Checked my phone afterhours yesterday for an alert, and attempted to open up the subsequent investigation in IDR on my phone from the email. I get that some sites are less functional than others on mobile, but how can it be possible for the IDR site to not even function? You literally cannot even get to any data within the investigation, or really do anything besides click the options in the left-side navigation menu. How is this even possible in today’s world of people always being on the move and needed to check into investigations or alerts. I think i saw in another thread that this was on the product roadmap in 2021… it is now almost 2025 with no change?
4 Likes
bump for awareness
Yes, this would be a very handy feature, especially as you’ve described it for afterhours or even before actually going to work to simply check if a new investigation needs my full attention asap or can wait.
1 Like
I gave up waiting for this to actually happen.
I wrote some InsightConnect workflows to send the alerts to a Teams space and also attempts to extract any evidence/log entries into the Teams space too.
This means for most alerts, i can quickly check whats been sent to Teams before i decide to get out of bed or not!
read @rpivm but we went the Slack route.
Also we handle a mindset of better safe then sorry so all of our quarantine tools can be triggered through Slack workflow.
We also implemented workflow monitoring (no email!) and other SecOps bits so we can monitor everything from a few channels.
I would make your comment the solution… but still holding out hope that someone from R7 will see this and at least give an update. But thank you for the suggestions, seems worth my time to look into it. Thanks all!
1 Like
And even if they didn’t have an app, a mobile friendly would help. The site is very difficult/impossible to use on a phone/ipad.