Send CSE Events to Rapid7 InsightIDR

Forward Cloud Secure Edge (CSE) events to InsightIDR through an InsightIDR Collector, using the Tail File collection method

Last validated: Nov 9, 2026
20 minutes to read

Overview
Prerequisites
Step 1: Install the InsightIDR Collector
Step 2: Create a service account
Step 3: Prepare folders and permissions
Step 4: Encrypt and store the API key
Step 5: Create the Custom Logs event source
Step 6: Deploy the poller script
Step 7: Schedule and run the poller
Step 8: Verify ingestion in InsightIDR
Related

Overview

This guide explains how to send Cloud Secure Edge (CSE) events to Rapid7 InsightIDR through an InsightIDR Collector, using the Tail File collection method.

A PowerShell script on the Collector host runs every five minutes through Task Scheduler. Each time it runs, it pulls new events from the CSE Events API and appends them to a local log file, C:\CSE\logs\cse_events.log, one event per line. The InsightIDR Collector monitors this file, picks up each new line, and forwards it to InsightIDR, where the events are available in Log Search.

Prerequisites

An InsightIDR account.
A supported Windows Server host to run the Collector on, with local administrative rights. This guide was written using Windows Server 2022.
Outbound HTTPS (TCP 443) from the Windows Server host to the CSE Command Center domain and to the Rapid7 Insight Platform.
A read-only CSE API key. See Step 1: Create a read-only API key.
The Command Center domain of your CSE organization:
- US (default): https://net.banyanops.com
- EU: https://eucc.console.banyanops.com

Step 1: Install the InsightIDR Collector

1.1 In InsightIDR, in the left pane, open Data Connectors > SIEM > Data Collectors. Select Setup Collector > Download Collector, and download the Windows 64-bit version.

1.2 Run the installer on the server as an administrator. The default settings are acceptable.

1.3 Copy the Activation Key that the installer displays.

1.4 In InsightIDR, under Data Connectors > SIEM > Data Collectors > Collectors, select Activate Collector.

1.5 Enter the Activation Key, and select Activate.

1.6 Confirm that the Collector appears as running on the Collectors tab. A not fully qualified warning on the Collector can be ignored; it does not affect this integration.

Step 2: Create a service account

2.1 In an elevated administrator PowerShell window, create a local account for the poller. Enter a strong password when prompted, and record it in your password vault:

$pw = Read-Host "Enter a strong password for svc-cse-poller" -AsSecureString
New-LocalUser -Name "svc-cse-poller" -Password $pw -PasswordNeverExpires -UserMayNotChangePassword `
  -Description "CSE to InsightIDR event poller"

Note: -PasswordNeverExpires prevents the scheduled task from failing when the password expires. Apply your organization’s password policy if it requires rotation. Windows derives the key that protects C:\CSE\apikey.dpapi from the account’s password. Only an administrator can set this account’s password, and after an administrator resets it, the poller script can no longer decrypt the API key. The scheduled task also keeps the old password and stops running. If you rotate the password, run schtasks /change /tn "CSE to InsightIDR Poller" /ru svc-cse-poller in an elevated administrator Command Prompt, and enter the new password when prompted. Then run icacls C:\CSE\apikey.dpapi /grant "svc-cse-poller:M" in an elevated administrator PowerShell window, and repeat Step 4. In a domain environment, a domain service account can be used instead.

2.2 Grant the account the Log on as a batch job right, which Task Scheduler requires:

Open secpol.msc.
Navigate to Local Policies > User Rights Assignment > Log on as a batch job.
Select Add User or Group, enter svc-cse-poller, and select OK.

2.3 Select OK again in the Log on as a batch job Properties window.

Step 3: Prepare folders and permissions

3.1 Steps 3 and 4 use two PowerShell windows: an elevated administrator window, and a window running as svc-cse-poller. Run whoami before each command to confirm which window you are in.

3.2 In the elevated administrator PowerShell window, run the following. This block creates the C:\CSE folder structure and the empty event log and key files. It locks the folder down so that only administrators and SYSTEM have full control, while the service account can read everything, write to the logs and state folders, and temporarily write to the key file.

