Rapid7 Insightidr

Rapid7 InsightIDR is a SIEM solution that helps organizations detect, investigate, and respond to security threats.

Rapid7 InsightIDR is a comprehensive security information and event management (SIEM) solution that provides advanced threat detection and response capabilities. This connector allows Swimlane Turbine users to seamlessly integrate with InsightIDR, enabling automated security operations such as threat indicator management, investigation handling, and log querying. By leveraging this integration, users can enhance their security posture with real-time insights and automated responses, reducing manual effort and accelerating incident resolution.

Prerequisites

Before you can use the Rapid7 InsightIDR connector for Turbine, you'll need access to the Rapid7 InsightIDR API. This requires the following:

an API key authentication using the following parameters:

URL: The endpoint URL for accessing the Rapid7 InsightIDR API.

API Key: A unique key provided by Rapid7 for authenticating API requests.

Capabilities

This connector provides the following capabilities:

Create Custom Threat

Create a Saved Query

Delete a Saved Query

Get Investigation Alerts

Get Queries

List All Saved Queries

Manage Investigations

Manage Threats

Retrieve Evidence for Alert

Retrieve Logs

Retrieve a Single Alert

Retrieve Multiple Alerts

Run Saved Query

SOC - InsightIDR to Turbine Schema

Asset Setup

Fill in the region parameter with the data center used for your account. To find the data center, log in to your insightIDR account, then look at the URL of the home page. The URL should look similar to this:

http://REGION.idr.insight.rapid7.com

REGION indicates your data center. Enter that as the value in the region parameter.

Actions Setup

You need a threat key in order to use actions that manage threats. If you do not have a threat to use, follow the instructions here to create a new threat.

For actions that take datetime inputs, you can use any standard datetime format, or put in a relative time.

Relative time format:

-1 months

+3 days

-123 seconds

Notes for Get a Saved Query

The following outputs should be a list type:

Logs

Time Range

Groups

Group Time Series

Others

Stats

Notes

All API documentation

documentation for new API

https://[region].api.insight.rapid7.com/idr/v2/investigations

Additional Documentation

Rapid7 Insightidr Connector Documentation

Rapid7 Insightidr API Documentation

Rapid7 Insightidr Authentication Guide

Configurations

API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
X-Api-Key	API key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Add Indicators to Threat

Add indicators to an existing threat in Rapid7 InsightIDR using a specific threat key and indicator format.

Endpoint

URL: customthreats/key/{{key}}/indicators/add

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.key	string	Required	Parameters for the Add Indicators to Threat action
parameters.format	string	Required	Parameters for the Add Indicators to Threat action
ips	array	Optional	Parameter for Add Indicators to Threat
hashes	array	Optional	Parameter for Add Indicators to Threat
domain_names	array	Optional	Name of the resource
urls	array	Optional	URL endpoint for the request

Input Example

{"parameters":{"format":"json"},"json_body":{"ips":["123.123.123.123"],"hashes":["b95663ec7339033cf1fde459a34b6606"],"domain_names":["rapid.com"],"urls":["https://myuniqueexample.com/endpoint","https://google.com"]},"path_parameters":{"key":"156c9e48-64da-4bba-939e-e1c329be591b"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
rejected_indicators	array	Output field: rejected_indicators
threat	object	Output field: threat
threat.indicator_count	number	Count value
threat.name	string	Name of the resource
threat.note	string	Output field: threat.note
threat.published	boolean	Output field: threat.published

Output Example

{"status_code":404,"response_headers":{"Date":"Thu, 15 Dec 2022 18:14:08 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"127","Connection":"keep-alive"},"reason":"Not Found","json_body":{"rejected_indicators":["blacklisted","invalid"],"threat":{"indicator_count":1,"name":"Threat","note":"Notes","published":true}}}

Assign User to Investigation

Assign a user to an existing investigation in Rapid7 InsightIDR by specifying the investigation ID and user's email address.

