What you are evaluating
No-code workflows connect supported services, while an Insight Orchestrator can execute actions within the customer’s network. This software has a different scope from Rapid7’s managed detection and response service.
A useful evaluation context
Candidate when Rapid7 SIEM or vulnerability management is already in use and the team needs customer-owned workflows.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- No-code workflows the customer designs for enrichment, ticketing, and response.
- Plugins that connect Rapid7 and third-party tools the buyer already runs.
- Human decision steps plus an Insight Orchestrator for on-premises actions that cannot run in SaaS.
Where it fits in the work
- Build a cloud workflow for a synthetic alert, then add a human decision before containment.
- Place on-network actions on an Orchestrator rather than exposing those systems to SaaS directly.
- Document software operating responsibilities separately from any Rapid7 managed-service agreement and the actions that provider may perform.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
In an authorized test environment, run a synthetic vulnerability ticket workflow that waits for a human decision, then calls a disposable test API through an Orchestrator without touching production.
Evidence to look for
The workflow log shows the human decision, Orchestrator execution, and that production systems received no change.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- Which actions must run on an Insight Orchestrator because they cannot execute in SaaS?
- Who owns workflow credentials when Rapid7 also delivers a separate MDR service?
- How are workflows exported if Automation is retired while Rapid7 MDR continues, or the reverse, without sharing production orchestrator credentials?
Names you may encounter: InsightConnect. Historical names do not establish current availability or feature equivalence.