Rapid7 Insight Threat Command
The Rapid7 Insight Threat Command connector facilitates the integration of Rapid7's threat intelligence and alert management capabilities into the Swimlane Turbine platform.
Rapid7 Insight Threat Command is a powerful threat intelligence and response management platform that enables security teams to identify, investigate, and take action on threats. This connector allows Swimlane Turbine users to automate the management of alerts, enrich indicators of compromise (IOCs), and initiate takedown requests directly within the Swimlane ecosystem. By integrating with Rapid7 Insight Threat Command, users can streamline their security operations, enhance their threat intelligence capabilities, and accelerate incident response times, all from within the familiar Swimlane interface.
Limitations
None to date.
Prerequisites
To effectively utilize the Rapid7 Insight Threat Command connector with Swimlane Turbine, ensure you have the following prerequisites:
- HTTP Basic Authentication with the following parameters:
- URL: The endpoint for the Rapid7 Insight Threat Command API.
- Account ID: Your unique identifier for accessing your Rapid7 account.
- API Key: A secure key generated within Rapid7 for authenticating API requests.
Supported Versions
This connector supports the latest version of the Rapid7 Insight Threat Command REST API.
Additional Docs
For more information, refer to the Rapid7 API documentation.
Configuration
Authentication Methods
Rapid7 HTTP Basic Authentication
To authenticate with the Rapid7 Insight Threat Command API, you must use HTTP Basic Authentication. This method requires the following credentials:
- Username: Your Rapid7 Insight Threat Command API username.
- Password: Your corresponding password.
These credentials are mandatory and must be provided to successfully connect to the API. Ensure that your username and password are kept secure and not shared with unauthorized individuals.
Capabilities
The Rapid7 Insight Threat Command integration provides the following capabilities:
- Add Manual Alert
- Assign Alert
- Close Alert
- Get Alert
- Get Alert Activity Log
- Get Alert CSV
- Get Alert's HTML Content
- Get Alert Image
- Get Alert Report Status
- Get Alert Takedown Status
- Get Alert WHOIS File
- Get Alerts
- Get IOC by Value
- Request IOC Enrichment
- Takedown Request ... and so on
Configurations
Rapid7 HTTP Basic Authentication
Authenticates using username and password.
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
username | Username | string | Required |
password | API Key. Do not provide it base64 encoded, it will be encoded automatically along with the username. | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Add Manual Alert
Adds a manual alert to Rapid7 Insight Threat Command and returns the new Alert ID, requiring a JSON body input.
Endpoint
- URL: /public/v1/data/alerts/add-alert
- Method: PUT
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
Images | object | Optional | Parameter for Add Manual Alert |
Images.files | array | Optional | Parameter for Add Manual Alert |
Images.files.file | string | Optional | Parameter for Add Manual Alert |
Images.files.file_name | string | Optional | Name of the resource |
FoundDate | string | Optional | Date value |
Details | object | Optional | Parameter for Add Manual Alert |
Details.Title | string | Optional | Parameter for Add Manual Alert |
Details.Description | string | Optional | Parameter for Add Manual Alert |
Details.Type | string | Optional | Type of the resource |
Details.SubType | string | Optional | Type of the resource |
Details.Severity | string | Optional | Parameter for Add Manual Alert |
Details.Source | object | Optional | Parameter for Add Manual Alert |
Details.Source.Type | string | Optional | Type of the resource |
Details.Source.NetworkType | string | Optional | Type of the resource |
Details.Source.URL | string | Optional | URL endpoint for the request |
Details.Source.Date | object | Optional | Date value |
Input Example
{"json_body":{"FoundDate":"2018-01-01","Details":{"Title":"API Title","Description":"API Description","Type":"ExploitableData","SubType":"VulnerabilityInTechnologyInUse","Severity":"High","Source":{"Type":"Application Store","NetworkType":"ClearWeb","URL":"http://www.blabla.com","Date":null}}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
response_text | string | Output field: response_text |
Output Example
{"status_code":401,"response_headers":{"Date":"Fri, 03 Feb 2023 15:55:27 GMT","Content-Length":"14","Connection":"keep-alive","set-cookie":"env=production-apiExternal; Path=/; SameSite=Lax, dash_version=6.59.2; Path=/; S...","content-security-policy":"default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' data:...","x-dns-prefetch-control":"off","expect-ct":"max-age=0","x-frame-options":"SAMEORIGIN","strict-transport-security":"max-age=15724800; includeSubDomains","x-download...
