--- title: Rapid7 Insight Threat Command slug: connectors/rapid7-insight-threat-command docTags: createdAt: 2026-06-09T16:29:36.950Z --- The Rapid7 Insight Threat Command connector facilitates the integration of Rapid7's threat intelligence and alert management capabilities into the Swimlane Turbine platform. Rapid7 Insight Threat Command is a powerful threat intelligence and response management platform that enables security teams to identify, investigate, and take action on threats. This connector allows Swimlane Turbine users to automate the management of alerts, enrich indicators of compromise (IOCs), and initiate takedown requests directly within the Swimlane ecosystem. By integrating with Rapid7 Insight Threat Command, users can streamline their security operations, enhance their threat intelligence capabilities, and accelerate incident response times, all from within the familiar Swimlane interface. ## Limitations None to date. ## Prerequisites To effectively utilize the Rapid7 Insight Threat Command connector with Swimlane Turbine, ensure you have the following prerequisites: - HTTP Basic Authentication with the following parameters: - URL: The endpoint for the Rapid7 Insight Threat Command API. - Account ID: Your unique identifier for accessing your Rapid7 account. - API Key: A secure key generated within Rapid7 for authenticating API requests. ## Supported Versions This connector supports the latest version of the Rapid7 Insight Threat Command REST API. ## Additional Docs For more information, refer to the [Rapid7 API documentation](https://docs.rapid7.com/threat-command/). ## Configuration ### Authentication Methods ### Rapid7 HTTP Basic Authentication To authenticate with the Rapid7 Insight Threat Command API, you must use HTTP Basic Authentication. This method requires the following credentials: 1. **Username**: Your Rapid7 Insight Threat Command API username. 2. **Password**: Your corresponding password. These credentials are mandatory and must be provided to successfully connect to the API. Ensure that your username and password are kept secure and not shared with unauthorized individuals. ## Capabilities The Rapid7 Insight Threat Command integration provides the following capabilities: - Add Manual Alert - Assign Alert - Close Alert - Get Alert - Get Alert Activity Log - Get Alert CSV - Get Alert's HTML Content - Get Alert Image - Get Alert Report Status - Get Alert Takedown Status - Get Alert WHOIS File - Get Alerts - Get IOC by Value - Request IOC Enrichment - Takedown Request *... and so on* # Configurations ## Rapid7 HTTP Basic Authentication Authenticates using username and password. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------------------------------------------------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | username | Username | string | Required | | password | API Key. Do not provide it base64 encoded, it will be encoded automatically along with the username. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Add Manual Alert Adds a manual alert to Rapid7 Insight Threat Command and returns the new Alert ID, requiring a JSON body input. ### Endpoint - **URL:** `/public/v1/data/alerts/add-alert` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------------ | | `Images` | object | Optional | Parameter for Add Manual Alert | | `Images.files` | array | Optional | Parameter for Add Manual Alert | | `Images.files.file` | string | Optional | Parameter for Add Manual Alert | | `Images.files.file_name` | string | Optional | Name of the resource | | `FoundDate` | string | Optional | Date value | | `Details` | object | Optional | Parameter for Add Manual Alert | | `Details.Title` | string | Optional | Parameter for Add Manual Alert | | `Details.Description` | string | Optional | Parameter for Add Manual Alert | | `Details.Type` | string | Optional | Type of the resource | | `Details.SubType` | string | Optional | Type of the resource | | `Details.Severity` | string | Optional | Parameter for Add