Investigation Count Dashboard

InsightIDR
1

Is there a way to create a dashboard in IDR, that shows the count of Investigations for a time period? I have a Quarterly Report Dashboard, that contains a number of cards that our C-Suite likes to see each quarter. With the new HTML capability with dashboards/reports, I’d like to be able to have that info available in that dashboard.

I can get the info by simply going to Investigations, selecting all Open, Closed, and Investigating investigations for the past 3 month – but it’d be nice to have that info available in a dashboard card.

2

Hey @gschneider the closest thing we have today is Monitor Your Security Operations Activities | InsightIDR Documentation

However it doesn’t allow easy exporting of data, aside from a screenshot. This is something a lot of customers are keen to have and we have committed to delivering a reporting experience to allow reports to be generated from this data.

We don’t have a firm ETA to share at this time but the work is progressing.

David

2 Likes
3

Sounds great. One of the biggest reasons we stick with Rapid7’s insightIDR (and in the past 20 years, I’ve used almost every SIEM out there), is because you all keep enriching it – unlike your competitors. I’ve seen your feature requests materialize into something real.

7 Likes
4

Hi,

I use the api and grafana to create a dashboard of case statistics.

5

Hey @david_smith, just checking to see if you’ve heard if there’s been any progress here for the reporting experience of investigations / security operations.

We are using the technique reporting on the “action” suggested this past April (discuss link).

However, we’re still wondering if there’s something native coming soon that can be leveraged in the tool, rather than resorting to the API with 3rd party reporting tools.

Also, I’m not seeing the cards noted in the document Monitoring Your Security Operations Activities. Curious if that’s been pulled from the product.

Thanks in advance for any update you and the team may have!

6

Hey @kebert the SOA Dashboard is only enabled for non Managed (MDR) Customers by default, if you are an MDR customer you can request that we enable it for you If you are a regular IDR customer, you will see this Dashboard via the Home Page in IDR, on the Tab view

7

Thanks for the clarification on this needing to be enabled for MDR customers!

Any idea on the work you noted was progressing? (Rather than the API/3rd party reporting)

Thanks!

8

I’m not aware of any new developments on this front, what is your use case precisely?

David

9

New customer to InsightIDR and I am still looking for this functionality. It’s almost like I’m looking for the SOA dashboard, but a customized or improved version of this. Has there been any progress on this being an option to query or run reports/dashboards on?