Skip to main content

Configure Rapid7 InsightIDR and Nebula integration

Effective August 18, 2023, the integration between Rapid7 and Nebula has reached its End of Maintenance (EOM). While the integration remains available for use, we would like to inform you that it will no longer receive updates. We encourage you to exercise caution when using this integration, as any use will be at your own risk. We are committed to providing ongoing support for common product usage questions and access to our online articles.

To configure the integration, you will need to:

  • Install the Collector component on a designated Windows™ or Linux™ server.
  • Configure a syslog communication endpoint to send Nebula syslog data to your Collector.
  • Add the Nebula event source in Rapid7 InsightIDR.

Configure Collector and syslog endpoint

  1. Install the Collector component on a Windows or Linux server. For more information, see Rapid7's Collector Overview support documentation.
  2. Log in to Nebula and go to Configure > Syslog Logging.
  3. Designate one of your Malwarebytes Windows endpoints to forward syslog data to your Collector. Follow the steps in the article Configure Syslog in Nebula platform. When configuring Syslog Communication Settings, enter your Collector's IP address for the IP Address/Host field.
    If you are using Malwarebytes Breach Remediation, see the Event Logging to syslog section of the Breach Remediation Windows Administrator Guide for configuration instructions.

Configure InsightIDR to receive event source data

  1. Log in to your InsightIDR console and go to Data Collection > Event Sources > Add Event Source > select Virus Scan.
  2. On the Add Event Source page, complete the required fields: 
    • Select a Collector: Select the Collector to receive Malwarebytes syslog data.
    • Select Event Source Type: Select Malwarebytes from the drop-down menu.
    • Name Event Source: Enter a name for the event source.
    • Collection Method: Select Listen on Network Port.
    • Enter Port Number: Choose the same port number and protocol as in the Nebula Syslog Communication Settings.
  3. Click Save.

Once you've finished configuring the integration, confirm you are receiving incoming Malwarebytes events by going to Log Search and searching for Malwarebytes.

 

Return to the Rapid7 InsightIDR and Nebula integration guide.

Related articles