Manual Alert | | `Details.Source` | object | Optional | Parameter for Add Manual Alert | | `Details.Source.Type` | string | Optional | Type of the resource | | `Details.Source.NetworkType` | string | Optional | Type of the resource | | `Details.Source.URL` | string | Optional | URL endpoint for the request | | `Details.Source.Date` | object | Optional | Date value | ### Input Example `{"json_body":{"FoundDate":"2018-01-01","Details":{"Title":"API Title","Description":"API Description","Type":"ExploitableData","SubType":"VulnerabilityInTechnologyInUse","Severity":"High","Source":{"Type":"Application Store","NetworkType":"ClearWeb","URL":"http://www.blabla.com","Date":null}}}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"status_code":401,"response_headers":{"Date":"Fri, 03 Feb 2023 15:55:27 GMT","Content-Length":"14","Connection":"keep-alive","set-cookie":"env=production-apiExternal; Path=/; SameSite=Lax, dash_version=6.59.2; Path=/; S...","content-security-policy":"default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' data:...","x-dns-prefetch-control":"off","expect-ct":"max-age=0","x-frame-options":"SAMEORIGIN","strict-transport-security":"max-age=15724800; includeSubDomains","x-download...` ## Assign Alert Assign an alert to a specific assignee in Rapid7 Insight Threat Command by using the alert's ID and AssigneeID. ### Endpoint - **URL:** `/public/v1/data/alerts/assign-alert/{{id}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Assign Alert action | | `AssigneeID` | string | Optional | The ID of the assignee to assign the alert to | | `IsMssp` | boolean | Optional | Whether the assignee is an MSSP | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"AssigneeID":"string","IsMssp":true}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `headers` | object | HTTP headers for the request | | `response` | object | Output field: response | ### Output Example `{"status_code":200,"reason":"Ok","headers":null,"response":{}}` ## Close Alert Closes a specified alert in Rapid7 Insight Threat Command by providing the alert ID and a closure reason. ### Endpoint - **URL:** `/public/v1/data/alerts/close-alert/{{alert_id}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ------------------------------------- | | `path_parameters.alert_id` | string | Required | Parameters for the Close Alert action | | `Reason` | string | Optional | Response reason phrase | | `FreeText` | string | Optional | Parameter for Close Alert | | `IsHidden` | boolean | Optional | Unique identifier | | `Rate` | number | Optional | Parameter for Close Alert | ### Input Example `{"json_body":{"Reason":"FalsePositive","FreeText":"comments...","IsHidden":true,"Rate":5},"path_parameters":{"alert_id":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `headers` | object | HTTP headers for the request | | `response` | object | Output field: response | ### Output Example `{"status_code":200,"reason":"Ok","headers":null,"response":{}}` ## Get Alert Retrieves detailed information for a specific alert in Rapid7 Insight Threat Command using the alert's unique ID. ### Endpoint - **URL:** `/public/v1/data/alerts/get-complete-alert/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Alert action | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_id` | string | Unique identifier | | `FoundDate` | string | Date value | | `Details` | object | Output field: Details | | `Details.Title` | string | Output field: Details.Title | | `Details.Type` | string | Type of the resource | | `Details.SubType` | string | Type of the resource | | `Details.Severity` | string | Output field: Details.Severity | | `Details.Tags` | array | Output field: Details.Tags | | `Details.Tags.Name` | string | Name of the resource | | `Details.Tags.CreatedBy` | string | Output field: Details.Tags.CreatedBy | | `Details.Tags._id` | string | Unique identifier | | `Details.Source` | object | Output field: Details.Source | | `Details.Source.Type` | string | Type of the resource | | `Details.Source.NetworkType` | string | Type of the resource | | `Details.Source.URL` | string | URL endpoint for the request | | `Details.Source.Date` | string | Date value | | `Details.Images` | array | Output field: Details.Images | | `Details.Description` | string | Output field: Details.Description | | `Assignees` | array | Output field: Assignees | | `Assets` | array | Output field: Assets | | `Assets.Type` | string | Type of the resource | | `Assets.Value` | string | Value for the parameter | | `TakedownStatus` | string | Status value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 27 Mar 2023 21:50:27 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","set-cookie":"env=production-apiExternal; Path=/; SameSite=Lax, dash_version=6.61.1; Path=/; S...","content-security-policy":"default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' data:...","x-dns-prefetch-control":"off","expect-ct":"max-age=0","x-frame-options":"SAMEORIGIN","strict-transport-se...` ## Get Alert Activity Log Retrieve the activity log for a specific alert in Rapid7 Insight Threat Command using the alert's unique identifier. ### Endpoint - **URL:** `/public/v1/data/alerts/activity-log/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------ | | `path_parameters.id` | string | Required | Parameters for the Get Alert Activity Log action | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------------------- | -------- | ------------------------------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `headers` | object | HTTP headers for the request | | `response` | array | Output field: response | | `response.Type` | string | Type of the resource | | `response.Initiator` | string | Output field: response.Initiator | | `response.CreatedDate` | string | Date value | | `response.UpdateDate` | string | Date value | | `response._id` | string | Unique identifier | | `response.AdditionalInformation` | object | Output field: response.AdditionalInformation | | `response.AdditionalInformation.RemediationBlocklistUpdate` | array | Date value | | `response.AdditionalInformation.AskTheAnalyst` | object | Output field: response.AdditionalInformation.AskTheAnalyst | | `response.AdditionalInformation.AskTheAnalyst.Replies` | array | Output field: response.AdditionalInformation.AskTheAnalyst.Replies | | `response.AdditionalInformation.Mail` | object | Output field: response.AdditionalInformation.Mail | | `response.AdditionalInformation.Mail.Replies` | array | Output field: response.AdditionalInformation.Mail.Replies | | `response.ReadBy` | array | Output field: response.ReadBy | | `response.SubTypes` | array | Type of the resource | ### Output Example `{"status_code":200,"reason":"Ok","headers":null,"response":[{"Type":"AlertRead","Initiator":"5b1641983a21b34c6d6e6197","CreatedDate":"2018-01-01T13:09:39.305Z","UpdateDate":"2018-01-01T13:09:39.305Z","_id":"5b1641a53a21b34c6d6e6198","AdditionalInformation":{},"ReadBy":[],"SubTypes":[]}]}` ## Get Alert CSV Retrieve a detailed CSV file for an alert from Rapid7 Insight Threat Command using the provided alert ID. ### Endpoint - **URL:** `/public/v1/data/alerts/csv-file/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Alert CSV action | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file` | object | File | | `file.file_name` | string | Name of the resource | | `file.file` | string | Output field: file.file | ### Output Example `{"status_code":200,"response_headers":{"pjsc-billing-credit-cost":"0.000131835","pjsc-billing-elapsedms":"1754","pjsc-billing-bytes":"252,335","pjsc-billing-proxy-ingress-bytes":"0","pjsc-billing-proxy-ingress-cost":"0","pjsc-billing-total-credits-remaining":"0.048495298","pjsc-billing-daily-subscription-credits-remaining":"0.047495298","pjsc-billing-prepaid-credits-remaining":"0.001","local-address":"190.195.70.130","pjsc-backend-id":"1-727r","pjsc-content-status-code":"200","pjsc-content-name"...