Rapid7 Log Monitoring

Integration Overview

Rapid7 is a cybersecurity company offering vulnerability management, detection, and response capabilities through its Insight platform. Panther integrates with Rapid7 InsightIDR to pull audit logs via API, giving security teams visibility into administrative activity and changes within their Rapid7 environment. Ingested data is normalized and stored in Panther's Snowflake-powered security data lake for detection and investigation alongside the rest of your security telemetry.

Use Cases for Rapid7 Logs

Common SIEM use cases for Rapid7 logs include:

• Monitoring administrative actions and configuration changes within your Rapid7 environment

• Correlating Rapid7 audit activity with other security data to detect unauthorized access or misuse

• Centralizing security tool audit logs for compliance and governance requirements

Onboarding Rapid7 Logs in Panther

Panther's integration for Rapid7 is easy to configure, allowing you to onboard your log data in just a few minutes. Panther pulls audit logs from Rapid7 InsightIDR via API using an organization-level API key with Administrator permissions. Your Rapid7 data storage region is also required during setup.

For more detailed steps on onboarding Rapid7 or for supported log schema, you can view our Rapid7 documentation here.