Endpoint

URL: /idr/v2/investigations/{{id}}/assignee

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Assign User to Investigation action
parameters.multi-customer	boolean	Optional	Indicates whether the requester has multi-customer access.
user_email_address	string	Optional	Parameter for Assign User to Investigation

Input Example

{"parameters":{"multi-customer":false},"json_body":{"user_email_address":"[email protected]"},"path_parameters":{"id":"723dc6a0-ae08-4404-986c-36310f15b679"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
rrn	string	Output field: rrn
organization_id	string	Unique identifier
title	string	Output field: title
source	string	Output field: source
status	string	Status value
priority	string	Output field: priority
last_accessed	string	Output field: last_accessed
created_time	string	Time value
disposition	string	Output field: disposition
assignee	object	Output field: assignee
assignee.name	string	Name of the resource
assignee.email	string	Output field: assignee.email
first_alert_time	string	Time value
latest_alert_time	string	Time value
responsibility	string	Output field: responsibility

Output Example

{"rrn":"string","organization_id":"string","title":"string","source":"string","status":"active","priority":"string","last_accessed":"string","created_time":"string","disposition":"string","assignee":{"name":"Example Name","email":"[email protected]"},"first_alert_time":"string","latest_alert_time":"string","responsibility":"string"}

Bulk Close Investigations

Close multiple investigations in Rapid7 InsightIDR for a specified date range using 'from', 'to', and 'source' parameters.

Endpoint

URL: idr/v1/investigations/bulk_close

Method: POST

Input

Argument Name	Type	Required	Description
source	string	Optional	Parameter for Bulk Close Investigations
alert_type	string	Optional	Type of the resource
from	string	Optional	Parameter for Bulk Close Investigations
to	string	Optional	Parameter for Bulk Close Investigations
max_investigations_to_close	string	Optional	Parameter for Bulk Close Investigations
verbose_errors	string	Optional	Error message if any

Input Example

{"json_body":{"source":"ALERT","alert_type":"Lateral Movement - Service Account","from":"2022-01-10T00:00:00Z","to":"2023-04-21T00:00:00Z","max_investigations_to_close":"1","verbose_errors":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
ids	array	Unique identifier
ids.file_name	string	Unique identifier
ids.file	string	Unique identifier
num_closed	number	Output field: num_closed

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 15 Dec 2022 19:58:04 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Expires":"0","Pragma":"no-cache","X-Content-Type-Options":"nosniff","X-Frame-Options":"DENY","X-XSS-Protection":"1; mode=block","vary":"Origin","Access-Control-Allow-Credentials":"true"},"reason":"OK","json_body":{"ids":[],"num_closed":0}}

Create a Saved Query

Initiate the creation of a saved query in Rapid7 InsightIDR using the specified 'saved_query' JSON body.

Endpoint

URL: /log_search/query/saved_queries

Method: POST

Input

Argument Name	Type	Required	Description
saved_query	object	Optional	Parameter for Create a Saved Query
saved_query.name	string	Required	The name for the Saved Query.
saved_query.leql	object	Required	Parameter for Create a Saved Query
saved_query.leql.during	object	Optional	Parameter for Create a Saved Query
saved_query.leql.during.from	number	Optional	The start of the time range for the query, as a UNIX timestamp in milliseconds.
saved_query.leql.during.to	number	Optional	The end of the time range for the query, as a UNIX timestamp in milliseconds.
saved_query.leql.during.time_range	string	Optional	Relative time range (instead of absolute from + to time range). Possible values are "yesterday", "today" and "last x timeunits" where x is the number of time unit back from the current server time. Supported time units (case insensitive) are min(s) or minute(s), hr(s) or hour(s), day(s), week(s), month(s) and year(s).
saved_query.leql.statement	string	Required	The LEQL query run against the log(s). If empty, the query retrieves all log entries in the specified time range.
saved_query.logs	array	Optional	The log keys of the logs which the query is run against.

