Rapid7 InsightIDR — Alert Ingestion Guide

this guide covers two approaches for ingesting rapid7 insightidr investigations and alerts into swimlane turbine, normalized to turbine schema format connector — use the rapid7 insightidr v2 connector actions directly in a playbook for full control over your workflow component — use the rapid7 insightidr alert ingestion component for a turnkey webhook based pipeline with investigation enrichment, observable extraction, and turbine schema emission both approaches deliver alerts in swimlane's turbine schema format one downstream playbook handles alerts from any source ingestion flow key capabilities unified alert format — every insightidr investigation/alert is normalized to turbine schema, enabling cross vendor playbooks and dashboards investigation enrichment — fetches investigation details, related alerts, evidence, and actors via the insightidr api before ingestion observables and mitre att\&ck — parses iocs from enriched alert content and maps mitre att\&ck tactics and techniques when available near real time webhook ingestion — investigation webhooks trigger enrichment and emission as investigations are created or updated in insightidr (no polling loop required for the primary component flow) using the connector the rapid7 insightidr v2 connector provides investigation and alert actions you can compose into a custom ingestion playbook list investigations , get investigation , list alerts investigation , get product list alerts by investigation , and retrieve evidence for alert use this approach when you want full control over your playbook logic and custom processing how it works discover investigations — use list investigations (or a webhook/sensor that supplies an investigation id) to identify investigations to process fetch investigation details — use get investigation to retrieve investigation metadata (title, priority, status, timestamps, assignee) list related alerts — use list alerts investigation (and optionally get product list alerts by investigation ) to retrieve alerts tied to the investigation enrich with evidence — use retrieve evidence for alert for each alert rrn to pull evidence used for observables and context normalize — use playbook logic or a transform block to map fields to turbine schema format process — create records, emit to an ingest sensor, or route alerts based on your playbook design connector setup prerequisites rapid7 insight platform api key with access to insightidr investigations and alerts your insightidr regional api base url (for example https //us api insight rapid7 com ) the rapid7 insightidr v2 connector installed from the turbine marketplace steps create an asset — in turbine, create a new rapid7 insightidr v2 asset with your api base url and x api key create a playbook — create a new playbook with a scheduled trigger (for polling) or a webhook/sensor trigger (for investigation events) add investigation actions — add list investigations and/or get investigation to retrieve investigation context add alert actions — add list alerts investigation to enumerate alerts for each investigation id or rrn add evidence enrichment — add retrieve evidence for alert in a loop over alert rrns when you need ioc and evidence context build processing logic — add playbook steps to normalize alerts to turbine schema, create records, and handle errors authentication the connector authenticates with an insightidr platform api key field required description url yes regional insightidr api base url (for example https //us api insight rapid7 com or https //us2 api insight rapid7 com ) x api key yes rapid7 platform api key verify ssl no enable or disable ssl verification http proxy no optional http(s) proxy common regional base urls region base url us https //us api insight rapid7 com us2 https //us2 api insight rapid7 com eu https //eu api insight rapid7 com ca https //ca api insight rapid7 com au https //au api insight rapid7 com using the component the rapid7 insightidr alert ingestion component ( rapid7 insightidr alert ingestion ) provides a turnkey pipeline that receives insightidr investigation webhooks, enriches related alerts via the insightidr api (investigation details, alerts, evidence, and actors), normalizes each alert to turbine schema, and emits turbine schema alerts to the swimlane ingest alert sensor use this approach when you want near real time ingestion with enrichment and standardized output out of the box what the component adds webhook driven ingestion — starts from an insightidr investigation/alert webhook payload; no lookback or page limit inputs are required for the primary flow bulk investigation enrichment — extracts the investigation id, then calls insightidr for investigation details and related alerts ( get investigation , list alerts investigation ) per alert enrichment — loops over investigation alerts to retrieve details, evidence ( retrieve evidence for alert ), and actors when rrns are present observables and mitre mapping — parses iocs and maps mitre att\&ck techniques where available turbine schema emission — builds a turbine schema alert, optionally applies extended field mappings from raw alert , and emits teds alert / extended fields to the ingest alert sensor component setup prerequisites rapid7 insight platform api key with access to insightidr