` ## Get Alert's HTML Content Retrieve the HTML content of an alert using its unique identifier from Rapid7 Insight Threat Command. ### Endpoint - **URL:** `/public/v1/data/alerts/website-html/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Alert's HTML Content action | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `headers` | object | HTTP headers for the request | | `response` | object | Output field: response | | `response.WebsiteText` | string | Output field: response.WebsiteText | | `response.WebsiteHtml` | string | Output field: response.WebsiteHtml | ### Output Example `{"status_code":200,"reason":"Ok","headers":null,"response":{"WebsiteText":"website text","WebsiteHtml":"website html"}}` ## Get Alert Image Retrieves the image for a specific alert from Rapid7 Insight Threat Command using the provided unique alert ID. ### Endpoint - **URL:** `/public/v1/data/alerts/alert-image/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Alert Image action | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file` | object | File | | `file.file_name` | string | Name of the resource | | `file.file` | string | Output field: file.file | ### Output Example `{"status_code":200,"response_headers":{"pjsc-billing-credit-cost":"0.000131835","pjsc-billing-elapsedms":"1754","pjsc-billing-bytes":"252,335","pjsc-billing-proxy-ingress-bytes":"0","pjsc-billing-proxy-ingress-cost":"0","pjsc-billing-total-credits-remaining":"0.048495298","pjsc-billing-daily-subscription-credits-remaining":"0.047495298","pjsc-billing-prepaid-credits-remaining":"0.001","local-address":"190.195.70.130","pjsc-backend-id":"1-727r","pjsc-content-status-code":"200","pjsc-content-name"...` ## Get Alert Report Status Retrieve the current status of a specific alert report in Rapid7 Insight Threat Command using the alert's unique ID. ### Endpoint - **URL:** `/public/v1/data/alerts/report-status/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Alert Report Status action | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `headers` | object | HTTP headers for the request | | `response` | array | Output field: response | | `response.Value` | string | Value for the parameter | | `response.GoogleWebRisk` | object | Output field: response.GoogleWebRisk | | `response.GoogleWebRisk.Status` | string | Status value | | `response.PhishTank` | object | Output field: response.PhishTank | | `response.PhishTank.Status` | string | Status value | ### Output Example `{"status_code":200,"reason":"Ok","headers":null,"response":[{"Value":"example.org","GoogleWebRisk":{},"PhishTank":{}}]}` ## Get Alert Takedown Status Retrieve the takedown status of an alert by its unique identifier in Rapid7 Insight Threat Command. ### Endpoint - **URL:** `/public/v1/data/alerts/takedown-status/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Alert Takedown Status action | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `headers` | object | HTTP headers for the request | | `response` | string | Output field: response | ### Output Example `{"status_code":200,"reason":"Ok","headers":null,"response":"Requested"}` ## Get Alert WHOIS File Retrieve the WHOIS text file for a specific phishing alert in Rapid7 Insight Threat Command using the alert's unique ID. ### Endpoint - **URL:** `/public/v1/data/alerts/whois-file/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ---------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Alert WHOIS File action | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file` | object | File | | `file.file_name` | string | Name of the resource | | `file.file` | string | Output field: file.file | ### Output Example `{"status_code":200,"response_headers":{"pjsc-billing-credit-cost":"0.000131835","pjsc-billing-elapsedms":"1754","pjsc-billing-bytes":"252,335","pjsc-billing-proxy-ingress-bytes":"0","pjsc-billing-proxy-ingress-cost":"0","pjsc-billing-total-credits-remaining":"0.048495298","pjsc-billing-daily-subscription-credits-remaining":"0.047495298","pjsc-billing-prepaid-credits-remaining":"0.001","local-address":"190.195.70.130","pjsc-backend-id":"1-727r","pjsc-content-status-code":"200","pjsc-content-name"...