[SOAR-20236] Rapid7 InsightIDR - Triggers: Get New Alerts - Improved error handling | Updated SDK to the latest version (6.3.10) #3622

igorski-r7 · 2025-10-17T14:47:15Z

Proposed Changes

Description

Describe the proposed changes:

Triggers: Get New Alerts - Improved error handling
Updated SDK to the latest version (6.3.10)

PR Requirements

Developers, verify you have completed the following items by checking them off:

Testing

Unit Tests

Review our documentation on generating and writing plugin unit tests

Unit tests written for any new or updated code

In-Product Tests

If you are an InsightConnect customer or have access to an InsightConnect instance, the following in-product tests should be done:

Screenshot of job output with the plugin changes
Screenshot of the changed connection, actions, or triggers input within the InsightConnect workflow builder

Style

Review the style guide

For dependencies, pin OS package and Python package versions
For security, set least privileged account with USER nobody in the Dockerfile when possible
For size, use the slim SDK images when possible: rapid7/insightconnect-python-3-38-slim-plugin:{sdk-version-num} and rapid7/insightconnect-python-3-38-plugin:{sdk-version-num}
For error handling, use of PluginException and ConnectionTestException
For logging, use self.logger
For docs, use changelog style
For docs, validate markdown with insight-plugin validate which calls icon_validate to lint help.md

Functional Checklist

Work fully completed
Functional
- Any new actions/triggers include JSON test files in the tests/ directory created with insight-plugin samples
- Tests should all pass unless it's a negative test. Negative tests have a naming convention of tests/$action_bad.json
- Unsuccessful tests should fail by raising an exception causing the plugin to die and an object should be returned on successful test
- Add functioning test results to PR, sanitize any output if necessary
  - Single action/trigger insight-plugin run -T tests/example.json --debug --jq
  - All actions/triggers shortcut insight-plugin run -T all --debug --jq (use PR format at end)
- Add functioning run results to PR, sanitize any output if necessary
  - Single action/trigger insight-plugin run -R tests/example.json --debug --jq
  - All actions/triggers shortcut insight-plugin run --debug --jq (use PR format at end)

Assessment

You must validate your work to reviewers:

Run insight-plugin validate and make sure everything passes
Run the assessment tool: insight-plugin run -A. For single action validation: insight-plugin run tests/{file}.json -A
Copy (insight-plugin ... | pbcopy) and paste the output in a new post on this PR
Add required screenshots from the In-Product Tests section

… handling | Updated SDK to the latest version (6.3.10)

simonirwin-r7 · 2025-10-17T14:47:48Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Licenses	0	0	0	0	0 issues
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

ewilson-r7 · 2025-10-17T15:11:12Z

Version history states this updates the Get New Alerts trigger, but it appears the Get New Investigations trigger is being updated.

ekelly-r7 · 2025-10-17T15:23:08Z

plugins/rapid7_insightidr/requirements.txt

-python-dateutil==2.9.0
-validators==0.34.0
-aiohttp==3.12.14
+python-dateutil==2.9.0.post0


should we just use the full version (2.9.0) or is there a reason for using the post release version?

ekelly-r7 · 2025-10-17T15:41:37Z

plugins/rapid7_insightidr/komand_rapid7_insightidr/triggers/get_new_investigations/trigger.py

+            try:
+                investigations = self.get_investigations(search, last_poll_time, current_time)
+            except Exception as error:
+                self.logger.error(error)


Would be better to prepend this with log a message indicating that get_investigations has failed? (instead of logging the exception alone)

ekelly-r7 · 2025-10-17T15:43:39Z

plugins/rapid7_insightidr/komand_rapid7_insightidr/triggers/get_new_investigations/trigger.py

+                self.logger.error(error)
+                self.logger.info(f"The request will be retried after {frequency} seconds...")
+                time.sleep(frequency)
+                continue


From the ticket I understand that the raised PluginException is causing the container to restart - is the intention to avoid raising exceptions and retry indefinitely?