Input Example

{"json_body":{"saved_query":{"name":"saved-query-2","leql":{"statement":"where(test)"}}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
saved_query	object	Output field: saved_query
saved_query.id	string	Unique identifier
saved_query.name	string	Name of the resource
saved_query.leql	object	Output field: saved_query.leql
saved_query.leql.statement	string	Output field: saved_query.leql.statement
saved_query.leql.during	object	Output field: saved_query.leql.during
saved_query.leql.during.time_range	object	Output field: saved_query.leql.during.time_range
saved_query.leql.during.to	object	Output field: saved_query.leql.during.to
saved_query.leql.during.from	object	Output field: saved_query.leql.during.from
saved_query.logs	array	Output field: saved_query.logs

Output Example

{"status_code":201,"response_headers":{"Date":"Fri, 21 Jun 2024 09:18:35 GMT","Content-Type":"application/json","Content-Length":"180","Connection":"keep-alive","Vary":"Origin, Accept-Encoding, Origin","Location":"https://us3.api.insight.rapid7.com/log_search/query/saved_queries/00000000-0000-...","Strict-Transport-Security":"max-age=31536000; includeSubDomains","R7-Correlation-Id":"3f4f3a96-4af9-4229-9303-30dd632beb93","Access-Control-Allow-Credentials":"true","Access-Control-Expose-Headers":"R...

Create Custom Threat

Generate a custom threat in Rapid7 InsightIDR with specific details, notes, and indicators like IPs, hashes, domains, and URLs.

Endpoint

URL: idr/v1/customthreats

Method: POST

Input

Argument Name	Type	Required	Description
threat	string	Optional	Parameter for Create Custom Threat
note	string	Optional	Parameter for Create Custom Threat
indicators	object	Optional	Parameter for Create Custom Threat
indicators.ips	array	Required	Parameter for Create Custom Threat
indicators.hashes	array	Required	Parameter for Create Custom Threat
indicators.domain_names	array	Required	Name of the resource
indicators.urls	array	Required	URL endpoint for the request

Input Example

{"json_body":{"threat":"threatName","note":"notetext","indicators":{"ips":["192.108.0.1"],"hashes":["b95663ec7339033cf1fde459a34b6606"],"domain_names":["mailxpy.com"],"urls":[" http://www.mailxpy.com/login/index.php"]}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
message	string	Response message
correlation_id	string	Unique identifier

Output Example

{"status_code":500,"response_headers":{"Date":"Mon, 12 Dec 2022 21:35:58 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Expires":"0","Pragma":"no-cache","X-Content-Type-Options":"nosniff","X-Frame-Options":"DENY","X-XSS-Protection":"1; mode=block","vary":"Origin","Access-Control-Allow-Credentials":"true"},"reason":"Server Error","json_body":{"message":"A server error occurred","corre...

Delete a Saved Query

Remove a specific saved query from Rapid7 InsightIDR using the unique saved_query_id.

Endpoint

URL: /log_search/query/saved_queries/{{saved_query_id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.saved_query_id	string	Required	The ID of the saved query.

Input Example

{"path_parameters":{"saved_query_id":"00000000-0000-1616-0000-000000000000"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"status_code":204,"response_headers":{"Date":"Fri, 21 Jun 2024 09:07:47 GMT","Connection":"keep-alive","Vary":"Origin, Origin","Strict-Transport-Security":"max-age=31536000; includeSubDomains","R7-Correlation-Id":"5d143985-8028-4204-a2f9-f18e1848b30b","Access-Control-Allow-Credentials":"true","Access-Control-Expose-Headers":"R7-Correlation-Id","RateLimit-Limit":"1500","RateLimit-Reset":"445","RateLimit-Remaining":"1497","X-RateLimit-Limit":"1500","X-RateLimit-Reset":"445","X-RateLimit-Remaining...

Get a Saved Query

Execute a saved query in Rapid7 InsightIDR using the specified query ID and return the results.