Assign Alert
Assign an alert to a specific assignee in Rapid7 Insight Threat Command by using the alert's ID and AssigneeID.
Endpoint
- URL: /public/v1/data/alerts/assign-alert/{{id}}
- Method: PATCH
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Assign Alert action |
AssigneeID | string | Optional | The ID of the assignee to assign the alert to |
IsMssp | boolean | Optional | Whether the assignee is an MSSP |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"AssigneeID":"string","IsMssp":true}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
headers | object | HTTP headers for the request |
response | object | Output field: response |
Output Example
{"status_code":200,"reason":"Ok","headers":null,"response":{}}
Close Alert
Closes a specified alert in Rapid7 Insight Threat Command by providing the alert ID and a closure reason.
Endpoint
- URL: /public/v1/data/alerts/close-alert/{{alert_id}}
- Method: PATCH
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.alert_id | string | Required | Parameters for the Close Alert action |
Reason | string | Optional | Response reason phrase |
FreeText | string | Optional | Parameter for Close Alert |
IsHidden | boolean | Optional | Unique identifier |
Rate | number | Optional | Parameter for Close Alert |
Input Example
{"json_body":{"Reason":"FalsePositive","FreeText":"comments...","IsHidden":true,"Rate":5},"path_parameters":{"alert_id":""}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
headers | object | HTTP headers for the request |
response | object | Output field: response |
Output Example
{"status_code":200,"reason":"Ok","headers":null,"response":{}}
Get Alert
Retrieves detailed information for a specific alert in Rapid7 Insight Threat Command using the alert's unique ID.
Endpoint
- URL: /public/v1/data/alerts/get-complete-alert/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Get Alert action |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
_id | string | Unique identifier |
FoundDate | string | Date value |
Details | object | Output field: Details |
Details.Title | string | Output field: Details.Title |
Details.Type | string | Type of the resource |
Details.SubType | string | Type of the resource |
Details.Severity | string | Output field: Details.Severity |
Details.Tags | array | Output field: Details.Tags |
Details.Tags.Name | string | Name of the resource |
Details.Tags.CreatedBy | string | Output field: Details.Tags.CreatedBy |
Details.Tags._id | string | Unique identifier |
Details.Source | object | Output field: Details.Source |
Details.Source.Type | string | Type of the resource |
Details.Source.NetworkType | string | Type of the resource |
Details.Source.URL | string | URL endpoint for the request |
Details.Source.Date | string | Date value |
Details.Images | array | Output field: Details.Images |
Details.Description | string | Output field: Details.Description |
Assignees | array | Output field: Assignees |
Assets | array | Output field: Assets |
Assets.Type | string | Type of the resource |
Assets.Value | string | Value for the parameter |
TakedownStatus | string | Status value |
Output Example
{"status_code":200,"response_headers":{"Date":"Mon, 27 Mar 2023 21:50:27 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","set-cookie":"env=production-apiExternal; Path=/; SameSite=Lax, dash_version=6.61.1; Path=/; S...","content-security-policy":"default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' data:...","x-dns-prefetch-control":"off","expect-ct":"max-age=0","x-frame-options":"SAMEORIGIN","strict-transport-se...
Get Alert Activity Log
Retrieve the activity log for a specific alert in Rapid7 Insight Threat Command using the alert's unique identifier.