` ## Get Alerts Retrieves all alerts from Rapid7 Insight Threat Command, offering a detailed perspective on potential security threats. ### Endpoint - **URL:** `/public/v1/data/alerts/alerts-list` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ------------------------------------ | | `parameters.alert_type` | array | Optional | Parameters for the Get Alerts action | | `parameters.assigned` | string | Optional | Parameters for the Get Alerts action | | `parameters.found_date_from` | number | Optional | Parameters for the Get Alerts action | | `parameters.found_date_to` | number | Optional | Parameters for the Get Alerts action | | `parameters.has_indicators` | boolean | Optional | Parameters for the Get Alerts action | | `parameters.is_closed` | string | Optional | Parameters for the Get Alerts action | | `parameters.is_flagged` | string | Optional | Parameters for the Get Alerts action | | `parameters.matched_asset_value` | array | Optional | Parameters for the Get Alerts action | | `parameters.network_type` | array | Optional | Parameters for the Get Alerts action | | `parameters.remediation_status` | array | Optional | Parameters for the Get Alerts action | | `parameters.severity` | array | Optional | Parameters for the Get Alerts action | | `parameters.source_date_from` | number | Optional | Parameters for the Get Alerts action | | `parameters.source_date_to` | number | Optional | Parameters for the Get Alerts action | | `parameters.source_type` | array | Optional | Parameters for the Get Alerts action | ### Input Example `{"parameters":{"alert_type":["Phishing"],"assigned":"Assigned","found_date_from":0,"found_date_to":1633047102456,"has_indicators":false,"is_closed":"Closed","is_flagged":"Flagged","matched_asset_value":["example.com"],"network_type":["DarkWeb"],"remediation_status":["InProgress","Pending"],"severity":["Low"],"source_date_from":1633047083142,"source_date_to":1633047102456,"source_type":["Application Store"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 27 Mar 2023 21:42:26 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","set-cookie":"env=production-apiExternal; Path=/; SameSite=Lax, dash_version=6.61.1; Path=/; S...","content-security-policy":"default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' data:...","x-dns-prefetch-control":"off","expect-ct":"max-age=0","x-frame-options":"SAMEORIGIN","strict-transport-se...` ## Get IOC by Value Retrieve details for a specific Indicator of Compromise (IOC) by its value in Rapid7 Insight Threat Command, with the required iocValue parameter. ### Endpoint - **URL:** `/public/v3/iocs/ioc-by-value` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | --------------- | | `parameters.iocValue` | string | Required | IOC value. | ### Input Example `{"parameters":{"iocValue":"google.com"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | --------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | string | Value for the parameter | | `type` | string | Type of the resource | | `severity` | string | Output field: severity | | `status` | string | Status value | | `score` | number | Score value | | `Whitelisted` | string | Output field: Whitelisted | | `firstSeen` | string | Output field: firstSeen | | `lastSeen` | string | Output field: lastSeen | | `LastUpdate` | string | Date value | | `Geolocation` | string | Output field: Geolocation | | `reportedFeeds` | array | Output field: reportedFeeds | | `reportedFeeds.id` | string | Unique identifier | | `reportedFeeds.name` | string | Name of the resource | | `reportedFeeds.confidenceLevel` | number | Unique identifier | | `tags` | array | Output field: tags | | `relatedMalwares` | array | Output field: relatedMalwares | | `relatedCampaigns` | array | Output field: relatedCampaigns | | `relatedThreatActors` | array | Output field: relatedThreatActors | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"value":"example.com","type":"Domains","severity":"High","status":"Active","score":100,"Whitelisted":"false","firstSeen":"2020-01-01T20:01:27.344Z","lastSeen":"2020-01-30T16:18:51.148Z","LastUpdate":"2020-02-21T23:00:51.268Z","Geolocation":"US","reportedFeeds":[{}],"tags":["MyTag_1"],"relatedMalwares":["doppeldridex","dridex"],"relatedCampaigns":["SolarWinds"],"relatedThreatActors":["doppelspider"]}}` ## Request IOC Enrichment Retrieve comprehensive enrichment data for a specified Indicator of Compromise (IOC) from Rapid7 Insight Threat Command. ### Endpoint - **URL:** `/public/v1/iocs/enrich/{{iocValue}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.iocValue` | string | Required | IOC value. Supported IOC types- Domains, URLs, IP addresses, and File hashes. Any other type will cause a response with "Status"- Failed. | ### Input Example `{"path_parameters":{"iocValue":"google.com"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `OriginalValue` | string | Value for the parameter | | `Status` | string | Status value | | `Data` | object | Response data | | `Data.Value` | string | Response data | | `Data.Type` | string | Response data | | `Data.IsKnownIoc` | boolean | Response data | | `Data.Whitelisted` | boolean | Response data | | `Data.Status` | string | Response data | | `Data.Tags` | array | Response data | | `Data.SystemTags` | array | Response data | | `Data.Sources` | array | Response data | | `Data.Severity` | object | Response data | | `Data.Severity.Value` | string | Response data | | `Data.Severity.Score` | number | Response data | | `Data.RelatedMalwares` | array | Response data | | `Data.RelatedThreatActors` | array | Response data | | `Data.RelatedHashes` | object | Response data | | `Data.RelatedHashes.downloaded` | array | Response data | | `Data.RelatedHashes.communicating` | array | Response data | | `Data.RelatedHashes.referencing` | array | Response data | | `Data.RelatedCampaigns` | array | Response data | | `Data.DnsRecords` | array | Response data | | `Data.DnsRecords.Value` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"OriginalValue":"securitywap.com","Status":"Done","Data":{"Value":"securitywap.com","Type":"Domains","IsKnownIoc":false,"Whitelisted":false,"Status":"Active","Tags":[],"SystemTags":[],"Sources":[],"Severity":{},"RelatedMalwares":[],"RelatedThreatActors":[],"RelatedHashes":{},"RelatedCampaigns":[],"DnsRecords":[],"Subdomains":[]}}}` ## Takedown Request Initiate a takedown request for an alert using the specified alert\_id in Rapid7 Insight Threat Command. ### Endpoint - **URL:** `/public/v1/data/alerts/takedown-request/{{alert_id}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | ------------------------------------------ | | `path_parameters.alert_id` | string | Required | Parameters for the Takedown Request action | | `Target` | string | Optional | Parameter for Takedown Request | | `ShouldCloseAlertAfterSuccess` | boolean | Optional | Whether the operation was successful | ### Input Example `{"json_body":{"Target":"Website","ShouldCloseAlertAfterSuccess":true}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `headers` | object | HTTP headers for the request | | `response` | object | Output field: response | ### Output Example `{"status_code":200,"reason":"Ok","headers":null,"response":{}}` ## Unassign Alert Releases the assignment of a specified alert in Rapid7 Insight Threat Command using the alert's unique ID. ### Endpoint - **URL:** `/public/v1/data/alerts/unassign-alert/{{id}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ---------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Unassign Alert action | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `headers` | object | HTTP headers for the request | | `response` | object | Output field: response | ### Output Example `{"status_code":200,"reason":"Ok","headers":null,"response":{}}` # Response Headers | **Header** | **Description** | **Example** | | ------------------------------------------------- | ----------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | access-control-expose-headers | HTTP response