026-08-27T10:33:35.213Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Having issues getting the PowerShell plugin to run correctly. Given that the orchestrators run on Linux, I was hoping to essentially nominate a Windows Server (Automation Server) to be the place where scripts are ran to …","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":172,"like_count":0,"has_summary":false,"last_poster_username":"rcrawford_cloud","category_id":18,"pinned_globally":false,"featured_link":null,"has_accepted_answer":true,"can_vote":false,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster","user_id":56780,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster, Accepted Answer","user_id":1427,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Orchestrator Error?","id":57374,"title":"Orchestrator Error?","slug":"orchestrator-error","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":"//forum-uploads-hub-prod-1-us-east-1-rapid7-com.s3.dualstack.us-east-1.amazonaws.com/original/2X/f/f64119fc5007a0d13a617c4c3dc6280a9810fd9d.png","created_at":"2026-08-05T17:46:54.674Z","last_posted_at":"2026-08-11T18:59:36.985Z","bumped":true,"bumped_at":"2026-08-11T18:59:36.985Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hello, when viewing our orchestrator I’m seeing an error symbol (see screenshot), but I can seem to find anywhere what the error actually is. Where should I be looking to get more information on what this means? Thanks! \n…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":465,"like_count":0,"has_summary":false,"last_poster_username":"randy_s","category_id":22,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":30233,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":4889,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Workflow Not Triggering on Investigation Creation","id":57343,"title":"Workflow Not Triggering on Investigation Creation","slug":"workflow-not-triggering-on-investigation-creation","posts_count":7,"reply_count":4,"highest_post_number":7,"image_url":null,"created_at":"2026-07-17T14:28:03.796Z","last_posted_at":"2026-08-11T13:31:45.582Z","bumped":true,"bumped_at":"2026-08-11T13:31:45.582Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi everyone! \nI have created a draft workflow to test it’s trigger condition which is on InsightIDR –> Get New Investigations, and I have set the condition in this way: [{"field":"title","operator":"EQUALS","value":"Micr…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":["InsightConnect","workflows"],"tags_descriptions":{},"views":291,"like_count":0,"has_summary":false,"last_poster_username":"Darrick_Hall","category_id":10,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":54733,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":13140,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":46943,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":42925,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":7808,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Automation Workflow Issues - InsightIDR to ServiceNOW","id":57377,"title":"Automation Workflow Issues - InsightIDR to ServiceNOW","slug":"automation-workflow-issues-insightidr-to-servicenow","posts_count":5,"reply_count":3,"highest_post_number":5,"image_url":null,"created_at":"2026-08-06T15:59:25.143Z","last_posted_at":"2026-08-11T13:00:22.833Z","bumped":true,"bumped_at":"2026-08-11T13:00:22.833Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Good Afternoon, \nI’m hoping to find someone here who could be of assistance. I’m looking to utilize the workflow templates from Rapid7 to generate servicenow incidents after investigation creation. Then I want to leverag…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":["InsightConnect","workflows","workflow-building"],"tags_descriptions":{},"views":166,"like_count":0,"has_summary":false,"last_poster_username":"rrdaniels","category_id":20,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster","user_id":42925,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":7808,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"What have you automated so far?","id":4537,"title":"What have you automated so far?","slug":"what-have-you-automated-so-far","posts_count":36,"reply_count":21,"highest_post_number":36,"image_url":null,"created_at":"2021-04-20T17:46:50.749Z","last_posted_at":"2026-07-21T16:26:29.322Z","bumped":true,"bumped_at":"2026-07-21T16:26:29.322Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"There’s a lot of possibilities in the realm of security and automation, and a lot of different technologies to pair with it. With that in mind, I thought it’d be nice to have a place where we can share how we’ve been