Endpoint
- URL: /public/v1/data/alerts/activity-log/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Get Alert Activity Log action |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
headers | object | HTTP headers for the request |
response | array | Output field: response |
response.Type | string | Type of the resource |
response.Initiator | string | Output field: response.Initiator |
response.CreatedDate | string | Date value |
response.UpdateDate | string | Date value |
response._id | string | Unique identifier |
response.AdditionalInformation | object | Output field: response.AdditionalInformation |
response.AdditionalInformation.RemediationBlocklistUpdate | array | Date value |
response.AdditionalInformation.AskTheAnalyst | object | Output field: response.AdditionalInformation.AskTheAnalyst |
response.AdditionalInformation.AskTheAnalyst.Replies | array | Output field: response.AdditionalInformation.AskTheAnalyst.Replies |
response.AdditionalInformation.Mail | object | Output field: response.AdditionalInformation.Mail |
response.AdditionalInformation.Mail.Replies | array | Output field: response.AdditionalInformation.Mail.Replies |
response.ReadBy | array | Output field: response.ReadBy |
response.SubTypes | array | Type of the resource |
Output Example
{"status_code":200,"reason":"Ok","headers":null,"response":[{"Type":"AlertRead","Initiator":"5b1641983a21b34c6d6e6197","CreatedDate":"2018-01-01T13:09:39.305Z","UpdateDate":"2018-01-01T13:09:39.305Z","_id":"5b1641a53a21b34c6d6e6198","AdditionalInformation":{},"ReadBy":[],"SubTypes":[]}]}
Get Alert CSV
Retrieve a detailed CSV file for an alert from Rapid7 Insight Threat Command using the provided alert ID.
Endpoint
- URL: /public/v1/data/alerts/csv-file/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Get Alert CSV action |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
file | object | File |
file.file_name | string | Name of the resource |
file.file | string | Output field: file.file |
Output Example
{"status_code":200,"response_headers":{"pjsc-billing-credit-cost":"0.000131835","pjsc-billing-elapsedms":"1754","pjsc-billing-bytes":"252,335","pjsc-billing-proxy-ingress-bytes":"0","pjsc-billing-proxy-ingress-cost":"0","pjsc-billing-total-credits-remaining":"0.048495298","pjsc-billing-daily-subscription-credits-remaining":"0.047495298","pjsc-billing-prepaid-credits-remaining":"0.001","local-address":"190.195.70.130","pjsc-backend-id":"1-727r","pjsc-content-status-code":"200","pjsc-content-name"...
Get Alert's HTML Content
Retrieve the HTML content of an alert using its unique identifier from Rapid7 Insight Threat Command.
Endpoint
- URL: /public/v1/data/alerts/website-html/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Get Alert's HTML Content action |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
headers | object | HTTP headers for the request |
response | object | Output field: response |
response.WebsiteText | string | Output field: response.WebsiteText |
response.WebsiteHtml | string | Output field: response.WebsiteHtml |
Output Example
{"status_code":200,"reason":"Ok","headers":null,"response":{"WebsiteText":"website text","WebsiteHtml":"website html"}}
Get Alert Image
Retrieves the image for a specific alert from Rapid7 Insight Threat Command using the provided unique alert ID.
Endpoint
- URL: /public/v1/data/alerts/alert-image/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Get Alert Image action |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
file | object | File |
file.file_name | string | Name of the resource |
file.file | string | Output field: file.file |
Output Example
{"status_code":200,"response_headers":{"pjsc-billing-credit-cost":"0.000131835","pjsc-billing-elapsedms":"1754","pjsc-billing-bytes":"252,335","pjsc-billing-proxy-ingress-bytes":"0","pjsc-billing-proxy-ingress-cost":"0","pjsc-billing-total-credits-remaining":"0.048495298","pjsc-billing-daily-subscription-credits-remaining":"0.047495298","pjsc-billing-prepaid-credits-remaining":"0.001","local-address":"190.195.70.130","pjsc-backend-id":"1-727r","pjsc-content-status-code":"200","pjsc-content-name"...
Get Alert Report Status
Retrieve the current status of a specific alert report in Rapid7 Insight Threat Command using the alert's unique ID.
Endpoint
- URL: /public/v1/data/alerts/report-status/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Get Alert Report Status action |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
headers | object | HTTP headers for the request |
response | array | Output field: response |
response.Value | string | Value for the parameter |
response.GoogleWebRisk | object | Output field: response.GoogleWebRisk |
response.GoogleWebRisk.Status | string | Status value |
response.PhishTank | object | Output field: response.PhishTank |
response.PhishTank.Status | string | Status value |
Output Example
{"status_code":200,"reason":"Ok","headers":null,"response":[{"Value":"example.org","GoogleWebRisk":{},"PhishTank":{}}]}
Get Alert Takedown Status
Retrieve the takedown status of an alert by its unique identifier in Rapid7 Insight Threat Command.