Just wondering what would happen here in the case of bad config (or some other error that will never resolve without intervention from the customer)

joneill-r7 · 2025-10-17T15:33:26Z

plugins/rapid7_insightidr/help.md


 # Version History

+* 12.0.2 - Triggers: `Get New Alerts` - Improved error handling | Updated SDK to the latest version (6.3.10)


Typo - should be Investigations

joneill-r7 · 2025-10-17T15:34:54Z

plugins/rapid7_insightidr/komand_rapid7_insightidr/triggers/get_new_investigations/trigger.py

-        # Flag to track the first execution
-        first_execution = True
+        # Initialize the trigger starting point
+        last_poll_time = datetime.now(UTC) - timedelta(minutes=INITIAL_LOOKBACK_MINUTES)


do we want to change this default lookback from 20 minutes to 5?

joneill-r7 · 2025-10-17T15:44:47Z

plugins/rapid7_insightidr/komand_rapid7_insightidr/triggers/get_new_investigations/trigger.py

+            for page_index in range(1, total_pages):
+                self.logger.info(f"Pulling data from page - ({page_index + 1}/{total_pages})")
+                response = self._call_search_api(
+                    request, endpoint, "POST", payload, {"size": TOTAL_SIZE, "index": page_index}


I haven't seen the API docs but before this seemed to pass 100, but I'm guessing that was a bug, this does look more accurate

joneill-r7 · 2025-10-17T15:46:46Z

plugins/rapid7_insightidr/komand_rapid7_insightidr/triggers/get_new_investigations/trigger.py

+        params: Dict[str, Any] = None,
+    ) -> Dict[str, Any]:
+        response = resource_helper.resource_request(endpoint, method, payload=payload, params=params)
+        return json.loads(response.get("resource", "{}"))


should we still catch if any invalid jSON is returned or are we happy maybe just having the generic try/except catch it?

joneill-r7 · 2025-10-17T15:48:16Z

plugins/rapid7_insightidr/komand_rapid7_insightidr/triggers/get_new_investigations/trigger.py


-            # Back off before next iteration (sleep for 15 seconds)
+            # Update last poll time for next iteration
+            last_poll_time = current_time


If a 500 isn't thrown, is this not incorrectly moving the time forward and then we could miss investigations?

joneill-r7 · 2025-10-17T15:49:52Z

plugins/rapid7_insightidr/komand_rapid7_insightidr/triggers/get_new_investigations/trigger.py

+            except Exception as error:
+                self.logger.error(error)
+                self.logger.info(f"The request will be retried after {frequency} seconds...")
+                time.sleep(frequency)


do we need this time.sleep() we've got one already at the end of the trigger?

Rapid7 InsightIDR - 20236 - Triggers: Get New Alerts - Improved error…

0576bf5

… handling | Updated SDK to the latest version (6.3.10)

igorski-r7 self-assigned this Oct 17, 2025

igorski-r7 requested a review from a team as a code owner October 17, 2025 14:47

ekelly-r7 reviewed Oct 17, 2025

View reviewed changes

joneill-r7 reviewed Oct 17, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[SOAR-20236] Rapid7 InsightIDR - Triggers: Get New Alerts - Improved error handling | Updated SDK to the latest version (6.3.10) #3622

[SOAR-20236] Rapid7 InsightIDR - Triggers: Get New Alerts - Improved error handling | Updated SDK to the latest version (6.3.10) #3622

Uh oh!

igorski-r7 commented Oct 17, 2025

Uh oh!

simonirwin-r7 commented Oct 17, 2025 •

edited

Loading

Uh oh!

ewilson-r7 commented Oct 17, 2025

Uh oh!

ekelly-r7 Oct 17, 2025

Uh oh!

ekelly-r7 Oct 17, 2025

Uh oh!

ekelly-r7 Oct 17, 2025 •

edited

Loading

Uh oh!

joneill-r7 Oct 17, 2025

Uh oh!

joneill-r7 Oct 17, 2025

Uh oh!

joneill-r7 Oct 17, 2025

Uh oh!

joneill-r7 Oct 17, 2025

Uh oh!

joneill-r7 Oct 17, 2025

Uh oh!

joneill-r7 Oct 17, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants


		# Version History

		* 12.0.2 - Triggers: `Get New Alerts` - Improved error handling \| Updated SDK to the latest version (6.3.10)

[SOAR-20236] Rapid7 InsightIDR - Triggers: Get New Alerts - Improved error handling | Updated SDK to the latest version (6.3.10) #3622

Are you sure you want to change the base?

[SOAR-20236] Rapid7 InsightIDR - Triggers: Get New Alerts - Improved error handling | Updated SDK to the latest version (6.3.10) #3622

Uh oh!

Conversation

igorski-r7 commented Oct 17, 2025

Proposed Changes

Description

PR Requirements

Testing

Unit Tests

In-Product Tests

Style

Functional Checklist

Assessment

Uh oh!

simonirwin-r7 commented Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

ewilson-r7 commented Oct 17, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ekelly-r7 Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

simonirwin-r7 commented Oct 17, 2025 •

edited

Loading

ekelly-r7 Oct 17, 2025 •

edited

Loading