New-Item -ItemType Directory -Force -Path C:\CSE, C:\CSE\logs, C:\CSE\state | Out-Null

# Restrict the root folder: full control for SYSTEM and Administrators, read and execute for the service account
icacls C:\CSE /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" "svc-cse-poller:(OI)(CI)RX"

# Allow the service account to write events, state, and run logs
icacls C:\CSE\logs /grant "svc-cse-poller:(OI)(CI)M"
icacls C:\CSE\state /grant "svc-cse-poller:(OI)(CI)M"

# Create the empty log file now so the event source can be pointed at it
New-Item -ItemType File -Force -Path C:\CSE\logs\cse_events.log | Out-Null

# Pre-create the key file and allow the service account to write it (removed again in Step 4.5)
New-Item -ItemType File -Force -Path C:\CSE\apikey.dpapi | Out-Null
icacls C:\CSE\apikey.dpapi /grant "svc-cse-poller:M"
icacls C:\CSE\apikey.dpapi

Note: The C:\CSE folder holds every file used by this integration: the poller script, the encrypted API key, the collected event log, and the poller’s state and run logs. A different folder can be used, provided that every reference to C:\CSE in this guide is replaced with the chosen path. This includes the folder commands in Steps 3 and 4, the path variables at the top of cse_poller.ps1, the scheduled task command in Step 7, and the event source file path in Step 5.

Step 4: Encrypt and store the API key

Windows Data Protection API (DPAPI) encryption is tied to the account that performs it, so the key must be encrypted while running as svc-cse-poller.

4.1 In the elevated administrator PowerShell window, run the following. The computer name prefix ensures that Windows uses the local account. Enter the service account password when prompted; the characters do not display as you type. A new PowerShell window opens as svc-cse-poller. Keep it open until the end of Step 4.

runas /user:$env:COMPUTERNAME\svc-cse-poller powershell.exe

4.2 In the svc-cse-poller window, run the following:

$secure = (Get-Credential -UserName "cse-api-key" -Message "Paste the CSE API key into the Password field").Password

A credential dialog opens. Paste the CSE read-only API key into the Password field with Ctrl+V, without quotes, and select OK.

4.3 In the same svc-cse-poller window, run:

$secure | ConvertFrom-SecureString | Set-Content -Path C:\CSE\apikey.dpapi

4.4 Confirm that the file contains an encrypted string rather than the key itself:

Get-Content C:\CSE\apikey.dpapi

Expected result: a long hexadecimal string. Administrators can delete or replace this file, but cannot decrypt it.

4.5 In the elevated administrator PowerShell window, remove the service account’s write access to the key file. The inherited read access remains. This command fails with Access is denied if it is run in the svc-cse-poller window.

icacls C:\CSE\apikey.dpapi /remove:g svc-cse-poller
icacls C:\CSE\apikey.dpapi

Expected result: svc-cse-poller is listed with (I)(RX) only.

4.6 Verify the key and its permissions:

In the svc-cse-poller window, run the following. If your CSE organization is on the EU Command Center, replace the domain with https://eucc.console.banyanops.com.

$s = (Get-Content C:\CSE\apikey.dpapi -Raw).Trim() | ConvertTo-SecureString
$k = [System.Net.NetworkCredential]::new('', $s).Password
"Decrypted key length: $($k.Length)"
Invoke-RestMethod -Uri "https://net.banyanops.com/api/v1/events?limit=1" -Headers @{ Authorization = "Bearer $k" } | Out-Null
"API authentication succeeded"
Remove-Variable k, s

In the same window, confirm that the service account can write to C:\CSE\state but not to the C:\CSE root:

"test" | Set-Content C:\CSE\state\write_test.txt; Remove-Item C:\CSE\state\write_test.txt; "State folder: write OK"
"test" | Set-Content C:\CSE\root_test.txt   # expected: Access to the path is denied

In the elevated administrator PowerShell window, run:

(Get-Content C:\CSE\apikey.dpapi -Raw).Trim() | ConvertTo-SecureString

Expected results:

The svc-cse-poller window displays the key length and API authentication succeeded.
The write to the state folder succeeds, and the write to the root folder is denied.
The administrator window returns Key not valid for use in specified state.

Step 5: Create the Custom Logs event source

5.1 In InsightIDR, navigate to Data Connectors > SIEM > Data Collectors. In the Setup Event Source drop-down, select Add event source.

5.2 In the Add Raw Data drop-down, select Custom Logs.

5.3 Configure the event source:

Field	Value
Run On	Collector
Event Source Name	`SonicWall CSE Events`
Collector	The Collector installed in Step 1
Collection Method	Tail File
Local File Path	`C:\CSE\logs\cse_events.log`
Timezone	UTC

Select Local File Path rather than Watch shared remote directory.