usi…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":4268,"like_count":50,"has_summary":false,"last_poster_username":"craig_wassel","category_id":10,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":9,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":6199,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":295,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":8146,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":3376,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Servicenow integration with insightconnect - workflows","id":57294,"title":"Servicenow integration with insightconnect - workflows","slug":"servicenow-integration-with-insightconnect-workflows","posts_count":7,"reply_count":5,"highest_post_number":7,"image_url":null,"created_at":"2026-06-22T08:51:44.650Z","last_posted_at":"2026-07-16T15:41:01.122Z","bumped":true,"bumped_at":"2026-07-16T15:41:01.122Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"hi, \nI am trying to automate - \n\nTickets get automatically created in ServiceNOW when any new investigation with high or critical severity is triggered\nIf ticket in ServiceNow is updated, the status of investigation is u…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":["workflows"],"tags_descriptions":{},"views":364,"like_count":0,"has_summary":false,"last_poster_username":"hrsingh","category_id":20,"pinned_globally":false,"featured_link":null,"has_accepted_answer":true,"can_vote":false,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster, Accepted Answer","user_id":55989,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":7808,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Rapid 7 Orchestrator","id":57331,"title":"Rapid 7 Orchestrator","slug":"rapid-7-orchestrator","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":"//forum-uploads-hub-prod-1-us-east-1-rapid7-com.s3.dualstack.us-east-1.amazonaws.com/optimized/2X/e/eee06615f788e13039780148cb2d4525fff8098b_2_1024x309.png","created_at":"2026-07-13T07:36:01.908Z","last_posted_at":"2026-07-13T07:36:01.989Z","bumped":true,"bumped_at":"2026-07-13T07:36:01.989Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Recently is it Rapid 7 orchestrator having issue, why my page always infinity loop does not showing up ?","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":82,"like_count":0,"has_summary":false,"last_poster_username":"jlai1","category_id":22,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":49982,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"InsightConnect - FreshService Plugin - Multi Workspace Issues","id":57261,"title":"InsightConnect - FreshService Plugin - Multi Workspace Issues","slug":"insightconnect-freshservice-plugin-multi-workspace-issues","posts_count":4,"reply_count":1,"highest_post_number":4,"image_url":null,"created_at":"2026-06-05T22:43:25.583Z","last_posted_at":"2026-06-25T18:40:01.531Z","bumped":true,"bumped_at":"2026-06-25T18:40:01.531Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Running into an issue where I am trying to build a workflow that sends tickets to a specific “workspace_id” within FreshService, but it is not available as an input with the plugin, and the field cannot be passed through…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":213,"like_count":0,"has_summary":false,"last_poster_username":"Darrick_Hall","category_id":20,"pinned_globally":false,"featured_link":null,"has_accepted_answer":true,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster, Accepted Answer","user_id":49130,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":7808,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Is there a trigger on investigation closure?","id":57268,"title":"Is there a trigger on investigation closure?","slug":"is-there-a-trigger-on-investigation-closure","posts_count":3,"reply_count":1,"highest_post_number":3,"image_url":null,"created_at":"2026-06-09T19:12:57.102Z","last_posted_at":"2026-06-10T19:37:55.992Z","bumped":true,"bumped_at":"2026-06-10T19:37:55.992Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi all, \nWe have palo cortex xdr as an event source coming into the siem. \nAlerts (or issues as they call it now) in the cortex portal trigger an investigation in the siem. \nI was looking to see if I could automate the c…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":176,"like_count":0,"has_summary":false,"last_poster_username":"btabb","category_id":10,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster","user_id":44936,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":10647,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"FQDN not working for LDAP connection (IP works)","id":57256,"title":"FQDN not working for LDAP connection (IP works)","slug":"fqdn-not-working-for-ldap-connection-ip-works","posts_count":3,"reply_count":1,"highest_post_number":3,"image_url":null,"created_at":"2026-06-03T06:35:01.352Z","last_posted_at":"2026-06-09T06:31:13.653Z","bumped":true,"bumped_at":"2026-06-09T06:31:13.653Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Issue: FQDN not working for LDAP connection (IP works)\nHi everyone, \nI’m encountering an issue with the Active Directory LDAP plugin in InsightConnect. \n\n\nWhen I configure the connection using the server hostname (FQDN),…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":["InsightConnect","active_directory_ldap"],"tags_descriptions":{},"views":194,"like_count":0,"has_summary":false,"last_poster_username":"jjjfff","category_id":10,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster","user_id":55853,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":1427,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"ManageEngine ServiceDesk Plus SAAS support is here!","id":57233,"title":"ManageEngine ServiceDesk Plus SAAS support is here!","slug":"manageengine-servicedesk-plus-saas-support-is-here","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-05-19T19:01:24.906Z","last_posted_at":"2026-05-19T19:01:25.034Z","bumped":true,"bumped_at":"2026-05-19T19:01:25.034Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"ManageEngine ServiceDesk Plus Plugin Setup Guide\nThis guide covers the complete configuration for the InsightConnect ManageEngine ServiceDesk Plus plugin (v2.0.0+). The plugin supports both Cloud (SaaS) and On-Premises d…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":["Manage_Engine_Service_Desk"],"tags_descriptions":{},"views":172,"like_count":0,"has_summary":false,"last_poster_username":"Eric-Wilson","category_id":18,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":1427,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Plugin permissions","id":57211,"title":"Plugin permissions","slug":"plugin-permissions","posts_count":3,"reply_count":1,"highest_post_number":3,"image_url":null,"created_at":"2026-05-07T14:38:03.094Z","last_posted_at":"2026-05-07T16:43:11.499Z","bumped":true,"bumped_at":"2026-05-07T16:43:11.499Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi everyone! \nI have a doubt on one of the plugins permissions, that is Azure AD Admin. The documentation says, we need the global administrator role for the App created in entra to set up this plugin in Rapid7 InsightCo…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":["InsightConnect"],"tags_descriptions":{},"views":181,"like_count":0,"has_summary":false,"last_poster_username":"pkm1","category_id":18,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster","user_id":54733,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":7808,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Tigger Detection rules","id":57173,"title":"Tigger Detection rules","slug":"tigger-detection-rules","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-04-17T18:24:15.981Z","last_posted_at":"2026-05-07T15:12:20.492Z","bumped":true,"bumped_at":"2026-05-07T15:12:20.492Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Does anyone have any insight to what the plan is for the trigger ‘SIEM Legacy Detection Rule’ and ‘SIEM Detection Rule’? Will the SIEM Legacy Detection Rule be going away in the near future? I find it a little frustratin…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":["InsightIDR","InsightConnect","workflows","workflow-building"],"tags_descriptions":{},"views":181,"like_count":0,"has_summary":false,"last_poster_username":"Darrick_Hall","category_id":10,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":52990,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":7808,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Request for better Palo Alto panorama functionality","id":57166,"title":"Request for better Palo Alto panorama functionality","slug":"request-for-better-palo-alto-panorama-functionality","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-04-15T12:47:07.364Z","last_posted_at":"2026-04-15T12:47:07.474Z","bumped":true,"bumped_at":"2026-04-15T12:47:07.474Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Currently, the Palo Alto firewall plugin has limited functionality for Panorama managed environments. While we can automate the creation of objects within Device Groups, the workflow is interrupted because the plugin lac…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":["InsightConnect","workflows","palo_alto_pan_os"],"tags_descriptions":{},"views":121,"like_count":5,"has_summary":false,"last_poster_username":"pl207","category_id":10,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":52728,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Need help with search filter in InsightIDR New Investigations trigger","id":48105,"title":"Need help with search filter in InsightIDR New Investigations trigger","slug":"need-help-with-search-filter-in-insightidr-new-investigations-trigger","posts_count":11,"reply_count":8,"highest_post_number":11,"image_url":null,"created_at":"2025-02-14T14:51:21.317Z","last_posted_at":"2026-04-15T12:37:58.501Z","bumped":true,"bumped_at":"2026-04-15T12:37:58.501Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"I