Approve/deny by email from someone who isn't an InsightConnect user — Human Decision alternative, and is one workflow possible?

InsightIDR Automation
,
1

Hi all,

I'm building a workflow off the InsightIDR "User Account Was Disabled" detection (Windows event 4725). When the account that performed the disable is a privileged/admin account, I want to email the relevant manager and have their reply drive the workflow:

  • Approved → close the investigation with a comment
  • Not approved → escalate (notify the admin team + keep the investigation open at higher priority)
  • No reply within ~1 day → escalate as "no response"

The blocker: the native Human Decision step's "Allow users to make a decision from email" option only lets me pick recipients from the dropdown of InsightConnect platform users. The managers who need to approve don't have InsightConnect accounts — they're regular AD users with normal mailboxes (e.g. manager@example.com) — so they can't complete a Human Decision.

My questions:

  1. Is there any supported way to get a Human Decision (or an equivalent approve/deny gate) from someone who isn't an InsightConnect user — i.e. purely from an email reply?

  2. For anyone who has built email-reply approvals: is the accepted pattern a split design — one workflow sends the email with a correlation token in the subject and stores a token → investigation-RRN mapping in a Global Artifact, and a second workflow triggers on the reply (Microsoft Exchange "email received in mailbox") to parse APPROVED/DENIED and correlate it back? Is there a cleaner or more native approach I'm missing?

  3. Is there any way to keep a single workflow execution waiting for an external email reply for up to a day? From what I can tell, a Sleep + poll loop keeps the job active and only works for a short window (~30 min), and anything longer needs the multi-workflow + timer approach. Can one execution park that long waiting on an inbound reply, or is multi-workflow the only realistic option for a 1-day window?

Environment: InsightConnect cloud. Plugins available include Microsoft Office 365 Email, Microsoft Exchange, IMAP, Storage / Global Artifacts, Sleep, Timers, and Active Directory LDAP.

Any guidance — or examples of how others have handled "approve/deny by email from a non-IC user" — would be hugely appreciated. Thanks!