Endpoint

URL: log_search/query/saved_queries/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Get a Saved Query action

Input Example

{"path_parameters":{"id":"00000000-0000-0838-0000-000000000000"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
saved_query	object	Output field: saved_query
saved_query.id	string	Unique identifier
saved_query.name	string	Name of the resource
saved_query.leql	object	Output field: saved_query.leql
saved_query.leql.statement	string	Output field: saved_query.leql.statement
saved_query.leql.during	object	Output field: saved_query.leql.during
saved_query.leql.during.time_range	object	Output field: saved_query.leql.during.time_range
saved_query.leql.during.to	object	Output field: saved_query.leql.during.to
saved_query.leql.during.from	object	Output field: saved_query.leql.during.from
saved_query.logs	array	Output field: saved_query.logs

Output Example

{"status_code":200,"response_headers":{"Date":"Wed, 14 Dec 2022 15:11:13 GMT","Content-Type":"application/json","Content-Length":"228","Connection":"keep-alive","R7-Correlation-Id":"8dd3331b-9c80-406d-acc4-81b9a3d6aa94","Vary":"Accept-Encoding, Origin","Content-Encoding":"gzip","Access-Control-Allow-Credentials":"true","RateLimit-Limit":"1500","RateLimit-Reset":"900","RateLimit-Remaining":"1499","X-RateLimit-Limit":"1500","X-RateLimit-Reset":"900","X-RateLimit-Remaining":"1499"},"reason":"OK","j...

Get Investigation Alerts

Retrieve alerts associated with a specific investigation in Rapid7 InsightIDR using the unique identifier.

Endpoint

URL: /idr/v2/investigations/{{identifier}}/alerts

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.identifier	string	Required	The ID of the investigation.
parameters.index	number	Optional	The optional 0-based index of the page to retrieve. Must be an integer greater than or equal to 0.
parameters.multi-customer	boolean	Optional	Indicates whether the requester has multi-customer access. If set to true, the ID of the investigation must be in the RRN format, the region of the RRN must match the region of the endpoint.
parameters.size	number	Optional	The optional size of the page to retrieve. Must be an integer greater than 0, or less than or equal to 100.

Input Example

{"parameters":{"index":0,"multi-customer":false,"size":1},"path_parameters":{"identifier":"174e4f99-2ac7-4481-9301-4d24c34baf06"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.id	string	Response data
data.title	string	Response data
data.alert_type	string	Response data
data.alert_type_description	string	Response data
data.created_time	string	Response data
data.first_event_time	string	Response data
data.latest_event_time	string	Response data
data.alert_source	string	Response data
data.detection_rule_rrn	object	Response data
data.detection_rule_rrn.rule_name	string	Response data
data.detection_rule_rrn.rule_rrn	string	Response data
metadata	object	Response data
metadata.index	number	Response data
metadata.size	number	Response data
metadata.total_pages	number	Response data
metadata.total_data	number	Response data

Output Example

{"data":[{"id":"12345678-1234-1234-1234-123456789abc","title":"string","alert_type":"string","alert_type_description":"string","created_time":"string","first_event_time":"string","latest_event_time":"string","alert_source":"string","detection_rule_rrn":{}}],"metadata":{"index":123,"size":123,"total_pages":123,"total_data":123}}

Get Investigations

Retrieve matching investigations from Rapid7 InsightIDR based on specified parameters.

Endpoint

URL: idr/v1/investigations

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Optional	Parameters for the Get Investigations action
parameters.end_time	string	Optional	Parameters for the Get Investigations action
parameters.limit	string	Optional	Parameters for the Get Investigations action
parameters.statuses	string	Optional	Parameters for the Get Investigations action

Input Example

{"parameters":{"start_time":"2020-01-10T00:00:00Z","end_time":"2023-04-21T00:00:00Z","limit":"50","statuses":"open,closed"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.id	string	Response data
data.rrn	string	Response data
data.title	string	Response data
data.status	string	Response data
data.source	string	Response data
data.disposition	string	Response data
data.alerts	array	Response data
data.alerts.type	string	Response data
data.alerts.type_description	string	Response data
data.alerts.first_event_time	string	Response data
data.created_time	string	Response data
data.assignee	object	Response data
data.assignee.name	string	Response data
data.assignee.email	string	Response data
metadata	object	Response data
metadata.index	number	Response data
metadata.size	number	Response data
metadata.total_pages	number	Response data
metadata.total_data	number	Response data