Endpoint
- URL: /public/v1/data/alerts/takedown-status/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Get Alert Takedown Status action |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
headers | object | HTTP headers for the request |
response | string | Output field: response |
Output Example
{"status_code":200,"reason":"Ok","headers":null,"response":"Requested"}
Get Alert WHOIS File
Retrieve the WHOIS text file for a specific phishing alert in Rapid7 Insight Threat Command using the alert's unique ID.
Endpoint
- URL: /public/v1/data/alerts/whois-file/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Get Alert WHOIS File action |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
file | object | File |
file.file_name | string | Name of the resource |
file.file | string | Output field: file.file |
Output Example
{"status_code":200,"response_headers":{"pjsc-billing-credit-cost":"0.000131835","pjsc-billing-elapsedms":"1754","pjsc-billing-bytes":"252,335","pjsc-billing-proxy-ingress-bytes":"0","pjsc-billing-proxy-ingress-cost":"0","pjsc-billing-total-credits-remaining":"0.048495298","pjsc-billing-daily-subscription-credits-remaining":"0.047495298","pjsc-billing-prepaid-credits-remaining":"0.001","local-address":"190.195.70.130","pjsc-backend-id":"1-727r","pjsc-content-status-code":"200","pjsc-content-name"...
Get Alerts
Retrieves all alerts from Rapid7 Insight Threat Command, offering a detailed perspective on potential security threats.
Endpoint
- URL: /public/v1/data/alerts/alerts-list
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.alert_type | array | Optional | Parameters for the Get Alerts action |
parameters.assigned | string | Optional | Parameters for the Get Alerts action |
parameters.found_date_from | number | Optional | Parameters for the Get Alerts action |
parameters.found_date_to | number | Optional | Parameters for the Get Alerts action |
parameters.has_indicators | boolean | Optional | Parameters for the Get Alerts action |
parameters.is_closed | string | Optional | Parameters for the Get Alerts action |
parameters.is_flagged | string | Optional | Parameters for the Get Alerts action |
parameters.matched_asset_value | array | Optional | Parameters for the Get Alerts action |
parameters.network_type | array | Optional | Parameters for the Get Alerts action |
parameters.remediation_status | array | Optional | Parameters for the Get Alerts action |
parameters.severity | array | Optional | Parameters for the Get Alerts action |
parameters.source_date_from | number | Optional | Parameters for the Get Alerts action |
parameters.source_date_to | number | Optional | Parameters for the Get Alerts action |
parameters.source_type | array | Optional | Parameters for the Get Alerts action |
Input Example
{"parameters":{"alert_type":["Phishing"],"assigned":"Assigned","found_date_from":0,"found_date_to":1633047102456,"has_indicators":false,"is_closed":"Closed","is_flagged":"Flagged","matched_asset_value":["example.com"],"network_type":["DarkWeb"],"remediation_status":["InProgress","Pending"],"severity":["Low"],"source_date_from":1633047083142,"source_date_to":1633047102456,"source_type":["Application Store"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{"Date":"Mon, 27 Mar 2023 21:42:26 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","set-cookie":"env=production-apiExternal; Path=/; SameSite=Lax, dash_version=6.61.1; Path=/; S...","content-security-policy":"default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' data:...","x-dns-prefetch-control":"off","expect-ct":"max-age=0","x-frame-options":"SAMEORIGIN","strict-transport-se...
Get IOC by Value
Retrieve details for a specific Indicator of Compromise (IOC) by its value in Rapid7 Insight Threat Command, with the required iocValue parameter.
