# Plugins **URL:** https://discuss.rapid7.com/c/insightconnect/plugins/18.md [Latest](https://discuss.rapid7.com/latest.md) · [Categories](https://discuss.rapid7.com/categories.md) · [Tags](https://discuss.rapid7.com/tags.md) --- ## [About the Plugins category](https://discuss.rapid7.com/t/about-the-plugins-category/1099)
**Author:** [@rapid7\_bot](https://discuss.rapid7.com/u/rapid7_bot)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 10:02pm UTC](https://discuss.rapid7.com/t/about-the-plugins-category/1099 "2020-06-05T22:02:49Z")
All about InsightConnect plugins, from using them to creating or customizing your own. --- ## [ICONN PowerShell Plugin](https://discuss.rapid7.com/t/iconn-powershell-plugin/57405)
**Author:** [@rcrawford\_cloud](https://discuss.rapid7.com/u/rcrawford_cloud)\ **Replies:** 2\ **Last updated:** [August 27, 2026, 10:33am UTC](https://discuss.rapid7.com/t/iconn-powershell-plugin/57405 "2026-08-27T10:33:35Z")
Having issues getting the PowerShell plugin to run correctly. Given that the orchestrators run on Linux, I was hoping to essentially nominate a Windows Server (Automation Server) to be the place where scripts are ran to … --- ## [ManageEngine ServiceDesk Plus SAAS support is here!](https://discuss.rapid7.com/t/manageengine-servicedesk-plus-saas-support-is-here/57233)
**Author:** [@Eric-Wilson](https://discuss.rapid7.com/u/Eric-Wilson)\ **Replies:** 0\ **Last updated:** [May 19, 2026, 7:01pm UTC](https://discuss.rapid7.com/t/manageengine-servicedesk-plus-saas-support-is-here/57233 "2026-05-19T19:01:25Z")
ManageEngine ServiceDesk Plus Plugin Setup Guide This guide covers the complete configuration for the InsightConnect ManageEngine ServiceDesk Plus plugin (v2.0.0+). The plugin supports both Cloud (SaaS) and On-Premises d… --- ## [Plugin permissions](https://discuss.rapid7.com/t/plugin-permissions/57211)
**Author:** [@pkm1](https://discuss.rapid7.com/u/pkm1)\ **Replies:** 2\ **Last updated:** [May 7, 2026, 4:43pm UTC](https://discuss.rapid7.com/t/plugin-permissions/57211 "2026-05-07T16:43:11Z")
Hi everyone! I have a doubt on one of the plugins permissions, that is Azure AD Admin. The documentation says, we need the global administrator role for the App created in entra to set up this plugin in Rapid7 InsightCo… --- ## [InsightVM Console plugin credentials](https://discuss.rapid7.com/t/insightvm-console-plugin-credentials/57103)
**Author:** [@mcolford](https://discuss.rapid7.com/u/mcolford)\ **Replies:** 0\ **Last updated:** [March 9, 2026, 4:15pm UTC](https://discuss.rapid7.com/t/insightvm-console-plugin-credentials/57103 "2026-03-09T16:15:56Z")
Trying to set up a connection for InsightVM console for vulnerability exceptions. I have a console user account made and confirmed I can log in with it. If I use the credentials in the connector it passes, however it nev… --- ## [Timers plugin issue](https://discuss.rapid7.com/t/timers-plugin-issue/57048)
**Author:** [@pkm](https://discuss.rapid7.com/u/pkm)\ **Replies:** 0\ **Last updated:** [January 26, 2026, 1:43pm UTC](https://discuss.rapid7.com/t/timers-plugin-issue/57048 "2026-01-26T13:43:09Z")
Hello Everyone, Greetings to all of you! Since Saturday, I have observed some changes in the Timer trigger. The plugin doc says, it takes a set of UTC times but, last two days it ran at EST. For instance, I had set up t… --- ## [Returns specific fields from jira plugin find issues?](https://discuss.rapid7.com/t/returns-specific-fields-from-jira-plugin-find-issues/56981)
