# Rapid7 Destination

## Overview

Destinations are integrations that receive alerts from rules, policies, system health notifications, and rule errors. Panther supports configuring workflows within [Rapid7's InsightConnect](https://docs.rapid7.com/insightconnect/) product as the destination to be triggered by alerts within Panther.

## How to set up Rapid7 InsightConnect destinations in Panther

### Step 1: Configure the workflow in InsightConnect

In this step, you will create a simple workflow that will be triggered by receiving a Panther alert. You will likely want to build on to the workflow by adding steps for whatever you need it to do—e.g., creating threats in InsightIDR or firing other workflows.

1. Log in to Rapid7 InsightConnect.\
   ![Under an "insightConnect" header is a blue "Open" button.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-81820c92316cecbccd8429e9b1a63429668eebe3%2FScreenshot%202024-05-28%20at%2014.57.22.png?alt=media)
2. In the left-hand navigation bar, click **Workflows**.\
   ![Under a "Rapid7" header is an "insightConnect" sub-header. Below that is a navigation bar, with the "Workflows" option circled.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-8ff33efd8de42ccda619634781092b229465112d%2Fimage%20\(2\)%20\(12\).png?alt=media)
3. Click **Add Workflow**.\
   ![To the right of a search field, an "Add Workflow" button is circled.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-cbe2b0585b0dcacca4b311b71825458ee55d7136%2Fimage.png?alt=media)
4. Download the **Panther Sample Alert Destination Workflow** file found [at the end of this step](#panther-sample-workflow-file).
   * This file contains the object schema for Panther to start triggering the workflow, and is the simplest way to bootstrap the workflow.
5. In the **Add Workflow** modal, click **Import from File**, then select the **Panther Sample Alert Destination Workflow** file you downloaded.\
   ![Under an "Add Workflow" header are three buttons: Start From Scratch, Browse Templates, and Import from File. "Import from File" is circled.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-6f9f236d0116679a3606614224de3777c6bb862a%2FScreenshot%202024-05-28%20at%2015.02.08.png?alt=media)
6. Once the workflow is populated, click **Edit in Builder**.
7. In the upper-right corner, click **Edit**.\
   ![Buttons with differing icons are shown. On the right side is a blue "Edit" button.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-73447c7a032f36e9e21614b00091b7a57360a751%2Fimage.png?alt=media)
8. Click the **Panther Alert** trigger (the first node in the workflow).\ <img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-f9e4f4e8d73a853f5a9b9049dbbe762fdbb754d9%2Fpantheralerttrigger.webp?alt=media" alt="A &#x22;Panther Alert&#x22; label is above a symbol with a circle connected to a plus sign." data-size="original">
9. In the **Configure Details** form, check the **Require API Key authentication** checkbox. Panther does not support unauthenticated workflow executions.\
   ![A Configure Details form has various fields, like Name, Trigger Description, and Require API Key authentication.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-8db4c40a770d863cb566872433134b9be74d0abe%2Fimage.png?alt=media)
10. Click **Save Step**.
11. In the **How to Use** section on the right-hand side of the window, copy the **API Trigger URL** and store it in a secure location. You will input this value into Panther in a later step.\
    ![Under a How to Use header is an API Trigger URL field, with a URL value.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-87cc5c5be8764c2ed479d5f367bb807b2beb9b44%2Fapitriggerurl.webp?alt=media)
12. Make any other desired modifications to the workflow, such as creating a threat or triggering other workflows.
13. Click **Publish Changes**.\
    ![Various buttons with different icons are shown. On the right-side is a blue "Publish Changes" button.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-7139d46a51d5c1f95ca61a6beeec76c0a646e8be%2Fimage.png?alt=media)
14. Click the workflow's toggle to enable it.\
    ![On the right side of text reading "Panther Sample Alert Destination Workflow," is a toggle set to ON.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-875ba2ef0ebaaba1689999d6373bd4754b231974%2Fimage.png?alt=media)

#### Panther sample workflow file

Below is an icon file exported from Rapid7, which contains a simple Panther workflow:

{% file src="<https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-900b0472eae4895e105b1178ff07defa918dba61%2FPanther%20Sample%20Alert%20Destination%20Workflow.icon?alt=media>" %}

### Step 2: Generate a Rapid7 API key

You will need to provide Panther a Rapid7 API key in the next step of this process.

1. In your Rapid7 console, navigate to your [Insight control panel](https://insight.rapid7.com/platform#/apiKeyManagement).
2. In the navigation bar, under **API Key Management**, select either **Organization Keys** or **User Keys**.
   * It's recommended to create a tightly scoped user key for this purpose, but any key with permission to run the workflow can be used.
   * Learn more about Rapid7 API keys in the [Managing Platform API Keys documentation](https://docs.rapid7.com/insight/managing-platform-api-keys/).\
     ![A navigation bar titled "Insight Platform" is shown, and an "API Key Management" value is expanded to show "User Keys" and "Organization Keys."](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-3318debd9df5879fe638f6997e44058728fbeb87%2FScreenshot%202024-05-28%20at%2016.48.04.png?alt=media)
3. Click **Generate New \<User or Organization> Key**. Follow the instructions on [Rapid7's Managing Platform API Keys documentation](https://docs.rapid7.com/insight/managing-platform-api-keys) to finish creating the key.\
   ![A "Generate New User Key" button is shown.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-c527878dd82e8ea091bb8e808be78cf4384ae71a%2FScreenshot%202024-05-28%20at%2016.48.09.png?alt=media)
   * Copy the generated key and store it in a secure location, as you will need it in the following step.

### Step 3: Configure the Rapid7 alert destination in Panther

1. In the left-hand navigation bar of your Panther Console, click **Configure** > **Alert Destinations**.
2. Click **+Add your first Destination**.
   * If you have already created Destinations, click **Create New** in the upper right side of the page to add a new Destination.
3. Click **Rapid7**.
4. Fill out the form to configure the destination:
   * **Display Name**: Enter a descriptive name.
   * **Workflow URL**: Enter the Trigger URL for the workflow you built in the previous section of this documentation.
   * **API Key**: Enter the API Key that you created in the previous section of this documentation.
   * **Severity**: Select the severity level of alerts to send to this destination.
   * **Alert Types**: Select the alert types to send to this destination.
   * **Log Type**: By default, we will send alerts from all log types. Specify log types here if you want to only send alerts from specific log types.
   * **Allow Manual Dispatch**: Set this toggle ON if you'd like to be able to [manually dispatch alerts](https://docs.panther.com/alerts#manual-alert-dispatch) to this destination.\
     ![A "Configure your Rapid7 Insight Connect Destination" form is shown, with fields for "Display Name," "Workflow URL," "API Key," and others.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-2e27c0c9d23917803af7a8ab82525e3b169c1938%2FScreenshot%202024-05-28%20at%2016.07.20.png?alt=media)
5. Click **Add Destination**.
6. On the final page, optionally click **Send Test Alert** to test the integration.
   * You'll be able to see the started workflow in InsightConnect, within the **Jobs** section.
7. When you are finished, click **Finish Setup**.

## Additional Information on Destinations

For more information on alert routing order, modifying or deleting destinations, and workflow automation, please see the Panther docs: [Destinations](https://docs.panther.com/destinations).
