Automate repetitive security tasks
Multiple automation workflows allow you to respond to security events as they emerge on your network. You can configure these workflows to automate all the manual drudgery that can dominate your day.
Rely on prebuilt workflows
InsightIDR has prebuilt workflows for containing threats on an endpoint, suspending user accounts, and integration with ticketing systems.
You’ll see enrichment via open source threat intelligence added to this list of workflows, as well as the ability to trigger any of these workflows (or seamlessly integrated InsightConnect workflows) off of alerts.
It’s easy to kick off any workflow or response playbook with the click of a button. And with expert response suggestions built into our detections library, you’ll know what to do faster.
Get critical use cases out-of-the-box
When investigating threats in InsightIDR, you not only get important context, but you can take immediate steps to contain or respond to a threat. For example, with the Insight Agent, you can kill malicious processes or quarantine infected endpoints from the network. You can also use InsightIDR to take containment actions across Active Directory, Access Management, EDR, and firewall tools.
ユーザーアカウントのプロビジョニングとプロビジョニング解除
InsightIDRでアラートを受信すると、注意すべきユーザーとアセットの行動が視覚的な調査のタイムラインに表示されます。ユーザーアカウントに関する判断をするために必要なコンテキストを得られるだけでなく、調査から直接アクションを起こして脅威を封じ込めることができます。ユーザーレベルの封じ込めについては、Active DirectoryやOktaなどをサポートしています。
アラートの自動エンリッチメント
InsightIDRの組み込みのワークフローやより拡張性に富んだInsightConnectを通じて、オープンソースまたはサポート対象の脅威インテリジェンスフィードを利用して、調査とユーザー行動分析アラートのエンリッチメントをおこないます。
Customize automation with InsightConnect
Streamline and accelerate highly manual, time-intensive, processes 24 hours a day. across IT and Security cloud apps, on-premise systems, employees, and administrators.
With more than 300 plugins to connect your IT and security systems — and a library of customizable workflows — you’ll free up your security team to tackle the serious challenges only they can. And when you build your own rich workflows, there’s low-to-no coding involved.