have in the Search box: \n[{“field”:“title”,“value”:“Suspicious Authentication - Non-Approved Country”,“operator”:“EQUALS”}] \nHave not seen a new job even with those events happening.","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":["InsightIDR","InsightConnect"],"tags_descriptions":{},"views":340,"like_count":2,"has_summary":false,"last_poster_username":"2tSecurity","category_id":10,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":395,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":7808,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":49963,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":1427,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":10647,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Defender for Endpoint File Extraction","id":57165,"title":"Defender for Endpoint File Extraction","slug":"defender-for-endpoint-file-extraction","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-04-15T12:35:09.460Z","last_posted_at":"2026-04-15T12:35:09.542Z","bumped":true,"bumped_at":"2026-04-15T12:35:09.542Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"I am genuinely curious if anyone has worked out any workflows for extracting file content from Defender for Endpoint detections. We have a sandbox that utilizes a Azure logic app to run a live response session and pull t…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":106,"like_count":0,"has_summary":false,"last_poster_username":"2tSecurity","category_id":10,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":10647,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Workflow Input","id":57127,"title":"Workflow Input","slug":"workflow-input","posts_count":6,"reply_count":4,"highest_post_number":6,"image_url":null,"created_at":"2026-03-20T16:23:00.430Z","last_posted_at":"2026-03-24T14:23:37.977Z","bumped":true,"bumped_at":"2026-03-24T14:23:37.977Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hello, \nI am currently trying to build a workflow, that resets the password of a user. I will be running it on legacy detection rule so that analysts can run that from investigations console. How may I prompt the analyst…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":["InsightConnect","workflows","workflow-building"],"tags_descriptions":{},"views":178,"like_count":0,"has_summary":false,"last_poster_username":"2tSecurity","category_id":10,"pinned_globally":false,"featured_link":null,"has_accepted_answer":true,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":49042,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster, Accepted Answer","user_id":7808,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":10647,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Exception requests through teams leveraging API","id":57106,"title":"Exception requests through teams leveraging API","slug":"exception-requests-through-teams-leveraging-api","posts_count":3,"reply_count":0,"highest_post_number":3,"image_url":null,"created_at":"2026-03-10T19:31:14.443Z","last_posted_at":"2026-03-11T02:17:51.104Z","bumped":true,"bumped_at":"2026-03-11T02:17:51.104Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"I’m trying to work out a way to have a pair of workflows, one to trigger a teams message with an accept/reject link, the second that takes that link (API trigger) and parses it to actually do the approve/reject. \nI have …","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":133,"like_count":0,"has_summary":false,"last_poster_username":"mcolford","category_id":10,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster","user_id":30311,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":7808,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Updating Global Artifacts Entries","id":57075,"title":"Updating Global Artifacts Entries","slug":"updating-global-artifacts-entries","posts_count":3,"reply_count":1,"highest_post_number":3,"image_url":null,"created_at":"2026-02-23T20:53:52.167Z","last_posted_at":"2026-03-09T20:19:20.426Z","bumped":true,"bumped_at":"2026-03-09T20:19:20.426Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"I have a workflow that adds entries to a Global Artifact that another workflow uses to schedule scans. The second workflow checks for records that contains a value of INC, and then loops through the returned records. \nOn…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":134,"like_count":0,"has_summary":false,"last_poster_username":"Sean","category_id":10,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster","user_id":32080,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":7808,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"InsightVM Console plugin credentials","id":57103,"title":"InsightVM Console plugin