Output Example

{"data":[{"id":"12345678-1234-1234-1234-123456789abc","rrn":"string","title":"string","status":"active","source":"string","disposition":"string","alerts":[],"created_time":"string","assignee":{}}],"metadata":{"index":123,"size":123,"total_pages":123,"total_data":123}}

Get Log

Retrieve a specific log from Rapid7 InsightIDR using the unique log identifier provided in the path parameters.

Endpoint

URL: log_search/management/logs/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Get Log action

Input Example

{"path_parameters":{"id":"4241b964-2bfd-4135-938e-d9b6f412ad66"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
log	object	Output field: log
log.id	string	Unique identifier
log.name	string	Name of the resource
log.tokens	array	Output field: log.tokens
log.structures	array	Output field: log.structures
log.user_data	object	Response data
log.user_data.le_expire_backup	string	Response data
log.user_data.le_log_type	string	Response data
log.user_data.platform_managed	string	Response data
log.source_type	string	Type of the resource
log.token_seed	object	Output field: log.token_seed
log.retention_period	string	Output field: log.retention_period
log.links	array	Output field: log.links
log.links.rel	string	Output field: log.links.rel
log.links.href	string	Output field: log.links.href
log.rrn	string	Output field: log.rrn
log.logsets_info	array	Output field: log.logsets_info
log.logsets_info.id	string	Unique identifier
log.logsets_info.name	string	Name of the resource
log.logsets_info.rrn	string	Output field: log.logsets_info.rrn
log.logsets_info.links	array	Output field: log.logsets_info.links
log.logsets_info.links.rel	string	Output field: log.logsets_info.links.rel
log.logsets_info.links.href	string	Output field: log.logsets_info.links.href

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 13 Dec 2022 19:14:29 GMT","Content-Type":"application/json","Content-Length":"460","Connection":"keep-alive","R7-Correlation-Id":"ee3427f3-175e-4b34-8172-4df714109137","Vary":"Accept-Encoding, Origin","Content-Encoding":"gzip","Access-Control-Allow-Credentials":"true","RateLimit-Limit":"1500","RateLimit-Reset":"440","RateLimit-Remaining":"1498","X-RateLimit-Limit":"1500","X-RateLimit-Reset":"440","X-RateLimit-Remaining":"1498"},"reason":"OK","j...

Get Logs

Pulls all log entries from Rapid7 InsightIDR, offering a complete overview of event streams for in-depth analysis.

Endpoint

URL: log_search

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
/log_search/management/actions/{id}/targets	object	Unique identifier
/log_search/management/actions/{id}/targets.path	string	Unique identifier
/log_search/management/actions/{id}/targets.verbs	array	Unique identifier
/log_search/management/aws/cloudtrails/{id}	object	Unique identifier
/log_search/management/aws/cloudtrails/{id}.path	string	Unique identifier
/log_search/management/aws/cloudtrails/{id}.verbs	array	Unique identifier
/log_search/usage/accounts/{accountId}/logs	object	Unique identifier
/log_search/usage/accounts/{accountId}/logs.path	string	Unique identifier
/log_search/usage/accounts/{accountId}/logs.verbs	array	Unique identifier
/log_search/query/logs/{log_keys}/{saved_query_id}	object	Unique identifier
/log_search/query/logs/{log_keys}/{saved_query_id}.path	string	Unique identifier
/log_search/query/logs/{log_keys}/{saved_query_id}.verbs	array	Unique identifier
/log_search/audit/query/{id}	object	Unique identifier
/log_search/audit/query/{id}.path	string	Unique identifier
/log_search/audit/query/{id}.verbs	array	Unique identifier
/log_search/management/logsets	object	Output field: /log_search/management/logsets
/log_search/management/logsets.path	string	Output field: /log_search/management/logsets.path
/log_search/management/logsets.verbs	array	Output field: /log_search/management/logsets.verbs
/log_search/management/accounts/{accountid}/apikeys	object	Unique identifier
/log_search/management/accounts/{accountid}/apikeys.path	string	Unique identifier
/log_search/management/accounts/{accountid}/apikeys.verbs	array	Unique identifier
/log_search/management/actions	object	Output field: /log_search/management/actions
/log_search/management/actions.path	string	Output field: /log_search/management/actions.path

