Docs » Splunk On-Call integrations » Rapid7 integration for Splunk On-Call

Rapid7 integration for Splunk On-Call πŸ”—

Rapid7 helps you reduce risk across your entire connected environment so your company can focus on what matters most.

Requirements πŸ”—

Splunk On-Call Version Required: Starter, Growth, or Enterprise

Configure Splunk On-Call πŸ”—

  1. From the main timeline, select Integrations then 3rd Party Integrations then Rapid7.

  2. Select Enable Integration. Copy the URL to notify for use in the next steps.

  3. Select Settings then Routing Keys to find your routing key configuration. Decide which routing key you want to use with this integration and make sure it is associated to the correct escalation policies. For more information on routing keys, see Create Routing Keys in Splunk On-Call.

Configure the Data Exporter in Rapid7 πŸ”—

  1. From your Rapid7 dashboard, select Data Collection.

  2. Select Setup Event Source then Add Event Source.

  3. In the Security Data section select the Data Exporter icon. The Add Event Source panel appears.

  4. Select your collector and event source. You can also name your event source if you want.

  5. Provide the URL that you previously copied from Splunk On-Call. For security reasons, Rapid7 recommends using HTTPS as the protocol whenever possible.

  6. If the secret is not already provided, enter in the Secret field.

  7. (Optional) Select Alerts to export asset-specific Alerts from InsightIDR.

  8. (Optional) Select to trust all certificates and self-signed certificates.

  9. Select Save.

Rapid7 Data Explorer configuration.

The Data Exporter is now configured and will send 2 types of messages.

  • A test event to confirm the URL is working. This message is whenever the webhook data exporter is started or if the configuration is changed.

  • An idr_alert event. This type of message is whenever an alert triggers in InsightIDR and contains information about the alert in the event. More details about each type of event can be found in Rapid7 documentation https://docs.rapid7.com/insightidr/webhook.

This page was last updated on May 02, 2024.