credentials","slug":"insightvm-console-plugin-credentials","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-03-09T16:15:56.297Z","last_posted_at":"2026-03-09T16:15:56.389Z","bumped":true,"bumped_at":"2026-03-09T16:15:56.389Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Trying to set up a connection for InsightVM console for vulnerability exceptions. I have a console user account made and confirmed I can log in with it. If I use the credentials in the connector it passes, however it nev…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":93,"like_count":0,"has_summary":false,"last_poster_username":"mcolford","category_id":18,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":30311,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"InsightIDR to Microsoft 365 Workflow Only Sending Investigations – Not Alerts or Managed Alerts","id":57074,"title":"InsightIDR to Microsoft 365 Workflow Only Sending Investigations – Not Alerts or Managed Alerts","slug":"insightidr-to-microsoft-365-workflow-only-sending-investigations-not-alerts-or-managed-alerts","posts_count":4,"reply_count":2,"highest_post_number":4,"image_url":"//forum-uploads-hub-prod-1-us-east-1-rapid7-com.s3.dualstack.us-east-1.amazonaws.com/original/2X/7/7ef84f0f2d2cbf590ab02e4e98151ea4a4578b4e.png","created_at":"2026-02-20T11:22:19.307Z","last_posted_at":"2026-02-26T14:25:03.018Z","bumped":true,"bumped_at":"2026-02-26T14:25:03.018Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi all, \nWe currently have the Rapid7 InsightIDR to Microsoft 365 workflow set up via InsightConnect, and it is successfully sending email notifications when an Investigation is created. \nHowever, we’ve noticed that it d…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":198,"like_count":0,"has_summary":false,"last_poster_username":"Darrick_Hall","category_id":10,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":28582,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":7808,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"How do folks manage API key rotations on connections before they expire?","id":56971,"title":"How do folks manage API key rotations on connections before they expire?","slug":"how-do-folks-manage-api-key-rotations-on-connections-before-they-expire","posts_count":4,"reply_count":0,"highest_post_number":4,"image_url":null,"created_at":"2025-12-05T11:53:03.261Z","last_posted_at":"2026-02-23T20:46:04.308Z","bumped":true,"bumped_at":"2026-02-23T20:46:04.308Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hello \nI'm curious how others manage their API Key expiration dates?  I'm not referring to Rapid7 Platform keys (User / Organization) that do not expire, but rather external connection API keys like Jira, Gitlab, etc.  N…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":230,"like_count":5,"has_summary":false,"last_poster_username":"Sean","category_id":10,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":45812,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":41304,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":13140,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":32080,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Rapid 7 sincronizar con Bitdefender alguien lo habrá realizado","id":57072,"title":"Rapid 7 sincronizar con Bitdefender alguien lo habrá realizado","slug":"rapid-7-sincronizar-con-bitdefender-alguien-lo-habra-realizado","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-02-12T19:28:07.770Z","last_posted_at":"2026-02-12T19:29:05.155Z","bumped":true,"bumped_at":"2026-02-12T19:29:05.155Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Alguien ha realizo la implementación entre Rapid7 y Bitdefender","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":109,"like_count":0,"has_summary":false,"last_poster_username":"imedina","category_id":22,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":52919,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Microsoft Graph API Integration","id":50844,"title":"Microsoft Graph API Integration","slug":"microsoft-graph-api-integration","posts_count":13,"reply_count":10,"highest_post_number":13,"image_url":null,"created_at":"2025-05-05T20:48:08.525Z","last_posted_at":"2026-02-06T13:20:28.533Z","bumped":true,"bumped_at":"2026-02-06T13:20:28.533Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"We’re looking to integrate Microsoft Graph API in our workflows - actions like POSTing to confirm a user as compromised in Azure AD. \nFrom reading what other’s have mentioned, the safest and most flexible option seems to…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":["InsightConnect","workflow-building"],"tags_descriptions":{},"views":514,"like_count":2,"has_summary":false,"last_poster_username":"2tSecurity","category_id":20,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":40196,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":7808,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":10647,"primary_group_id":null,"flair_group_id":null}]}]}}