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 12 Dec 2022 17:14:27 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","R7-Correlation-Id":"15a2e950-7497-4f75-b624-ba04b423cd8d","Vary":"Accept-Encoding, Origin","Content-Encoding":"gzip","Access-Control-Allow-Credentials":"true","RateLimit-Limit":"500","RateLimit-Reset":"380","RateLimit-Remaining":"496","X-RateLimit-Limit":"500","X-RateLimit-Reset":"380","X-RateLimit-Remaining":"496"},"reason":"OK"...

Get Query

Execute a Log Entry Query Language (LEQL) query in Rapid7 InsightIDR to retrieve targeted log entry data, requiring a JSON body input.

Endpoint

URL: log_search/query/logs

Method: POST

Input

Argument Name	Type	Required	Description
leql	object	Optional	Parameter for Get Query
leql.during	object	Optional	Parameter for Get Query
leql.during.from	number	Optional	Parameter for Get Query
leql.during.to	number	Optional	Parameter for Get Query
leql.statement	string	Optional	Parameter for Get Query
logs	array	Optional	Parameter for Get Query

Input Example

{"json_body":{"leql":{"during":{"from":1670955839000,"to":1670956949000},"statement":"where(hostname=DESKTOP-QSI525C) calculate(count) timeslice(200)"},"logs":["4241b964-2bfd-4135-938e-d9b6f412ad66","7707f0ef-31f2-4fce-91ba-2eb7fbcdf771"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
logs	array	Output field: logs
progress	number	Output field: progress
events	array	Output field: events
events.file_name	string	Name of the resource
events.file	string	Output field: events.file
partial	object	Output field: partial
partial.cardinality	number	Output field: partial.cardinality
partial.granularity	number	Output field: partial.granularity
partial.from	number	Output field: partial.from
partial.to	number	Output field: partial.to
partial.type	string	Type of the resource
partial.stats	object	Output field: partial.stats
partial.stats.global_timeseries	object	Output field: partial.stats.global_timeseries
partial.stats.global_timeseries.count	number	Count value
partial.groups	array	Output field: partial.groups
partial.groups.file_name	string	Name of the resource
partial.groups.file	string	Output field: partial.groups.file
partial.others	object	Output field: partial.others
partial.status	number	Status value
partial.timeseries	object	Output field: partial.timeseries
partial.timeseries.global_timeseries	array	Output field: partial.timeseries.global_timeseries
partial.timeseries.global_timeseries.count	number	Count value
partial.groups_timeseries	array	Output field: partial.groups_timeseries

Output Example

{"status_code":202,"response_headers":{"Date":"Tue, 13 Dec 2022 18:54:26 GMT","Content-Type":"application/json","Content-Length":"3667","Connection":"keep-alive","R7-Correlation-Id":"6f05e429-c746-43aa-896c-9f283bee6bd3","vary":"Origin","Access-Control-Allow-Credentials":"true","RateLimit-Limit":"1500","RateLimit-Reset":"734","RateLimit-Remaining":"1497","X-RateLimit-Limit":"1500","X-RateLimit-Reset":"734","X-RateLimit-Remaining":"1497"},"reason":"Accepted","json_body":{"logs":["4241b964-2bfd-41...

List All Saved Queries

Retrieve all saved queries from Rapid7 InsightIDR to support analysis or investigation efforts.

