Could we explore the option of refining the InsightIDR Multi-Country Authentication and Remediation workflow? For instance, consider adjusting the workflow so that user accounts are not automatically deleted in the event of authentication from more than two countries. Alternatively, incorporating a notification feature, such as sending a message, in the case where one of the authenticated countries is, for example, Russia. This modification aims to enhance the flexibility and precision of the system while ensuring that user accounts are managed in a more nuanced manner.
1 Like
Hi @jnaus, yes you may edit the workflow from the Extension Library as much as you require. To edit, visit Workflows in InsightConnect, and find the workflow you’ve imported, click it, then click Edit or View in Builder in the top right. From there you can see each step of the workflow and update, add, remove steps as you like.
For more instruction on editing workflows I recommend the Learn to Build Workflows self-guided course (more information here) or the documentation here for more detail and videos.
1 Like