How to get Alert RRN from Detection Rule

InsightConnect
,
1

To preface, I’m aware this has been asked before, but the answer does not provide a resolution for my situation.

I’m making a workflow that will create an investigation upon a certain order of events. In that investigation, I’m wanting to add alerts from those events. The rule action for the trigger detection is set to “create alert” but the alert rrn is not available in the output. Is there another workflow step that I can use to pull the rrn?

EDIT: Simply put, I want to create an alert with this workflow and add it to a new investigation.

2

We do something similar to this. To start with, I was confusing the Alert RRN with the Investigation RRN. I ended up using the Rapid 7 InsightIDR plugin - Search Investigation with [{“field”:“title”,“value”:“{{["IDR Alert"].[alert].[name]}}”,“operator”:“CONTAINS”},{“field”:“status”,“value”:“OPEN”,“operator”:“EQUALS”}]
This should return the alert investigation rrn
Sorry if i have misunderstood your question.

3

Not quite what I’m looking for.
Simply put, I want to create an alert with this workflow and add it to a new investigation. The Alert RRN is needed for that but I can’t find it in any of the steps output.

4

What type of Detection Rule are you working with?

5

It’s a regular Detection Rule (I believe ABA). To clarify it’s not Legacy UBA, nor Basic Detection Rule

6

Can you describe your workflow up to this point?

What is the trigger that is kicking off the workflow? Knowing this will help understand what is already available.

We have a trigger for Alerts that was released a few months back. I am not sure if you have tried that out.

If you are using an ABA trigger, this is firing off before an investigation or an alert happens, so no alert RRN is going to be available.

7
  1. Trigger: Insight IDR Detection Rule
  2. Advanced Query on Log Set
  3. Decision: if {{[“Advanced Query”].[count]}}>0
  4. Create Investigation
  5. ** Add alert from trigger to the investigation
8

I would suggest the new Alert Trigger instead of the ABA trigger.

Screenshot 2024-09-06 at 12.31.16 PM

I am not sure what you are wanting to pull out of log search, but the Alert RRN is part of the payload when triggering from the Alert instead of the detection.

When searching triggers it will not be one of the “From Insight Platform” options. It will be down in the plugins section where you would find other tools like Crowdstrike, & SentinelOne.

9

Thank you Darrick, I should be able to make this work

1 Like