Skip to main content
Rapid7 InsightIDR is Rapid7’s cloud SIEM and detection and response product. After you add a Universal Webhook data exporter to a data collector in InsightIDR, the collector posts to Flashduty On-call each time an investigation is generated. Each investigation maps to one Flashduty alert. InsightIDR only sends “investigation created”. It does not send updates or closures, so alerts do not recover on their own. Turn on auto-close in the channel that receives them, with a suggested window of 24 hours, or adjust it to how quickly your team handles investigations.

In Flashduty On-call

You can get the push URL in either of the following ways.

Use a dedicated integration

  1. In the Flashduty console, select Channels and open a channel
  2. Select Settings → Integrations → Dedicated integrations, then click Add integration
  3. Select Rapid7 InsightIDR and click Save
  4. Open the generated integration card and copy the Push URL

Use a shared integration

  1. In the Flashduty console, go to Integration Center → Alert Events
  2. Select Rapid7 InsightIDR and enter an integration name
  3. Configure the default route and select a channel. You can add more rules under Routing after creation
  4. Click Save and copy the generated Push URL

In Rapid7 InsightIDR

1

Add a Universal Webhook data exporter in InsightIDR

Where: Rapid7 InsightIDR › Data Connectors › SIEM › Data Collectors › Data Exporters › Add Data ExporterClick Save when done.InsightIDR has no recovery setting: it only sends “investigation created”, never updates or closures. Turn on auto-close in the channel that receives this integration (see above).
2

Verify

Where: Rapid7 InsightIDR › Data Connectors › SIEM › Data Collectors › Data ExportersWhen the exporter is saved, started or stopped, or its configuration changes, InsightIDR sends a test request (X-Rapid7-Event: test). Flashduty creates an Info alert titled Rapid7 InsightIDR test notification. It does not recover on its own, so close it by hand after checking. The test request only proves connectivity; to verify a real investigation, wait for InsightIDR to generate one and confirm the alert arrives in Flashduty.

Event types

Alert key

Flashduty uses investigationId, the fixed ID InsightIDR assigns to each investigation, as the Alert Key. Changes to the title, description, or time do not change it. A request without investigationId is rejected.

Status and severity

The InsightIDR payload carries no severity, so every investigation is treated as Warning. To separate levels, adjust them in the integration’s Alert processing by title or label.

Labels

User emails and AD distinguished names (distinguishedName) are not written to labels.

About signatures

InsightIDR signs the request body with the Secret (X-Rapid7-Signature). Flashduty does not verify it, so the integration_key in the push URL is the only credential; keep it private. You can also add custom headers on the exporter; Flashduty does not require them.

Troubleshooting

  • Flashduty receives nothing: the collector is hosted by you. Confirm it can reach the internet and that the URL is complete and includes integration_key
  • Parameter error: a missing investigationId means the request is not an investigation; an unsupported event means X-Rapid7-Event is neither idr_investigation_created nor test
  • Alerts never close: InsightIDR does not send investigation closures, so turn on auto-close
  • The test alert stays open: the Info alert from the test request must be closed by hand
For more details, see Rapid7’s Universal Webhook documentation.