Endpoint
- URL: /public/v3/iocs/ioc-by-value
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.iocValue | string | Required | IOC value. |
Input Example
{"parameters":{"iocValue":"google.com"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
value | string | Value for the parameter |
type | string | Type of the resource |
severity | string | Output field: severity |
status | string | Status value |
score | number | Score value |
Whitelisted | string | Output field: Whitelisted |
firstSeen | string | Output field: firstSeen |
lastSeen | string | Output field: lastSeen |
LastUpdate | string | Date value |
Geolocation | string | Output field: Geolocation |
reportedFeeds | array | Output field: reportedFeeds |
reportedFeeds.id | string | Unique identifier |
reportedFeeds.name | string | Name of the resource |
reportedFeeds.confidenceLevel | number | Unique identifier |
tags | array | Output field: tags |
relatedMalwares | array | Output field: relatedMalwares |
relatedCampaigns | array | Output field: relatedCampaigns |
relatedThreatActors | array | Output field: relatedThreatActors |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"value":"example.com","type":"Domains","severity":"High","status":"Active","score":100,"Whitelisted":"false","firstSeen":"2020-01-01T20:01:27.344Z","lastSeen":"2020-01-30T16:18:51.148Z","LastUpdate":"2020-02-21T23:00:51.268Z","Geolocation":"US","reportedFeeds":[{}],"tags":["MyTag_1"],"relatedMalwares":["doppeldridex","dridex"],"relatedCampaigns":["SolarWinds"],"relatedThreatActors":["doppelspider"]}}
Request IOC Enrichment
Retrieve comprehensive enrichment data for a specified Indicator of Compromise (IOC) from Rapid7 Insight Threat Command.
Endpoint
- URL: /public/v1/iocs/enrich/{{iocValue}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.iocValue | string | Required | IOC value. Supported IOC types- Domains, URLs, IP addresses, and File hashes. Any other type will cause a response with "Status"- Failed. |
Input Example
{"path_parameters":{"iocValue":"google.com"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
OriginalValue | string | Value for the parameter |
Status | string | Status value |
Data | object | Response data |
Data.Value | string | Response data |
Data.Type | string | Response data |
Data.IsKnownIoc | boolean | Response data |
Data.Whitelisted | boolean | Response data |
Data.Status | string | Response data |
Data.Tags | array | Response data |
Data.SystemTags | array | Response data |
Data.Sources | array | Response data |
Data.Severity | object | Response data |
Data.Severity.Value | string | Response data |
Data.Severity.Score | number | Response data |
Data.RelatedMalwares | array | Response data |
Data.RelatedThreatActors | array | Response data |
Data.RelatedHashes | object | Response data |
Data.RelatedHashes.downloaded | array | Response data |
Data.RelatedHashes.communicating | array | Response data |
Data.RelatedHashes.referencing | array | Response data |
Data.RelatedCampaigns | array | Response data |
Data.DnsRecords | array | Response data |
Data.DnsRecords.Value | string | Response data |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"OriginalValue":"securitywap.com","Status":"Done","Data":{"Value":"securitywap.com","Type":"Domains","IsKnownIoc":false,"Whitelisted":false,"Status":"Active","Tags":[],"SystemTags":[],"Sources":[],"Severity":{},"RelatedMalwares":[],"RelatedThreatActors":[],"RelatedHashes":{},"RelatedCampaigns":[],"DnsRecords":[],"Subdomains":[]}}}
Takedown Request
Initiate a takedown request for an alert using the specified alert_id in Rapid7 Insight Threat Command.
Endpoint
- URL: /public/v1/data/alerts/takedown-request/{{alert_id}}
- Method: PATCH
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.alert_id | string | Required | Parameters for the Takedown Request action |
Target | string | Optional | Parameter for Takedown Request |
ShouldCloseAlertAfterSuccess | boolean | Optional | Whether the operation was successful |
Input Example
{"json_body":{"Target":"Website","ShouldCloseAlertAfterSuccess":true}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
headers | object | HTTP headers for the request |
response | object | Output field: response |
Output Example
{"status_code":200,"reason":"Ok","headers":null,"response":{}}
Unassign Alert
Releases the assignment of a specified alert in Rapid7 Insight Threat Command using the alert's unique ID.