investigations and alerts the rapid7 insightidr v2 connector installed from the turbine marketplace the rapid7 insightidr alert ingestion component imported from the marketplace a turbine webhook sensor endpoint configured to receive insightidr investigation webhooks insightidr configured to send investigation webhooks to that turbine webhook url steps create an asset — in turbine, create a new rapid7 insightidr v2 asset with your regional api base url and x api key install the component — import the rapid7 insightidr alert ingestion component from the marketplace configure the webhook sensor — ensure a turbine custom webhook sensor is enabled and note its url configure insightidr webhooks — in rapid7 insightidr, create or update an investigation webhook (or automation) that posts investigation/alert events to the turbine webhook url assign the asset — attach the rapid7 insightidr v2 asset to the component so enrichment actions can call the insightidr api wire downstream processing — connect playbooks or solutions that subscribe to the ingest alert sensor to consume turbine schema alerts component inputs variable default description webhook payload ( alert ) — required insightidr investigation/alert json delivered by the webhook sensor rapid7 insightidr asset — required connector asset with insightidr api url and api key used for enrichment error handling scenario behavior webhook / parsing failures errors stop the bulk alert parsing path; failed runs are logged in turbine investigation / alert api failures connector errors from insightidr enrichment actions are logged; dependent enrichment steps may not complete evidence / actor retrieval failures per alert enrichment may skip or fail for individual rrns while other alerts continue in the loop emit failures failures emitting to ingest alert are logged; successfully built turbine schema alerts earlier in the flow are not re emitted automatically recommended configuration scenario trigger notes production (near real time) insightidr investigation webhook → turbine webhook sensor primary recommended path for the component backfill / catch up scheduled playbook using connector list investigations use time filters on the connector; normalize manually or feed ids into enrichment logic testing manual webhook post of a sample investigation payload validate asset credentials and ingest alert emission before enabling production webhooks turbine schema output both the connector (when you normalize in playbook) and the component produce alerts in this standardized format the component emits each alert wrapped for the ingest sensor field type description alert uid string investigation or alert identifier alert title string investigation / alert title alert description string investigation / alert description alert severity string critical , high , medium , low , or other mapped values alert provider string "rapid 7 insight idr" alert organization string organization name alert categories array categories such as triggering event type alert created timestamp string rfc 3339 creation time alert start timestamp string when activity began alert end timestamp string when activity ended alert ingested timestamp string when the alert was ingested by turbine alert permalink string direct link to the investigation/alert in insightidr alert impacted hostnames array affected hostnames alert impacted ip addresses array affected ip addresses alert impacted usernames array affected user accounts alert rules array objects with rule id , rule name , rule description , rule type alert mitre attack tactic technique array tactics and techniques with uids and names observables array objects with observable type , observable value , provider, and optional enrichments signal source string source signal type (for example "alert" ) raw alert object complete original insightidr investigation/alert context sample output { "teds alert" { "alert uid" "investigation id", "alert title" "investigation / alert title", "alert description" "investigation / alert title", "alert severity" "high", "alert created timestamp" "2026 07 20t15 09 17 516z", "alert start timestamp" "2026 07 20t15 00 00 000z", "alert end timestamp" "2026 07 20t15 08 00 000z", "alert ingested timestamp" "2026 07 20t15 09 38 367z", "alert provider" "rapid 7 insight idr", "alert organization" "organization name", "alert categories" \["triggering event type"], "alert impacted hostnames" \["host1"], "alert impacted ip addresses" \[], "alert impacted usernames" \["user1"], "alert permalink" "https //insight rapid7 com/ ", "alert rules" \[ { "rule id" " ", "rule name" " ", "rule description" " ", "rule type" " " } ], "alert mitre attack tactic technique" \[ { "tactics" \[{"uid" "ta0001", "name" " "}], "technique" {"uid" "t1234", "name" " "}, "version" "" } ], "observables" \[ { "observable type" "ipv4 public", "observable value" " ", "observable primary provider" "rapid 7 insight idr", "observable primary verdict" " ", "observable primary timestamp" "2026 07 20t15 09 17 516z", "observable enrichments" \[] } ], "signal source" "alert", "raw alert" {} }, "extended fields" {} } connector reference for the full list of actions, input/output schemas, and authentication setup, see the rapid7 insightidr v2 connector documentation https //docs swimlane com/connectors/rapid7 insightidr v2