I’m hoping to find someone here who could be of assistance. I’m looking to utilize the workflow templates from Rapid7 to generate servicenow incidents after investigation creation. Then I want to leverage the other template to automatically update the investigations from servicenow. I configure the workflow, which seems to require an excessive amount of connections, and it activates without issue but it never triggers. I can trigger a quick action from the investigations pay (insightidr) but it doesn’t auto update from servicenow, so it is pointless unless I want to duplicate my work. I tried creating my own and it successfully creates an incident in servicenow when testing but it doesn’t seem to pull anything from InsightIDR Investigations. Once again, all of my connections are working and everything appears to be healthy. Has anyone else had this issue and could they share their experience? I appreciate your help
When you configure the workflow that should create the investigations in ServiceNow, the workflow never triggers when a normal investigation comes through, is that correct?
When you said you try to create your own and it does create in incident in Servicenow, do you mean you create an investigation manually within InsightIDR, or within InsightConnect you hit the test button, and manually input information within the test section?
“When you configure the workflow that should create the investigations in ServiceNow, the workflow never triggers when a normal investigation comes through, is that correct?” - Yes
“When you said you try to create your own and it does create in incident in Servicenow, do you mean you create an investigation manually within InsightIDR, or within InsightConnect you hit the test button, and manually input information within the test section?” - I created the work flow within InsightConnect. If I “test” the workflow, it will generate an incident in ServiceNow. If I use an action to create a servicenow incident from InsightIDR, it will generate an incident. Neither of those actions are automated though as I had to manually trigger both.
If you go into InsightIDR and manually create an investigation, wait a few minutes does that investigation appear in the job execution list within InsightConnect?
For your InsightIDR connection did you use a platform api key, or a user api key?
When you are logged into InsightIDR in the URL it shows your region, US, US2, etc. Does the region match what is in your connection?