5.4 Select Save.

Step 6: Deploy the poller script

6.1 Save the following PowerShell script as C:\CSE\cse_poller.ps1:

<#
.SYNOPSIS
  Polls the SonicWall Cloud Secure Edge (CSE) Events API and appends each event
  as one JSON line to a file read by an InsightIDR Custom Logs (Tail File) event source.
.NOTES
  Intended to run as the dedicated service account (svc-cse-poller) via Task Scheduler
  every 5 minutes. The API key is DPAPI-encrypted and can only be decrypted by that
  account on this machine.
  Validate in a lab before production use.
#>

# ---------------- Configuration ----------------
$CommandCenter          = 'https://net.banyanops.com'   # EU Command Center: https://eucc.console.banyanops.com
$ApiKeyPath             = 'C:\CSE\apikey.dpapi'
$OutFile                = 'C:\CSE\logs\cse_events.log'
$StateFile              = 'C:\CSE\state\last_before.txt'
$RunLog                 = 'C:\CSE\state\poller.log'
$PageSize               = 100   # events per request; pagination retrieves the rest
$InitialLookbackMinutes = 60    # first run only; CSE retains events for 14 days
$MaxRetries             = 3
# ------------------------------------------------

$ErrorActionPreference = 'Stop'
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

function Write-RunLog ([string]$Message) {
    $ts = [DateTime]::UtcNow.ToString('yyyy-MM-ddTHH:mm:ssZ')
    Add-Content -Path $RunLog -Value "$ts $Message"
}

function Invoke-CseRequest([string]$Uri, [hashtable]$Headers) {
    for ($i = 1; $i -le $MaxRetries; $i++) {
        try {
            return Invoke-RestMethod -Uri $Uri -Headers $Headers -Method Get -TimeoutSec 60
        } catch {
            if ($i -eq $MaxRetries) { throw }
            Start-Sleep -Seconds (5 * $i)
        }
    }
}

try {
    # Decrypt the DPAPI-protected key (works only for the account that encrypted it)
    $secure  = (Get-Content -Path $ApiKeyPath -Raw).Trim() | ConvertTo-SecureString
    $apiKey  = [System.Net.NetworkCredential]::new('', $secure).Password
    $headers = @{ Authorization = "Bearer $apiKey" }

    # Time window in epoch milliseconds: [previous "before", now minus 60 seconds].
    # The lag allows for clock differences and for events the Command Center is still storing.
    $before = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds() - 60000
    if (Test-Path $StateFile) {
        $after = [int64]((Get-Content -Path $StateFile -Raw).Trim())
    } else {
        $after = $before - ($InitialLookbackMinutes * 60000)
    }

    # Collect every page in memory first, so a mid-run failure writes nothing
    $lines = New-Object System.Collections.Generic.List[string]
    $skip  = 0
    $pages = 0
    do {
        $uri   = "$($CommandCenter)/api/v1/events?after=$after&before=$before&order=ASC&skip=$skip&limit=$PageSize"
        $resp  = Invoke-CseRequest -Uri $uri -Headers $headers
        $batch = if ($null -ne $resp.data) { @($resp.data) } else { @() }   # "data" is case-sensitive
        foreach ($evt in $batch) {
            $lines.Add(($evt | ConvertTo-Json -Depth 20 -Compress))
        }
        $skip += $PageSize
        $pages++
    } while ($batch.Count -eq $PageSize)

    if ($lines.Count -gt 0) {
        [System.IO.File]::AppendAllLines($OutFile, $lines, (New-Object System.Text.UTF8Encoding($false)))
    }

    # Advance the window only after a fully successful run
    Set-Content -Path $StateFile -Value $before
    Write-RunLog "OK after=$after before=$before events=$($lines.Count) pages=$pages"
}
catch {
    Write-RunLog "ERROR after=$after before=$before $($_.Exception.Message)"
    exit 1
}

6.2 Open the script in an editor, and set $CommandCenter to the Command Center domain of your CSE organization (see Prerequisites). Adjust $InitialLookbackMinutes if the first run needs to collect more history. The maximum is 14 days, the CSE retention period.

Step 7: Schedule and run the poller

7.1 In an elevated administrator Command Prompt, create a task that runs every 5 minutes as the svc-cse-poller service account. Enter the service account password when prompted:

schtasks /create /tn "CSE to InsightIDR Poller" /tr "powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\CSE\cse_poller.ps1" /sc minute /mo 5 /ru svc-cse-poller /rp * /f

7.2 Start the first run immediately:

schtasks /run /tn "CSE to InsightIDR Poller"

7.3 After about one minute, confirm that the run succeeded:

schtasks /query /tn "CSE to InsightIDR Poller" /v /fo list

Expected result: Last Result: 0.

7.4 Verify the output in an elevated administrator PowerShell window:

Get-Content C:\CSE\state\poller.log -Tail 5
Get-Content C:\CSE\logs\cse_events.log -Tail 3

Expected result: poller.log shows a line beginning with OK and an event count. If the count is greater than zero, cse_events.log contains one JSON object per line. A count of zero means that no events occurred in the lookback window.

Step 8: Verify ingestion in InsightIDR

8.1 In InsightIDR, navigate to Logs > SIEM > Log Search, and select the SonicWall CSE Events event source under Raw Log. Events appear 5 to 7 minutes after the scheduled task first runs.

Event Properties and Definitions, for the fields in each event
Retrieve Events with the API, for how the Events API pages results

Was this page helpful?