Endpoint
- URL: /public/v1/data/alerts/unassign-alert/{{id}}
- Method: PATCH
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Unassign Alert action |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
headers | object | HTTP headers for the request |
response | object | Output field: response |
Output Example
{"status_code":200,"reason":"Ok","headers":null,"response":{}}
Response Headers
Header | Description | Example |
|---|---|---|
access-control-expose-headers | HTTP response header: access-control-expose-headers | WWW-Authenticate,Server-Authorization |
Alt-Svc | HTTP response header: Alt-Svc | h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 |
cache-control | Directives for caching mechanisms | no-cache |
CF-Cache-Status | HTTP response header: CF-Cache-Status | DYNAMIC |
CF-RAY | HTTP response header: CF-RAY | 793c59d46a9500d7-GRU |
Connection | HTTP response header: Connection | keep-alive |
content-disposition | HTTP response header: content-disposition | filename="www-google-com.jpeg" |
content-encoding | HTTP response header: content-encoding | gzip |
Content-Length | The length of the response body in bytes | 14 |
content-security-policy | HTTP response header: content-security-policy | default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' data: fonts.gstatic.com *.hotjar.com *.hotjar.io;img-src 'self' data: blob: www.google-analytics.com *.pendo.io *.hotjar.com *.hotjar.io pendo-static-6269273820233728.storage.googleapis.com pendo-eu-static-6269273820233728.storage.googleapis.com res.cloudinary.com;object-src 'none';script-src 'self' 'unsafe-eval' 'sha256-+GHdaarOHaf9yPkoMBR7fz6Z0f3UO2oLnN/JrgPn1xc=' 'sha256-lKxiQ5tGr1Gqv3Bzy/pZuL0JOfMGwvEdeZwoZo9PQu0=' 'sha256-7fi6eVdHESL/8LS4hH5dfSlIzjmhO99EjDfcPR7iVVU=' 'sha256-LMpuTDITnWPMywmvAwVLZcCd11w34blWbEBvhhp8xo0=' 'sha256-d6uhP5HSE2IYiXQUeI4D/nRJDJ/P9FzfcU8mCImC7Vk=' 'sha256-9TTI1c5jN4zrUq7DBGweqLN2Xmlyqyf1jSHJCcbuBzI=' 'sha256-3/VkuILPEhxV7LhLtCV73w5Pw3gI3FB1A4+fDWLb1SI=' 'sha256-y/Mg5ZcRM9EjUeoI9nWz0ad809+Q9erxkHh8/s2uKEU=' 'sha256-0DadbYrbDiUeTjXoBWkNkhBf5ZdB0oJIN52KbeAgxoM=' www.recaptcha.net www.gstatic.com www.gstatic.cn www.google-analytics.com *.pendo.io pendo-io-static.storage.googleapis.com pendo-eu-static.storage.googleapis.com pendo-static-6269273820233728.storage.googleapis.com pendo-eu-static-6269273820233728.storage.googleapis.com *.hotjar.com *.hotjar.io;style-src 'self' 'unsafe-inline' fonts.googleapis.com *.pendo.io pendo-static-6269273820233728.storage.googleapis.com pendo-eu-static-6269273820233728.storage.googleapis.com https://cdn.rawgit.com/google/code-prettify/master/loader/prettify.css https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/prettify.css https://cdn.jsdelivr.net/npm/@mdi/font@latest/css/materialdesignicons.min.css;frame-src 'self' *.pendo.io *.hotjar.com *.hotjar.io www.recaptcha.net;frame-ancestors 'self' *.pendo.io;child-src 'self' *.pendo.io;connect-src 'self' blob: *.r7ops.com *.rapid7.com docs.google.com stats.g.doubleclick.net *.sentry.io *.hotjar.com .hotjar.io wss://.hotjar.com fonts.gstatic.com *.hotjar.com *.hotjar.io www.google-analytics.com *.pendo.io pendo-static-6269273820233728.storage.googleapis.com pendo-eu-static-6269273820233728.storage.googleapis.com res.cloudinary.com www.recaptcha.net www.gstatic.com www.gstatic.cn pendo-io-static.storage.googleapis.com pendo-eu-static.storage.googleapis.com fonts.googleapis.com https://cdn.rawgit.com/google/code-prettify/master/loader/prettify.css https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/prettify.css https://cdn.jsdelivr.net/npm/@mdi/font@latest/css/materialdesignicons.min.css |
Content-Type | The media type of the resource | application/json; charset=utf-8 |
Date | The date and time at which the message was originated | Fri, 03 Feb 2023 15:55:27 GMT |
