# Automation **URL:** https://discuss.rapid7.com/c/insightidr/automation/19.md [Latest](https://discuss.rapid7.com/latest.md) · [Categories](https://discuss.rapid7.com/categories.md) · [Tags](https://discuss.rapid7.com/tags.md) --- ## [About the Automation category](https://discuss.rapid7.com/t/about-the-automation-category/1100)
**Author:** [@rapid7\_bot](https://discuss.rapid7.com/u/rapid7_bot)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 10:03pm UTC](https://discuss.rapid7.com/t/about-the-automation-category/1100 "2020-06-05T22:03:49Z")
Discussions on InsightIDR automation and automation workflows used to extend and integrate the product. --- ## [Keyless Integration or Securing API keys](https://discuss.rapid7.com/t/keyless-integration-or-securing-api-keys/57410)
**Author:** [@imoughal](https://discuss.rapid7.com/u/imoughal)\ **Replies:** 0\ **Last updated:** [August 27, 2026, 10:20am UTC](https://discuss.rapid7.com/t/keyless-integration-or-securing-api-keys/57410 "2026-08-27T10:20:32Z")
Hello guys, I am wondering how we are able to connect the Google Directory Plugin to Rapid7 in a secure manner. From my understanding, this is the current method of connecting the Google Directory Plugin to Rapid7 Insi… --- ## [Approve/deny by email from someone who isn't an InsightConnect user — Human Decision alternative, and is one workflow possible?](https://discuss.rapid7.com/t/approve-deny-by-email-from-someone-who-isnt-an-insightconnect-user-human-decision-alternative-and-is-one-workflow-possible/57298)
**Author:** [@vsysnet](https://discuss.rapid7.com/u/vsysnet)\ **Replies:** 0\ **Last updated:** [June 23, 2026, 7:44am UTC](https://discuss.rapid7.com/t/approve-deny-by-email-from-someone-who-isnt-an-insightconnect-user-human-decision-alternative-and-is-one-workflow-possible/57298 "2026-06-23T07:44:07Z")
Hi all, I'm building a workflow off the InsightIDR "User Account Was Disabled" detection (Windows event 4725). When the account that performed the disable is a privileged/admin account, I want to email the relevant mana… --- ## [Automated workflow triggers](https://discuss.rapid7.com/t/automated-workflow-triggers/57153)
**Author:** [@pkm1](https://discuss.rapid7.com/u/pkm1)\ **Replies:** 1\ **Last updated:** [April 8, 2026, 3:51pm UTC](https://discuss.rapid7.com/t/automated-workflow-triggers/57153 "2026-04-08T15:51:21Z")
Hello, How to do this? I cannot see that automation option or any alert triggers option in SIEM. --- ## [Automatically Linking Related Investigations Together?](https://discuss.rapid7.com/t/automatically-linking-related-investigations-together/53315)
**Author:** [@thobbs2](https://discuss.rapid7.com/u/thobbs2)\ **Replies:** 1\ **Last updated:** [July 23, 2025, 12:13am UTC](https://discuss.rapid7.com/t/automatically-linking-related-investigations-together/53315 "2025-07-23T00:13:30Z")
Hi! We’re seeing multiple investigations triggering for a series of related events on specific user’s accounts off the back of a pre-built MITRE ATT&CK rule. Is there a way to get InsightIDR to automatically tag any new … --- ## [Can't see custom detection rules when creating trigger](https://discuss.rapid7.com/t/cant-see-custom-detection-rules-when-creating-trigger/49912)
**Author:** [@craig\_wassel](https://discuss.rapid7.com/u/craig_wassel)\ **Replies:** 4\ **Last updated:** [April 21, 2025, 8:52pm UTC](https://discuss.rapid7.com/t/cant-see-custom-detection-rules-when-creating-trigger/49912 "2025-04-21T20:52:10Z")
When I am creating triggers in IDR I do not see any custom detections rules I’ve created. Further, the list of detection rules to choose from is relatively short compared to everything seen in the Detection Rules tab. … --- ## [How to send events to InsightConnect workflow](https://discuss.rapid7.com/t/how-to-send-events-to-insightconnect-workflow/47912)