**Author:** [@tward1](https://discuss.rapid7.com/u/tward1)\ **Replies:** 2\ **Last updated:** [December 8, 2025, 4:26pm UTC](https://discuss.rapid7.com/t/returns-specific-fields-from-jira-plugin-find-issues/56981 "2025-12-08T16:26:29Z")
i am using the jira plugin v 6.5.3 and the find issues function. i read somewhere there should be a fields input where i can list the fields, but I'm not seeing one. so it may have been wrong. How can i specify fields to… --- ## [Connection set up issue](https://discuss.rapid7.com/t/connection-set-up-issue/56944)
**Author:** [@pkm](https://discuss.rapid7.com/u/pkm)\ **Replies:** 0\ **Last updated:** [December 4, 2025, 4:26pm UTC](https://discuss.rapid7.com/t/connection-set-up-issue/56944 "2025-12-04T16:26:53Z")
Hey all, How yall are doing? I am facing an issue setting up the MS Defender for Endpoint plugin in Rapid7. We checked with the API Permissions, secret key value, tenant id, and application id. All seems to be fine but,… --- ## [API Permissions](https://discuss.rapid7.com/t/api-permissions/56538)
**Author:** [@pkm](https://discuss.rapid7.com/u/pkm)\ **Replies:** 2\ **Last updated:** [November 19, 2025, 4:08pm UTC](https://discuss.rapid7.com/t/api-permissions/56538 "2025-11-19T16:08:32Z")
Hello folks, Greetings! Does anybody know what are those API permissions we need to provide while registering the MS Defender Hunting App in Entra ID, so that we can access all the functionalities of this Plugin in ICON… --- ## [Plugin Request: Google Chat](https://discuss.rapid7.com/t/plugin-request-google-chat/10753)
**Author:** [@mason\_prince](https://discuss.rapid7.com/u/mason_prince)\ **Replies:** 3\ **Last updated:** [November 19, 2025, 10:57am UTC](https://discuss.rapid7.com/t/plugin-request-google-chat/10753 "2025-11-19T10:57:29Z")
Hello, I’d like to request a plugin for Google Chat, in the same way that there is functionality for Slack and MS Teams. We use Google Chat for company-wide comms so it would be necessary to have that functionality for … --- ## [Anyone ever used rapid7/Typo Squatter](https://discuss.rapid7.com/t/anyone-ever-used-rapid7-typo-squatter/9843)
**Author:** [@brandon\_mcclure](https://discuss.rapid7.com/u/brandon_mcclure)\ **Replies:** 12\ **Last updated:** [October 28, 2025, 7:30pm UTC](https://discuss.rapid7.com/t/anyone-ever-used-rapid7-typo-squatter/9843 "2025-10-28T19:30:21Z")
Anyone ever used the plugin rapid7/Typo Squatter? I tried with the default google.com and I’m getting an error with the input rapid7/Typo Squatter:1.0.1. Step name: check\_for\_squatters Running command: ./dnstwist/dnstw… --- ## [Creating .eml from icon\_email.json](https://discuss.rapid7.com/t/creating-eml-from-icon-email-json/43751)
**Author:** [@2tSecurity](https://discuss.rapid7.com/u/2tSecurity)\ **Replies:** 2\ **Last updated:** [October 9, 2025, 4:41pm UTC](https://discuss.rapid7.com/t/creating-eml-from-icon-email-json/43751 "2025-10-09T16:41:23Z")
Has anyone found an effective way of creating a .eml from the 365 Email plugin or the icon\_email.json output in general? My only workaround so far has been creating a .html to analyze the email body in addition to extrac… --- ## [Microsoft Defender Alerts](https://discuss.rapid7.com/t/microsoft-defender-alerts/55041)
