Technical Tip: Integration of Rapid7 InsightIDR for SIEM

Step 1: Add an Event Source on InsightIDR: Go to Data Collection -> Event Sources -> Add Event Source -> Add Raw Data -> Custom Logs.

• In the Run On section, select Webhook, then enter a name and description for the event source.
• Ensure to copy the generated Webhook URL from the Connectivity Details panel. This will be needed in Step 2.

• Select Save to save the Event Source.

Step 2: Configure the webhook in NextDLP UI.

• On the Next DLP web UI, go to Admin -> Webhooks -> Create new webhook.

• Paste the URL that was copied from Rapid7 in Step 1 into the URL field.
• Give the webhook a name, choose the required event type(s), and select JSON as the Payload format. 
• Choose any filters required, then select Create.

• Test the webhook by expanding the newly created webhook and selecting Test.

• If everything is configured correctly, the JSON should be viewable on the Log Search tab in InsightIDR, by ensuring that the relevant Event Source is ticked, setting a Time Range that includes the webhook test, and selecting Run.

Note:

Whilst the webhook is initialising, there may be a brief period where the webhook appears unhealthy. If this state lasts for longer than 48 hours, please contact FortiDLP support.