Rapid7 Insight
Rapid7 Insight is a security analytics and threat intelligence platform that enables automated incident detection and response.
Rapid7 Insight is a powerful threat intelligence and analytics platform that provides real-time visibility into the global threat landscape. The Rapid7 Insight connector for Swimlane Turbine allows users to seamlessly integrate threat intelligence into their security workflows. By leveraging this connector, users can automatically retrieve indicators of compromise (IOCs) based on specific values, enhancing incident response and proactive threat hunting. The integration streamlines the process of gathering and analyzing threat data, enabling security teams to respond more effectively to potential threats.
Prerequisites
To effectively utilize the Rapid7 Insight connector within Swimlane Turbine, ensure you have the following prerequisites:
- HTTP Basic Authentication with the following parameters:
- URL: The endpoint for the Rapid7 Insight API.
- Account ID: Your unique identifier for accessing Rapid7 services.
- API Key: A secure key generated by Rapid7 for API access.
Capabilities
This connector provides the following capabilities:
- Get IOC by Value
Asset Setup
You can obtain your account ID and API key from the IntSights cloud platform UI from the 'Subscription' page. Please note that the API key is the same key used to obtain connectivity between IntSights virtual appliance and the cloud platform, so if you have generated it in the past you can re-use it for the Rest API connectivity.
Configurations
HTTP Basic Authentication
Authenticates using username and password.
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
username | Intel IntSights Account ID | string | Required |
password | Intel IntSights API Key | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Get IOC By Value
Retrieve indicators of compromise (IOCs) from Rapid7 Insight using a specific value provided as input.
Endpoint
- URL: public/v3/iocs/ioc-by-value
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.iocValue | string | Required | Parameters for the Get IOC By Value action |
headers | object | Optional | HTTP headers for the request |
headers.Content-type | string | Optional | HTTP headers for the request |
headers.Account-id | string | Optional | HTTP headers for the request |
Input Example
{"parameters":{"iocValue":"intsiights.com"},"headers":{"Content-type":"application/json"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
value | string | Value for the parameter |
type | string | Type of the resource |
status | string | Status value |
severity | string | Output field: severity |
score | number | Score value |
lastUpdateDate | string | Date value |
lastSeen | string | Output field: lastSeen |
firstSeen | string | Output field: firstSeen |
relatedMalware | array | Output field: relatedMalware |
relatedMalware.file_name | string | Name of the resource |
relatedMalware.file | string | Output field: relatedMalware.file |
relatedCampaigns | array | Output field: relatedCampaigns |
relatedCampaigns.file_name | string | Name of the resource |
relatedCampaigns.file | string | Output field: relatedCampaigns.file |
relatedThreatActors | array | Output field: relatedThreatActors |
relatedThreatActors.file_name | string | Name of the resource |
relatedThreatActors.file | string | Output field: relatedThreatActors.file |
reportedFeeds | array | Output field: reportedFeeds |
reportedFeeds.id | string | Unique identifier |
reportedFeeds.name | string | Name of the resource |
reportedFeeds.confidenceLevel | number | Unique identifier |
whitelisted | boolean | Output field: whitelisted |
tags | array | Output field: tags |
Output Example
{"status_code":200,"response_headers":{"Date":"Thu, 10 Nov 2022 17:53:29 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","set-cookie":"env=production-apiExternal; Path=/; SameSite=Lax, dash_version=6.55.2; Path=/; S...","content-security-policy":"default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' data:...","x-dns-prefetch-control":"off","expect-ct":"max-age=0","x-frame-options":"SAMEORIGIN","strict-transport-se...