header: access-control-expose-headers | WWW-Authenticate,Server-Authorization | | Alt-Svc | HTTP response header: Alt-Svc | h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 | | cache-control | Directives for caching mechanisms | no-cache | | CF-Cache-Status | HTTP response header: CF-Cache-Status | DYNAMIC | | CF-RAY | HTTP response header: CF-RAY | 793c59d46a9500d7-GRU | | Connection | HTTP response header: Connection | keep-alive | | content-disposition | HTTP response header: content-disposition | filename="www-google-com.jpeg" | | content-encoding | HTTP response header: content-encoding | gzip | | Content-Length | The length of the response body in bytes | 14 | | content-security-policy | HTTP response header: content-security-policy | default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' data: fonts.gstatic.com \*.hotjar.com \*.hotjar.io;img-src 'self' data: blob: [www.google-analytics.com](http://www.google-analytics.com) \*.pendo.io \*.hotjar.com \*.hotjar.io pendo-static-6269273820233728.storage.googleapis.com pendo-eu-static-6269273820233728.storage.googleapis.com res.cloudinary.com;object-src 'none';script-src 'self' 'unsafe-eval' 'sha256-+GHdaarOHaf9yPkoMBR7fz6Z0f3UO2oLnN/JrgPn1xc=' 'sha256-lKxiQ5tGr1Gqv3Bzy/pZuL0JOfMGwvEdeZwoZo9PQu0=' 'sha256-7fi6eVdHESL/8LS4hH5dfSlIzjmhO99EjDfcPR7iVVU=' 'sha256-LMpuTDITnWPMywmvAwVLZcCd11w34blWbEBvhhp8xo0=' 'sha256-d6uhP5HSE2IYiXQUeI4D/nRJDJ/P9FzfcU8mCImC7Vk=' 'sha256-9TTI1c5jN4zrUq7DBGweqLN2Xmlyqyf1jSHJCcbuBzI=' 'sha256-3/VkuILPEhxV7LhLtCV73w5Pw3gI3FB1A4+fDWLb1SI=' 'sha256-y/Mg5ZcRM9EjUeoI9nWz0ad809+Q9erxkHh8/s2uKEU=' 'sha256-0DadbYrbDiUeTjXoBWkNkhBf5ZdB0oJIN52KbeAgxoM=' [www.recaptcha.net](http://www.recaptcha.net) [www.gstatic.com](http://www.gstatic.com) [www.gstatic.cn](http://www.gstatic.cn) [www.google-analytics.com](http://www.google-analytics.com) \*.pendo.io pendo-io-static.storage.googleapis.com pendo-eu-static.storage.googleapis.com pendo-static-6269273820233728.storage.googleapis.com pendo-eu-static-6269273820233728.storage.googleapis.com \*.hotjar.com \*.hotjar.io;style-src 'self' 'unsafe-inline' fonts.googleapis.com \*.pendo.io pendo-static-6269273820233728.storage.googleapis.com pendo-eu-static-6269273820233728.storage.googleapis.com [https://cdn.rawgit.com/google/code-prettify/master/loader/prettify.css](https://cdn.rawgit.com/google/code-prettify/master/loader/prettify.css) [https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/prettify.css](https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/prettify.css) [https://cdn.jsdelivr.net/npm/@mdi/font@latest/css/materialdesignicons.min.css;frame-src](https://cdn.jsdelivr.net/npm/@mdi/font@latest/css/materialdesignicons.min.css;frame-src) 'self' \*.pendo.io \*.hotjar.com \*.hotjar.io [www.recaptcha.net;frame-ancestors](http://www.recaptcha.net;frame-ancestors) 'self' \*.pendo.io;child-src 'self' \*.pendo.io;connect-src 'self' blob: \*.r7ops.com \*.rapid7.com docs.google.com stats.g.doubleclick.net \*.sentry.io \*.hotjar.com *.hotjar.io wss\://*.hotjar.com fonts.gstatic.com \*.hotjar.com \*.hotjar.io [www.google-analytics.com](http://www.google-analytics.com) \*.pendo.io pendo-static-6269273820233728.storage.googleapis.com pendo-eu-static-6269273820233728.storage.googleapis.com res.cloudinary.com [www.recaptcha.net](http://www.recaptcha.net) [www.gstatic.com](http://www.gstatic.com) [www.gstatic.cn](http://www.gstatic.cn) pendo-io-static.storage.googleapis.com pendo-eu-static.storage.googleapis.com fonts.googleapis.com [https://cdn.rawgit.com/google/code-prettify/master/loader/prettify.css](https://cdn.rawgit.com/google/code-prettify/master/loader/prettify.css) [https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/prettify.css](https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/prettify.css) [https://cdn.jsdelivr.net/npm/@mdi/font@latest/css/materialdesignicons.min.css](https://cdn.jsdelivr.net/npm/@mdi/font@latest/css/materialdesignicons.min.css) | | Content-Type | The media type of the resource | application/json; charset=utf-8 | | Date | The date and time at which the message was originated | Fri, 03 Feb 2023 15:55:27 GMT | | etag | An identifier for a specific version of a resource | W/"5dc-5+LKMNDDY/a9YAKatE7GsuaVTtk" | | expect-ct | HTTP response header: expect-ct | max-age=0 | | expires | The date/time after which the response is considered stale | 0 | | local-address | HTTP response header: local-address | 190.195.70.130 | | pjsc-backend-id | HTTP response header: pjsc-backend-id | 1-727r | | pjsc-billing-bytes | HTTP response header: pjsc-billing-bytes | 252,335 | | pjsc-billing-credit-cost | HTTP response header: pjsc-billing-credit-cost | 0.000131835 | | pjsc-billing-daily-subscription-credits-remaining | HTTP response header: pjsc-billing-daily-subscription-credits-remaining | 0.047495298 | | pjsc-billing-elapsedms | HTTP response header: pjsc-billing-elapsedms | 1754 | | pjsc-billing-prepaid-credits-remaining | HTTP response header: pjsc-billing-prepaid-credits-remaining | 0.001 | | pjsc-billing-proxy-ingress-bytes | HTTP response header: pjsc-billing-proxy-ingress-bytes | 0 | | pjsc-billing-proxy-ingress-cost | HTTP response header: pjsc-billing-proxy-ingress-cost | 0 | | pjsc-billing-total-credits-remaining | HTTP response header: pjsc-billing-total-credits-remaining | 0.048495298 | | pjsc-content-done-detail | HTTP response header: pjsc-content-done-detail | \{"reason":"match.doneWhen:\{"event":"domReady"}","statusCode":200} | | pjsc-content-event-phase | HTTP response header: pjsc-content-event-phase | "load" | | pjsc-content-name | HTTP response header: pjsc-content-name | www-google-com.jpeg | | pjsc-content-page-exec-last-waited-on | HTTP response header: pjsc-content-page-exec-last-waited-on | waitInterval(1000) not yet met. still need to wait 43 | | pjsc-content-resource-aborted | HTTP response header: pjsc-content-resource-aborted | 0 | | pjsc-content-resource-active | HTTP response header: pjsc-content-resource-active | 0 | | pjsc-content-resource-complete | HTTP response header: pjsc-content-resource-complete | 13 | | pjsc-content-resource-failed | HTTP response header: pjsc-content-resource-failed | 0 | | pjsc-content-resource-late | HTTP response header: pjsc-content-resource-late | 0 | | pjsc-content-status-code | HTTP response header: pjsc-content-status-code | 200 | | pjsc-content-url | HTTP response header: pjsc-content-url | [http://www.google.com/](http://www.google.com/) | | pragma | HTTP response header: pragma | no-cache | | referrer-policy | HTTP response header: referrer-policy | same-origin | | Server | Information about the software used by the origin server | cloudflare | | set-cookie | HTTP response header: set-cookie | env=production-apiExternal; Path=/; SameSite=Lax, dash\_version=6.61.1; Path=/; SameSite=Lax | | strict-transport-security | HTTP response header: strict-transport-security | max-age=15724800; includeSubDomains | | surrogate-control | HTTP response header: surrogate-control | no-store | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | vary | HTTP response header: vary | origin,accept-encoding | | Via | HTTP response header: Via | 1.1 google | | x-content-type-options | HTTP response header: x-content-type-options | nosniff | | x-dns-prefetch-control | HTTP response header: x-dns-prefetch-control | off | | x-download-options | HTTP response header: x-download-options | noopen | | x-frame-options | HTTP response header: x-frame-options | SAMEORIGIN | | x-permitted-cross-domain-policies | HTTP response header: x-permitted-cross-domain-policies | none | | x-request-account-name | HTTP response header: x-request-account-name | Swimlane NFR | | x-request-route-param | HTTP response header: x-request-route-param | 621530e534928c87fd0a0469 | | x-request-route-path | HTTP response header: x-request-route-path | /public/v1/data/alerts/alerts-list | | x-username | HTTP response header: x-username | Swimlane NFR | | x-xss-protection | HTTP response header: x-xss-protection | 0 |