**Author:** [@pkm](https://discuss.rapid7.com/u/pkm)\ **Replies:** 6\ **Last updated:** [September 23, 2025, 3:37pm UTC](https://discuss.rapid7.com/t/microsoft-defender-alerts/55041 "2025-09-23T15:37:43Z")
Hello folks. Our SOC analysts working on Defender alerts manually for many of the alerts and carrying out the activities like revoke sessions and reset passwords etc. I want to pull defender alerts/incidents into Insigh… --- ## [Lookup Host workflows](https://discuss.rapid7.com/t/lookup-host-workflows/53512)
**Author:** [@lpriefert](https://discuss.rapid7.com/u/lpriefert)\ **Replies:** 2\ **Last updated:** [September 11, 2025, 12:14pm UTC](https://discuss.rapid7.com/t/lookup-host-workflows/53512 "2025-09-11T12:14:34Z")
I am working on two new workflows. Lookup Host in InsightVM from Teams Requirement: InsightVM Console URL and account credentials. Plugin: Rapid7 InsightVM Console v7.0.2 Lookup Vulnerable Hosts from Teams Requireme… --- ## [View existing Rapid7 InsightVM Cloud connections?](https://discuss.rapid7.com/t/view-existing-rapid7-insightvm-cloud-connections/53514)
**Author:** [@lpriefert](https://discuss.rapid7.com/u/lpriefert)\ **Replies:** 1\ **Last updated:** [July 30, 2025, 11:15am UTC](https://discuss.rapid7.com/t/view-existing-rapid7-insightvm-cloud-connections/53514 "2025-07-30T11:15:53Z")
Plugin: Rapid7 InsightVM Cloud. Where can I see existing Rapid7 InsightVM Cloud Connections? --- ## [Integrating Palo Alto Firewall Plugin For A POC Demo](https://discuss.rapid7.com/t/integrating-palo-alto-firewall-plugin-for-a-poc-demo/4301)
**Author:** [@ilovesoar](https://discuss.rapid7.com/u/ilovesoar)\ **Replies:** 3\ **Last updated:** [July 28, 2025, 4:10pm UTC](https://discuss.rapid7.com/t/integrating-palo-alto-firewall-plugin-for-a-poc-demo/4301 "2025-07-28T16:10:12Z")
Hi, what are the setup steps for this plugin? \*\*\*UPDATED Choose a Palo FW Create a local FW account with XML API Admin role (assume that API access is enabled and a new XML API Admin Role has been made \*best practices … --- ## [Crowdstrike Falcon plugin for InsightConnect](https://discuss.rapid7.com/t/crowdstrike-falcon-plugin-for-insightconnect/1865)
**Author:** [@claire\_hogan](https://discuss.rapid7.com/u/claire_hogan)\ **Replies:** 12\ **Last updated:** [June 30, 2025, 2:10pm UTC](https://discuss.rapid7.com/t/crowdstrike-falcon-plugin-for-insightconnect/1865 "2025-06-30T14:10:13Z")
Hey everyone, the integrations team is building out additional plugin actions for the Crowdstrike Falcon plugin for InsightConnect. We currently have capabilities to get detections, get detection information, update dete… --- ## [Microsoft Office365 Email Security - does it work for anyone?](https://discuss.rapid7.com/t/microsoft-office365-email-security-does-it-work-for-anyone/51510)
**Author:** [@paul.hoff](https://discuss.rapid7.com/u/paul.hoff)\ **Replies:** 1\ **Last updated:** [May 23, 2025, 5:14pm UTC](https://discuss.rapid7.com/t/microsoft-office365-email-security-does-it-work-for-anyone/51510 "2025-05-23T17:14:07Z")
Does this work for anyone? Which roles are required not really defined anywhere, in the document. Do I just ChatGPT this to figure out what least privileges need to be based on actions? --- ## [Python 3 Plugin Update: Support for Additional Secure Connection Fields 🔏](https://discuss.rapid7.com/t/python-3-plugin-update-support-for-additional-secure-connection-fields/51231)