etag | An identifier for a specific version of a resource | W/"5dc-5+LKMNDDY/a9YAKatE7GsuaVTtk" |
expect-ct | HTTP response header: expect-ct | max-age=0 |
expires | The date/time after which the response is considered stale | 0 |
local-address | HTTP response header: local-address | 190.195.70.130 |
pjsc-backend-id | HTTP response header: pjsc-backend-id | 1-727r |
pjsc-billing-bytes | HTTP response header: pjsc-billing-bytes | 252,335 |
pjsc-billing-credit-cost | HTTP response header: pjsc-billing-credit-cost | 0.000131835 |
pjsc-billing-daily-subscription-credits-remaining | HTTP response header: pjsc-billing-daily-subscription-credits-remaining | 0.047495298 |
pjsc-billing-elapsedms | HTTP response header: pjsc-billing-elapsedms | 1754 |
pjsc-billing-prepaid-credits-remaining | HTTP response header: pjsc-billing-prepaid-credits-remaining | 0.001 |
pjsc-billing-proxy-ingress-bytes | HTTP response header: pjsc-billing-proxy-ingress-bytes | 0 |
pjsc-billing-proxy-ingress-cost | HTTP response header: pjsc-billing-proxy-ingress-cost | 0 |
pjsc-billing-total-credits-remaining | HTTP response header: pjsc-billing-total-credits-remaining | 0.048495298 |
pjsc-content-done-detail | HTTP response header: pjsc-content-done-detail | {"reason":"match.doneWhen:{"event":"domReady"}","statusCode":200} |
pjsc-content-event-phase | HTTP response header: pjsc-content-event-phase | "load" |
pjsc-content-name | HTTP response header: pjsc-content-name | www-google-com.jpeg |
pjsc-content-page-exec-last-waited-on | HTTP response header: pjsc-content-page-exec-last-waited-on | waitInterval(1000) not yet met. still need to wait 43 |
pjsc-content-resource-aborted | HTTP response header: pjsc-content-resource-aborted | 0 |
pjsc-content-resource-active | HTTP response header: pjsc-content-resource-active | 0 |
pjsc-content-resource-complete | HTTP response header: pjsc-content-resource-complete | 13 |
pjsc-content-resource-failed | HTTP response header: pjsc-content-resource-failed | 0 |
pjsc-content-resource-late | HTTP response header: pjsc-content-resource-late | 0 |
pjsc-content-status-code | HTTP response header: pjsc-content-status-code | 200 |
pjsc-content-url | HTTP response header: pjsc-content-url | |
pragma | HTTP response header: pragma | no-cache |
referrer-policy | HTTP response header: referrer-policy | same-origin |
Server | Information about the software used by the origin server | cloudflare |
set-cookie | HTTP response header: set-cookie | env=production-apiExternal; Path=/; SameSite=Lax, dash_version=6.61.1; Path=/; SameSite=Lax |
strict-transport-security | HTTP response header: strict-transport-security | max-age=15724800; includeSubDomains |
surrogate-control | HTTP response header: surrogate-control | no-store |
Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked |
vary | HTTP response header: vary | origin,accept-encoding |
Via | HTTP response header: Via | 1.1 google |
x-content-type-options | HTTP response header: x-content-type-options | nosniff |
x-dns-prefetch-control | HTTP response header: x-dns-prefetch-control | off |
x-download-options | HTTP response header: x-download-options | noopen |
x-frame-options | HTTP response header: x-frame-options | SAMEORIGIN |
x-permitted-cross-domain-policies | HTTP response header: x-permitted-cross-domain-policies | none |
x-request-account-name | HTTP response header: x-request-account-name | Swimlane NFR |
x-request-route-param | HTTP response header: x-request-route-param | 621530e534928c87fd0a0469 |
x-request-route-path | HTTP response header: x-request-route-path | /public/v1/data/alerts/alerts-list |
x-username | HTTP response header: x-username | Swimlane NFR |
x-xss-protection | HTTP response header: x-xss-protection | 0 |