InsightIDR

No entries match these filters. Clear filters

1. docs update Sep 15, 2026 · issue 075

   InsightIDR adds Disable User and Enable User in Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. actions via Response & Remediation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Disable a compromised Active Directory user directly from an open investigation without leaving InsightIDR.
   📍In InsightIDR, click Response & Remediation in the left menu. Navigate to SIEM › Investigations, open the relevant investigation, click Take action, and select Disable User in Active Directory.
   Re-enable an Active Directory user account after remediation is confirmed.
   📍In InsightIDR, click Response & Remediation in the left menu. Navigate to SIEM › Investigations, open the relevant investigation, click Take action, and select Enable User in Active Directory.
   • Adds Disable User in Active Directory action, accessible from Response & Remediation > SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. > Investigations > Take action.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Enable User in Active Directory action, accessible from Response & Remediation > SIEM > Investigations > Take action.

   2 details in Everything

2. docs update Sep 15, 2026 · issue 075

   Insight Agent can now collect Security Event Logs directly from Domain Controllers as an alternative to per-DC Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. event sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Collect Domain Controller Security Event Logs via the Insight Agent instead of configuring an Active Directory event source for every DC.
   📍1. Go to Administration. 2. Click SIEM › Settings. 3. Click SIEM Features › Command Platform Features. 4. Under Rapid7 Agent, switch the toggle to ON. The Insight Agent on any installed Domain Controller will now collect additional Security Event Logs.