**Author:** [@ryan\_murray1](https://discuss.rapid7.com/u/ryan_murray1)\ **Replies:** 0\ **Last updated:** [May 15, 2025, 3:03pm UTC](https://discuss.rapid7.com/t/python-3-plugin-update-support-for-additional-secure-connection-fields/51231 "2025-05-15T15:03:26Z")
:rocket: Big News: InsightConnect’s 'Python 3 Script' Plugin Just Got an Upgrade! :wrench::snake: We’re excited to roll out powerful new enhancements to the Python 3 Script plugin in InsightConnect — making your automati… --- ## [AWS Athena Plugin should get query results](https://discuss.rapid7.com/t/aws-athena-plugin-should-get-query-results/50724)
**Author:** [@bsonmez](https://discuss.rapid7.com/u/bsonmez)\ **Replies:** 0\ **Last updated:** [April 30, 2025, 3:28pm UTC](https://discuss.rapid7.com/t/aws-athena-plugin-should-get-query-results/50724 "2025-04-30T15:28:52Z")
Although this is nice to have a plugin, would it be a lot nicer if plugin could also get query results. --- ## [MS Teams trigger - error message channel not found](https://discuss.rapid7.com/t/ms-teams-trigger-error-message-channel-not-found/50310)
**Author:** [@btabb](https://discuss.rapid7.com/u/btabb)\ **Replies:** 7\ **Last updated:** [April 28, 2025, 10:31pm UTC](https://discuss.rapid7.com/t/ms-teams-trigger-error-message-channel-not-found/50310 "2025-04-28T22:31:06Z")
Hi I’m just starting out on the chatops journey and am trying to get a basic “Hello World” type workflow going. The workflow should trigger from a new message in a channel and post a message back saying allow. I’ve go… --- ## [Infoblox Dossier](https://discuss.rapid7.com/t/infoblox-dossier/49748)
**Author:** [@2tSecurity](https://discuss.rapid7.com/u/2tSecurity)\ **Replies:** 1\ **Last updated:** [April 1, 2025, 4:33pm UTC](https://discuss.rapid7.com/t/infoblox-dossier/49748 "2025-04-01T16:33:41Z")
We use Infoblox as a DNS filter but this plugin seems specifically to be focused on the on-prem device DNS services. I was wondering if there were any plans or possibilities to include Infoblox Dossier services into this… --- ## [Updated Values for Defender Incidents Plugin](https://discuss.rapid7.com/t/updated-values-for-defender-incidents-plugin/49398)
**Author:** [@2tSecurity](https://discuss.rapid7.com/u/2tSecurity)\ **Replies:** 4\ **Last updated:** [March 27, 2025, 12:48pm UTC](https://discuss.rapid7.com/t/updated-values-for-defender-incidents-plugin/49398 "2025-03-27T12:48:54Z")
This plugin really needs to be updated with current values. The Defender Incident API had multiple determination values available but the plugin is still only listing off the Endpoint-related determinations. I’ve been wa… --- ## [Send one-on-one chat type HTML message?](https://discuss.rapid7.com/t/send-one-on-one-chat-type-html-message/49529)
**Author:** [@mwu-at-work](https://discuss.rapid7.com/u/mwu-at-work)\ **Replies:** 0\ **Last updated:** [March 26, 2025, 3:34am UTC](https://discuss.rapid7.com/t/send-one-on-one-chat-type-html-message/49529 "2025-03-26T03:34:53Z")
In the MS Teams plugin for InsightConnect, there is an option to send TEXT message to one or more users in a “chat type” way, and there is also an option to send HTML message to a Teams’ channel… How to send HTML messag… --- ## [Crowdstrike InsightConnect IOC](https://discuss.rapid7.com/t/crowdstrike-insightconnect-ioc/47943)