**Author:** [@rdarji](https://discuss.rapid7.com/u/rdarji)\ **Replies:** 0\ **Last updated:** [February 11, 2025, 1:17pm UTC](https://discuss.rapid7.com/t/how-to-send-events-to-insightconnect-workflow/47912 "2025-02-11T13:17:30Z")
I have created a custom detection rule on my InsightIDR platform. Now, I want to trigger the workflow based on that custom detection rule and send that event log to the triggered workflow so that it can be further levera… --- ## [MISP Threat Intel into IDR](https://discuss.rapid7.com/t/misp-threat-intel-into-idr/46678)
**Author:** [@brian\_jackson](https://discuss.rapid7.com/u/brian_jackson)\ **Replies:** 12\ **Last updated:** [January 21, 2025, 6:59pm UTC](https://discuss.rapid7.com/t/misp-threat-intel-into-idr/46678 "2025-01-21T18:59:59Z")
Is there an easy way to get threal intel from MISP into IDR? I’m very new to MISP so still trying to work my way around it and figure out the best way to use the data it provides. --- ## [STIX-TAXII Integration](https://discuss.rapid7.com/t/stix-taxii-integration/45380)
**Author:** [@brian\_jackson](https://discuss.rapid7.com/u/brian_jackson)\ **Replies:** 1\ **Last updated:** [December 3, 2024, 1:57pm UTC](https://discuss.rapid7.com/t/stix-taxii-integration/45380 "2024-12-03T13:57:57Z")
Does IDR offer any sort of STIX-TAXII integration to threat feeds? I have a treat feed that i’d like to subscribe too. The only way I believe I can do it now is downloading the data manually to Excel and importing into… --- ## [InsightIDR Automation Workflow - Jira](https://discuss.rapid7.com/t/insightidr-automation-workflow-jira/10725)
**Author:** [@nowel](https://discuss.rapid7.com/u/nowel)\ **Replies:** 7\ **Last updated:** [August 3, 2024, 1:25pm UTC](https://discuss.rapid7.com/t/insightidr-automation-workflow-jira/10725 "2024-08-03T13:25:03Z")
Hi, Just want to get a second opinion on this. I tried leveraging the InsightIDR free (I suppose) automation integration with Jira ticketing system. Just a basic one actually. Reference: Create a ServiceNow or JIRA Ti… --- ## [IDR Investigation - Correlation](https://discuss.rapid7.com/t/idr-investigation-correlation/37245)
**Author:** [@mmarohn](https://discuss.rapid7.com/u/mmarohn)\ **Replies:** 0\ **Last updated:** [May 14, 2024, 3:14pm UTC](https://discuss.rapid7.com/t/idr-investigation-correlation/37245 "2024-05-14T15:14:56Z")
I would like to see a way to correlate investigations based on IOCs including usernames and systems so that it is easier to identify issues and do more correlation for tuning purposes. In the ideal world, I would like t… --- ## [Multi country logins - playbook](https://discuss.rapid7.com/t/multi-country-logins-playbook/34365)
**Author:** [@jnaus](https://discuss.rapid7.com/u/jnaus)\ **Replies:** 1\ **Last updated:** [March 8, 2024, 12:14pm UTC](https://discuss.rapid7.com/t/multi-country-logins-playbook/34365 "2024-03-08T12:14:28Z")
I was thinking of using a Rapid7 playbook for one of our cases, we get a lot of multi country logins and to counter alert fatigue I was looking into building my own playbook. One of the problems I have is when an employ… --- ## [Orchestrator Installation Failed](https://discuss.rapid7.com/t/orchestrator-installation-failed/31514)
**Author:** [@hp\_first](https://discuss.rapid7.com/u/hp_first)\ **Replies:** 0\ **Last updated:** [January 5, 2024, 11:20am UTC](https://discuss.rapid7.com/t/orchestrator-installation-failed/31514 "2024-01-05T11:20:43Z")
Hello, i was trying to install orchestrator with the second method (script method) and i had this issue: One of the configured repositories failed (rapid7\_insightconnect\_stable), and yum doesn’t have enough cached dat… --- ## [Would it be possible to setup automatic ingestion of H-ISAC IOC data to IDR?](https://discuss.rapid7.com/t/would-it-be-possible-to-setup-automatic-ingestion-of-h-isac-ioc-data-to-idr/28125)
**Author:** [@jlaboy](https://discuss.rapid7.com/u/jlaboy)\ **Replies:** 1\ **Last updated:** [October 11, 2023, 2:48pm UTC](https://discuss.rapid7.com/t/would-it-be-possible-to-setup-automatic-ingestion-of-h-isac-ioc-data-to-idr/28125 "2023-10-11T14:48:56Z")
Hi! I would like to know if anyone have been able to configure an automatic ingestion of H-ISAC IOC directly to “Add Threat” inside IDR. Appreciate any input and thoughts. --- ## [InsightIDR4Py](https://discuss.rapid7.com/t/insightidr4py/7696)
