Hi all,
in our environment we automated a lot of different SOC related tasks using InsightConnect workflows. For a couple of workflows we use Microsoft Teams or InsightIDR Behavior Alerts as triggers to start these workflows. One thing that I’m missing is a way to start workflows conveniently in InsightIDR without a running investigation. Something like Quick Actions but for my own workflows. As far as I know there is no option to customize the Quick Actions - you can just activate or deactivate them. I’m curious if there are any plans that will allow us to use our own workflows in the Quick Actions. Something like a Quick Actions Trigger.
I’m also wondering how others trigger their workflows. Are there any clients who just switch over to InsightConnect and start the workflow directly in the tool by hand?