**Author:** [@gzherow](https://discuss.rapid7.com/u/gzherow)\ **Replies:** 1\ **Last updated:** [February 15, 2025, 2:12pm UTC](https://discuss.rapid7.com/t/crowdstrike-insightconnect-ioc/47943 "2025-02-15T14:12:42Z")
Looking to automate network isolation for a device that experiencing IOC(specifically around encryption). What are some ways folks deployed this workflow using CS plugins? --- ## [Anyone use S1 as a trigger and have a way to filter down the results to be useful?](https://discuss.rapid7.com/t/anyone-use-s1-as-a-trigger-and-have-a-way-to-filter-down-the-results-to-be-useful/47773)
**Author:** [@ilovesoar](https://discuss.rapid7.com/u/ilovesoar)\ **Replies:** 16\ **Last updated:** [February 11, 2025, 6:45pm UTC](https://discuss.rapid7.com/t/anyone-use-s1-as-a-trigger-and-have-a-way-to-filter-down-the-results-to-be-useful/47773 "2025-02-11T18:45:46Z")
Sentinelone as a trigger means a lot of new jobs running. It also means one new threat can have hundreds of new threats under the same original threat. It would be nice to be able to group the new threat alerts by one c… --- ## [Feature Request: Add the creation date to the user info](https://discuss.rapid7.com/t/feature-request-add-the-creation-date-to-the-user-info/47067)
**Author:** [@tmillant](https://discuss.rapid7.com/u/tmillant)\ **Replies:** 2\ **Last updated:** [January 21, 2025, 1:42pm UTC](https://discuss.rapid7.com/t/feature-request-add-the-creation-date-to-the-user-info/47067 "2025-01-21T13:42:00Z")
Hello, Thanks for the work and this good plugin. I see in the output that there is a field for the user creation date when we use the GetUserInfo. Unfortunately, this field seems empty. According to Microsoft documen… --- ## [Integration Rapid7 InsightConnect + AbuseIPDB](https://discuss.rapid7.com/t/integration-rapid7-insightconnect-abuseipdb/45562)
**Author:** [@dabd](https://discuss.rapid7.com/u/dabd)\ **Replies:** 7\ **Last updated:** [December 18, 2024, 7:43pm UTC](https://discuss.rapid7.com/t/integration-rapid7-insightconnect-abuseipdb/45562 "2024-12-18T19:43:56Z")
Hi team, i need help, I managed to insert the abusipDB API, but when creating the workflow I cannot send the IP of the query I make to check its reputation, it sends the entire query log. the variable in rapid7 that bri… --- ## [Error connecting InsightConnect with Microsoft Teams](https://discuss.rapid7.com/t/error-connecting-insightconnect-with-microsoft-teams/45306)
**Author:** [@ichani](https://discuss.rapid7.com/u/ichani)\ **Replies:** 5\ **Last updated:** [November 27, 2024, 2:47pm UTC](https://discuss.rapid7.com/t/error-connecting-insightconnect-with-microsoft-teams/45306 "2024-11-27T14:47:48Z")
I have completed the configuration steps and connected to Microsoft Teams. However, when I attempt to connect to Teams, the error shown below appears Time Now: 1732507284.3262608 Time Ago: 0 Refreshing auth token Upd… --- ## [Trouble with Python Plugin](https://discuss.rapid7.com/t/trouble-with-python-plugin/44689)
**Author:** [@brandon\_mcclure](https://discuss.rapid7.com/u/brandon_mcclure)\ **Replies:** 2\ **Last updated:** [November 7, 2024, 3:24pm UTC](https://discuss.rapid7.com/t/trouble-with-python-plugin/44689 "2024-11-07T15:24:59Z")
I’m not the best with Python, but I cannot get this to work with my connection def run(params={}): import requests import json # Authentication client\_id = params.get('credentials').get('username') I k… [Next page](https://discuss.rapid7.com/c/insightconnect/plugins/18.md?page=1)