Cloud Control Center sends its logs to Rapid7 InsightIDR through the HEC Log Exporter external monitor, which posts events to HTTP Event Collector (HEC) compatible endpoints. In InsightIDR, a Custom Logs event source that uses the Webhook collection method provides a unique HTTPS URL. Cloud Control Center posts each event to that URL as JSON, and the event is available in InsightIDR Log Search within seconds. No Rapid7 Collector, Insight Agent, or on-premises server is required.
In InsightIDR, Elisity events can be searched, added to dashboards, and used in custom detection rules. Custom Logs is a Raw Data event source, so these events do not feed the InsightIDR built-in user behavior analytics or out-of-the-box detections. For the log categories that the HEC Log Exporter sends, see Connect HEC Log Exporter.
Note: If your environment already runs an on-premises Rapid7 Collector, you can forward events with syslog and the Collector's Listen on Network Port collection method instead. See Configure Syslog Forwarding for CCC Monitoring Events.
Prerequisites
- Administrator access to Monitoring > External Monitors in Cloud Control Center.
- Permission in InsightIDR to add event sources under Data Connectors > Data Collectors.
- Cloud Control Center must be able to reach the InsightIDR webhook host for your region, for example
us3.webhook.data.insight.rapid7.com, over HTTPS (port 443, TLS 1.2 or higher). - Cloud Control Center runs one log export connector at a time. If a Splunk or Microsoft Sentinel connector is configured, remove it before you add the HEC Log Exporter. A syslog monitor can remain configured alongside it.
Configure Rapid7 InsightIDR
Create the Webhook Event Source
Step 1. In InsightIDR, navigate to Data Connectors > Data Collectors.
Step 2. Open the Event Sources tab and select Add Event Source.
Step 3. Under Raw Data, select Custom Logs. You can also search for "Custom Logs" and select the Rapid7 Custom Logs tile.
Step 4. Under the Cloud collection methods, select Webhook.
Step 5. Enter a name for the event source, for example Elisity Cloud Control Center.
Step 6. Select Copy to copy the Webhook URL. The URL has the format https://<region>.webhook.data.insight.rapid7.com/v1/ingress/<unique-id>.
Step 7. Leave JSON Events Key blank. Cloud Control Center sends one event per request, wrapped in a single JSON object, so InsightIDR stores the whole request body as one event.
Step 8. Select Save.
Important: The webhook URL is the only credential that the InsightIDR endpoint checks. Anyone who has the URL can write logs into your InsightIDR tenant. Store it as you would an API key, and do not share it in tickets or chat. If the URL is exposed, select Generate a new Webhook URL in the event source and update the URL in Cloud Control Center.
Test the Webhook (Optional)
Before you configure Cloud Control Center, you can send a test event in the same shape as a Cloud Control Center event to confirm that the URL works. Run the following command from any machine with internet access, replacing <webhook-url> with the URL from Step 6. Keep the whole command on one line. A line break inside the quoted URL causes curl to fail with "URL rejected: Malformed input".
curl --verbose "<webhook-url>" -H "Authorization: Bearer test" -H "Content-Type: application/json" --data '{"data":{"action":"test"},"collector_ms":1}'
A successful request returns HTTP/2 200 with an empty body. Within a minute, Log Search shows the following event under the new event source:
{"data":{"action":"test"},"collector_ms":1}
The command includes an Authorization: Bearer header because Cloud Control Center always sends one. InsightIDR accepts the request with this header and ignores its value.
Configure Cloud Control Center
Step 1. Log in to Cloud Control Center and navigate to Monitoring > External Monitors.
Step 2. Select + Add External Monitor, search for HEC, and select Configure on the HEC Log Exporter tile.
Step 3. In the Add External Monitor drawer, complete the fields as described in the following table.
| Field | Value | Description |
|---|---|---|
| URL | The InsightIDR webhook URL from Configure Rapid7 InsightIDR | The address where Cloud Control Center posts each event. |
| Token | Any placeholder value, for example rapid7-webhook
|
Cloud Control Center requires a value. InsightIDR authenticates the request by its URL and ignores the token. |
| Token Prefix |
Bearer (default) |
InsightIDR accepts requests that include this header. |
| Export Format | JSON | InsightIDR parses JSON into searchable fields. Events sent in RAW, Common Event Format (CEF), or Log Event Extended Format (LEEF) arrive as a single unparsed string. |
Step 4. Select Submit. The connector appears on the External Monitors page, and the HEC Log Exporter tile shows Active.
Step 5. Generate an event in Cloud Control Center. Logging out and logging back in is sufficient, because each login writes an audit log entry.
Step 6. In InsightIDR, open Log Search, select the log for the event source that you created, and set the time range to the last 15 minutes. The event appears with its data.* fields parsed.
Mapping
Cloud Control Center wraps each event in a single JSON object. The event fields are nested under data, so in Log Search they are available as data.username, data.category, data.level, and so on. Each event arrives in InsightIDR in the following format:
{
"data": {
"id": "<event-id>",
"level": "INFO",
"type": "...",
"category": "...",
"action": "...",
"username": "admin@example.com",
"roles": "...",
"context": { },
"time": "2026-10-08T14:23:45.123Z",
"octime": "2026-10-08T14:23:45.000Z"
},
"collector_ms": 1791469425123
}
The following Log Entry Query Language (LEQL) queries are a starting point for searches, dashboard cards, and custom detection rules in InsightIDR.
| Purpose | Query |
|---|---|
| All Cloud Control Center audit activity by one administrator | where(data.username = "admin@example.com") |
| Event volume by category | groupby(data.category) calculate(count) |
| Warnings and errors only | where(data.level = "WARN" OR data.level = "ERROR") |
Troubleshooting
| Symptom | Likely cause | Resolution |
|---|---|---|
| The test command returns "URL rejected: Malformed input" | A line break or space inside the quoted URL | Enter the whole command on one line. |
| The connector reports a timeout or connection failure | The URL does not match the event source, or the regional host is incorrect | Confirm that the URL in Cloud Control Center, including the regional host (for example us3.webhook.data.insight.rapid7.com), matches the event source. If the failure persists, contact Elisity Support. |
| The webhook returns a non-2xx response | The webhook URL was regenerated, or the event source was deleted | Copy the current URL from the event source and update the URL field in Cloud Control Center. |
| Log Search shows no events, but the connector shows Active | The wrong log is selected, or the time range is too narrow | Select the log for the Custom Logs event source and widen the time range. |
| Events arrive as a single unparsed string | Export Format is set to RAW, CEF, or LEEF | Set Export Format to JSON. |
If an event is not delivered, because the webhook returns a non-2xx response or does not reply within 10 seconds, Cloud Control Center keeps the event and retries it on the next delivery cycle. A short outage does not cause data loss.
Related Articles
- Connect HEC Log Exporter
- Configure Syslog Forwarding for CCC Monitoring Events
- Monitoring
- Custom Logs (Rapid7 InsightIDR documentation)
- InsightIDR Event Sources (Rapid7 InsightIDR documentation)