The InsightConnect team is happy to announce the launch of our newest feature, Quick Actions!
With Quick Actions, you will now be able to run simple yet powerful automated actions from InsightConnect with no setup required. That’s right: the initial set of actions we will be releasing will not require Orchestrators, Connections, Workflows or anything of the like. Simply log into the product, enter some input and start automating!
With our initial release, Quick Actions will be available on the InsightConnect Home page and the first action supported will be to Lookup an IP Address with WHOIS.
This feature will have a Beta flag as we plan to rapidly add additional actions as well as make Quick Actions more accessible throughout the product.
We would love to hear about how you might use this and get any feedback that you have!
What kind of actions would you put here? Would you like this functionality anywhere else in the platform?
For you next trick, it’d be nice feature to also get internal IP info.
It’s the internal ones which can be difficult to lookup on the fly, ie. have to connect to VPN, etc.
NSLOOKUP / DIG / tracert sorta thing.
It would be awesome to have a feature like this present throughout the rest of the Insight platform in the form of some sort of toolbar or maybe a browser extension that can leverage the API. It’d certainly help with launching workflows that require a bit of an extra nudge from the IDR side.
Lots of potential here, keep up the awesome work folks! It breaks the concept of “no config needed”, but it would be really cool if I could use that same toolbar to execute a custom workflow as well (Now that I’m writing it… probably a lot more effort needed to make that configurable by end users, but I could see it fitting well with the parameters feature)
@matt_domko_deprecated – We REALLY want to evolve the Quick Actions service to get to workflow execution as well. As you’ve rightly pointed out, definitely gets a little more involved to enable that functionality but it’s in our plans. We will definitely keep the community here in the loop as we look to get into the next phases of Quick Actions! Might need a few friends to help us test and make sure we get the experience right!
Mostly one-off tasks, or scheduled workflows I want to kickoff early:
- Get github audit logs since $date
- Get asset context (find jira tickets, asset owner [email, title, recent tickets for owner])
- Get user context (find assets, jira tickets, email, title, recent security events)
- Rotate all credentials for $username
- Kickoff an InsightVM scan of a new AWS AMI
- Rerun a recently failed job (once I find an API and make a plugin for it )
More Quick Action Suggestions: Generate InsightVM SQL Report
(There’s already a plugin that will let me generate an adhoc report… I just wish I could quick action it… to be fair, I could setup a webhook workflow and manually run it…)
Scenario: I just loaded a bunch of assets into InsightVM and my scans are done. I’d like to quickly run a SQL report on them.
@tyler_terenzoni - Not to steal from Matt’s request, but to answer your question. A use case would be to create a ticket (Jira in our case) for a vulnerability workflow. Today I use slack to do this. The workflow finds the assets and populates the Jira issue with asset info and vulnerability info. It would be a quick change for the input to be “Quick Action”. Now, Imagine if this quick action is then reachable from InsighAppSec, InsightVM, Nexpose (InsightVM Console), InsightDR… that would make this very powerful
@fausto_zambrano thank you for the insight, it is much appreciated!
Some good news: We actually recently released a Quick Action that enables you to create issues with Jira! You just have to navigate to InsightConnect > Quick Actions > More Actions and then configure it. Once configured, this action will be available wherever Quick Actions are, which right now includes InsightConnect and InsightIDR.
On the second point you make, I totally agree that the more accessible this is the better. We are actually in the process of expanding Quick Actions to be available within InsightVM as well so that should hopefully make this even more useful for you.
Yes, I did see that new action!! however it just creates a basic JIRA ticket. I would have to manually enter the details. It is a good start, but it does not save me any time… I can just create the JIRA ticket from JIRA…
)