Skip to content
downpipes docs

Forward the downpipes audit trail to Rapid7 InsightIDR

Rapid7 InsightIDR receives the downpipes audit trail through a Custom Logs webhook or a Generic API log source. The engine dials out to that URL on the scheduler tick and posts the audit events as a JSON array (or newline-delimited JSON).

InsightIDR has no HTTP Event Collector, so do not send the Splunk HEC shape. Use the JSON array or NDJSON format, and authenticate with the header the log source expects (a Basic or Authorization header). Set up a custom-log parser on the InsightIDR side so the fields become queryable.

Because the engine makes the outbound call, a Cloudflare Access perimeter on your console hostname never blocks this: there is no inbound request for Access to turn away.

What you need

  • An InsightIDR role that can add a Custom Logs or Generic API log source.
  • The log source URL and its auth value, and owner access to the downpipes console.

Set it up

  1. In InsightIDR, add a log source: either a Custom Logs source with a webhook or HTTP collector, or a Generic API log source. Note its URL and the auth it issues (a Basic credential, or a bearer value in Authorization).
  2. In the downpipes console, open Integrations, choose this vendor’s tile, and set up the SIEM audit push there (owner-only, asks for a fresh step-up sign-in).
  3. Set the sink to HTTPS endpoint, the format to JSON array, and paste the InsightIDR log source URL.
  4. Set the auth header to match the source. For a bearer, leave the header name as Authorization and paste Bearer <token>; for Basic, keep the header name Authorization and paste Basic <base64>.
  5. Choose Test send and confirm InsightIDR accepts it, then Enable the destination.

What lands in Rapid7 InsightIDR

Each batch arrives as a JSON array of raw audit events:

[{"seq":4097,"ts":"2026-06-19T02:14:08.221Z","actorEmail":"ops@acme.example","action":"restore-approve","outcome":"success","...":"..."}]

Map the fields you want to InsightIDR’s custom-log parsing so action, outcome and actorEmail are queryable. The ts field is the event time.

Good to know

  • There is no HEC on InsightIDR, so send generic JSON. The Splunk HEC format would arrive as unparsed text; use JSON array or NDJSON to a Custom Logs or Generic API source.
  • Delivery is at-least-once, not exactly-once. Every event carries a stable seq and hash to dedup on. The feed carries operator identity (member emails, source IPs, roles and approver emails); no backup data and no secret values. For the shared push mechanics and the pull alternative, see forwarding the audit log to your SIEM.

Last updated .