**Author:** [@mbabinski](https://discuss.rapid7.com/u/mbabinski)\ **Replies:** 2\ **Last updated:** [January 5, 2023, 2:53am UTC](https://discuss.rapid7.com/t/insightidr4py/7696 "2023-01-05T02:53:25Z")
Greetings, I’ve just developed a Python script which I’ve dubbed InsightIDR4Py, that simplifies the process of querying logs using the InsightIDR REST API. I’ve been using this for a couple weeks now for threat data enr… --- ## [Network Sensor in Hetzner Cloud](https://discuss.rapid7.com/t/network-sensor-in-hetzner-cloud/15001)
**Author:** [@aneumyvakin](https://discuss.rapid7.com/u/aneumyvakin)\ **Replies:** 0\ **Last updated:** [September 5, 2022, 1:28pm UTC](https://discuss.rapid7.com/t/network-sensor-in-hetzner-cloud/15001 "2022-09-05T13:28:15Z")
Hello, is it technically possible to make the network senser work in the hetzner cloud and collect data? Thanks. --- ## [Accelerate Detection and Response with Automation Webinar Scheduled August 3rd](https://discuss.rapid7.com/t/accelerate-detection-and-response-with-automation-webinar-scheduled-august-3rd/13682)
**Author:** [@tyler\_terenzoni](https://discuss.rapid7.com/u/tyler_terenzoni)\ **Replies:** 0\ **Last updated:** [July 14, 2022, 1:50pm UTC](https://discuss.rapid7.com/t/accelerate-detection-and-response-with-automation-webinar-scheduled-august-3rd/13682 "2022-07-14T13:50:10Z")
Are you a current InsightIDR user? Have you been thinking about where automation could fit into your detection and response program? Are you currently using InsightConnect and are wondering what you could or should be au… --- ## [Question for Rapid 7 folks surrounding IDR's limitation on ticketing automation](https://discuss.rapid7.com/t/question-for-rapid-7-folks-surrounding-idrs-limitation-on-ticketing-automation/9541)
**Author:** [@patrick\_hook](https://discuss.rapid7.com/u/patrick_hook)\ **Replies:** 6\ **Last updated:** [May 6, 2022, 2:35pm UTC](https://discuss.rapid7.com/t/question-for-rapid-7-folks-surrounding-idrs-limitation-on-ticketing-automation/9541 "2022-05-06T14:35:47Z")
Hello Rapid 7 community, I wanted to reach out and ask if there were any plans on the roadmap to expand the native automation ticketing connections to also include the new ABA’s and not just UBA Alerts? Right now my tea… --- ## [Want to trigger custom workflow from Virus Alert in IDR](https://discuss.rapid7.com/t/want-to-trigger-custom-workflow-from-virus-alert-in-idr/4531)
**Author:** [@aaron\_denton](https://discuss.rapid7.com/u/aaron_denton)\ **Replies:** 1\ **Last updated:** [April 22, 2021, 8:34pm UTC](https://discuss.rapid7.com/t/want-to-trigger-custom-workflow-from-virus-alert-in-idr/4531 "2021-04-22T20:34:10Z")
I want to examine additional information in the Virus Alert trigger to see if the threat was successfully removed and also pull out the name of the threat. This would allow me to add a decision to perform some basic act… --- ## [Block user in AD from InsightIDR](https://discuss.rapid7.com/t/block-user-in-ad-from-insightidr/802)
**Author:** [@marian\_danisek](https://discuss.rapid7.com/u/marian_danisek)\ **Replies:** 2\ **Last updated:** [November 5, 2020, 7:42pm UTC](https://discuss.rapid7.com/t/block-user-in-ad-from-insightidr/802 "2020-11-05T19:42:34Z")
Is it workflow working ? I mean i go to Take action, select all values including user and button Take action is still grey out. What is wrong ? --- ## [Why is InsightIDR "Automation" so limited? Cannot edit/create playbooks](https://discuss.rapid7.com/t/why-is-insightidr-automation-so-limited-cannot-edit-create-playbooks/1206)
**Author:** [@thomas\_morris](https://discuss.rapid7.com/u/thomas_morris)\ **Replies:** 2\ **Last updated:** [August 13, 2020, 5:53pm UTC](https://discuss.rapid7.com/t/why-is-insightidr-automation-so-limited-cannot-edit-create-playbooks/1206 "2020-08-13T17:53:13Z")
Why is the InsightIDR “automation” capability so limited? WE cannot create new automations, we cannot edit workflows or playbooks or create new ones. The limited capabilities in IDR without having to purchase yet anothe…