Response Headers
Header | Description | Example |
|---|---|---|
Cache-Control | Directives for caching mechanisms | no-store, no-cache, must-revalidate, proxy-revalidate |
CF-Cache-Status | HTTP response header: CF-Cache-Status | DYNAMIC |
CF-RAY | HTTP response header: CF-RAY | 7680a5d50c230108-GRU |
Connection | HTTP response header: Connection | keep-alive |
Content-Encoding | HTTP response header: Content-Encoding | gzip |
content-security-policy | HTTP response header: content-security-policy | default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' data: fonts.gstatic.com *.hotjar.com *.hotjar.io;img-src 'self' data: blob: www.google-analytics.com *.pendo.io *.hotjar.com *.hotjar.io pendo-static-6269273820233728.storage.googleapis.com pendo-eu-static-6269273820233728.storage.googleapis.com res.cloudinary.com;object-src 'none';script-src 'self' 'unsafe-eval' 'sha256-0/SE6M9R9UcpOPxN4PuJl8a+D5x78/T867+4sNzJrIE=' 'sha256-I8NX4g/ztbMZhGQFeaqXpHct8b5xp6vTKNCFzYH/0RY=' 'sha256-c1qWgWjXzn8H7npoduT2Py31E2fcmmyamL53Qb5dg90=' 'sha256-CQF45vy2UbV5fy1ZT1O8TPpzHpAv9GIMuE74MjNZGH4=' 'sha256-un7FjUTh8h237tupzdOqq59VBnjgcttntKRp9uevzw4=' 'sha256-9TTI1c5jN4zrUq7DBGweqLN2Xmlyqyf1jSHJCcbuBzI=' 'sha256-3/VkuILPEhxV7LhLtCV73w5Pw3gI3FB1A4+fDWLb1SI=' 'sha256-YJ7Tsl+I+cTrC3lLCmUm0FAgy6XsYyZogUti8tJPzuc=' 'sha256-Zopv4K+WF+yY2+iYhjl5LM5uT4cL+0k4bv25BcBUAw0=' www.recaptcha.net www.gstatic.com www.gstatic.cn www.google-analytics.com *.pendo.io pendo-io-static.storage.googleapis.com pendo-eu-static.storage.googleapis.com pendo-static-6269273820233728.storage.googleapis.com pendo-eu-static-6269273820233728.storage.googleapis.com *.hotjar.com *.hotjar.io;style-src 'self' 'unsafe-inline' fonts.googleapis.com *.pendo.io pendo-static-6269273820233728.storage.googleapis.com pendo-eu-static-6269273820233728.storage.googleapis.com https://cdn.rawgit.com/google/code-prettify/master/loader/prettify.css https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/prettify.css https://cdn.jsdelivr.net/npm/@mdi/font@latest/css/materialdesignicons.min.css;frame-src 'self' *.pendo.io *.hotjar.com *.hotjar.io www.recaptcha.net;frame-ancestors 'self' *.pendo.io;child-src 'self' *.pendo.io;connect-src 'self' blob: *.r7ops.com *.rapid7.com docs.google.com stats.g.doubleclick.net *.sentry.io *.hotjar.com .hotjar.io wss://.hotjar.com fonts.gstatic.com *.hotjar.com *.hotjar.io www.google-analytics.com *.pendo.io pendo-static-6269273820233728.storage.googleapis.com pendo-eu-static-6269273820233728.storage.googleapis.com res.cloudinary.com www.recaptcha.net www.gstatic.com www.gstatic.cn pendo-io-static.storage.googleapis.com pendo-eu-static.storage.googleapis.com fonts.googleapis.com https://cdn.rawgit.com/google/code-prettify/master/loader/prettify.css https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/prettify.css https://cdn.jsdelivr.net/npm/@mdi/font@latest/css/materialdesignicons.min.css |
Content-Type | The media type of the resource | application/json; charset=utf-8 |
Date | The date and time at which the message was originated | Thu, 10 Nov 2022 17:53:29 GMT |
etag | An identifier for a specific version of a resource | W/"255-GFKzl8ha9ZeGrtJ0JxI/f7RqV7Y" |
expect-ct | HTTP response header: expect-ct | max-age=0 |
expires | The date/time after which the response is considered stale | 0 |
pragma | HTTP response header: pragma | no-cache |
referrer-policy | HTTP response header: referrer-policy | same-origin |
Server | Information about the software used by the origin server | cloudflare |
set-cookie | HTTP response header: set-cookie | env=production-apiExternal; Path=/; SameSite=Lax, dash_version=6.55.2; Path=/; SameSite=Lax |
strict-transport-security | HTTP response header: strict-transport-security | max-age=15724800; includeSubDomains |
surrogate-control | HTTP response header: surrogate-control | no-store |
Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked |
x-content-type-options | HTTP response header: x-content-type-options | nosniff |
x-dns-prefetch-control | HTTP response header: x-dns-prefetch-control | off |
x-download-options | HTTP response header: x-download-options | noopen |
x-frame-options | HTTP response header: x-frame-options | SAMEORIGIN |
x-permitted-cross-domain-policies | HTTP response header: x-permitted-cross-domain-policies | none |
x-request-account-name | HTTP response header: x-request-account-name | Swimlane NFR |
x-request-route-path | HTTP response header: x-request-route-path | /public/v3/iocs/ioc-by-value |
x-username | HTTP response header: x-username | Swimlane NFR |
x-xss-protection | HTTP response header: x-xss-protection | 0 |