Endpoint

URL: /log_search/query/saved_queries

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
saved_queries	array	Output field: saved_queries
saved_queries.id	string	Unique identifier
saved_queries.name	string	Name of the resource
saved_queries.leql	object	Output field: saved_queries.leql
saved_queries.leql.statement	string	Output field: saved_queries.leql.statement
saved_queries.leql.during	object	Output field: saved_queries.leql.during
saved_queries.leql.during.time_range	object	Output field: saved_queries.leql.during.time_range
saved_queries.leql.during.to	object	Output field: saved_queries.leql.during.to
saved_queries.leql.during.from	object	Output field: saved_queries.leql.during.from
saved_queries.logs	array	Output field: saved_queries.logs

Output Example

{"status_code":200,"response_headers":{"Date":"Fri, 21 Jun 2024 09:00:13 GMT","Content-Type":"application/json","Content-Length":"191","Connection":"keep-alive","Vary":"Origin, Accept-Encoding, Origin","Strict-Transport-Security":"max-age=31536000; includeSubDomains","R7-Correlation-Id":"14f165c3-d476-45e3-a9f1-13df3a33426b","Access-Control-Allow-Credentials":"true","Access-Control-Expose-Headers":"R7-Correlation-Id","RateLimit-Limit":"1500","RateLimit-Reset":"900","RateLimit-Remaining":"1499","...

List Query endpoints

Retrieve a comprehensive list of available Query API endpoints from Rapid7 InsightIDR.

Endpoint

URL: log_search/query

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
/log_search/query/logs/{log_keys}/{saved_query_id}	object	Unique identifier
/log_search/query/logs/{log_keys}/{saved_query_id}.path	string	Unique identifier
/log_search/query/logs/{log_keys}/{saved_query_id}.verbs	array	Unique identifier
/log_search/query/dataview/saved_query/{saved_query_id}	object	Response data
/log_search/query/dataview/saved_query/{saved_query_id}.path	string	Response data
/log_search/query/dataview/saved_query/{saved_query_id}.verbs	array	Response data
/log_search/query	object	Output field: /log_search/query
/log_search/query.path	string	Output field: /log_search/query.path
/log_search/query.verbs	array	Output field: /log_search/query.verbs
/log_search/query/saved_queries/{id}	object	Unique identifier
/log_search/query/saved_queries/{id}.path	string	Unique identifier
/log_search/query/saved_queries/{id}.verbs	array	Unique identifier
/log_search/query/metrics/{id}	object	Unique identifier
/log_search/query/metrics/{id}.path	string	Unique identifier
/log_search/query/metrics/{id}.verbs	array	Unique identifier
/log_search/query/context/{id}	object	Unique identifier
/log_search/query/context/{id}.path	string	Unique identifier
/log_search/query/context/{id}.verbs	array	Unique identifier
/log_search/query/logs/{log_keys}	object	Output field: /log_search/query/logs/
/log_search/query/logs/{log_keys}.path	string	Output field: /log_search/query/logs/.path
/log_search/query/logs/{log_keys}.verbs	array	Output field: /log_search/query/logs/.verbs
/log_search/query/repeated/{id}	object	Unique identifier
/log_search/query/repeated/{id}.path	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Date":"Wed, 14 Dec 2022 22:03:27 GMT","Content-Type":"application/json","Content-Length":"380","Connection":"keep-alive","R7-Correlation-Id":"7d3877b2-bc53-4da0-b23c-19853fc7f47e","Vary":"Accept-Encoding, Origin","Content-Encoding":"gzip","Access-Control-Allow-Credentials":"true","RateLimit-Limit":"1500","RateLimit-Reset":"900","RateLimit-Remaining":"1499","X-RateLimit-Limit":"1500","X-RateLimit-Reset":"900","X-RateLimit-Remaining":"1499"},"reason":"OK","j...

Query Individual Log Sets

Retrieve details for a specific log set in Rapid7 InsightIDR using the provided unique identifier.

Endpoint

URL: log_search/query/logsets/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Query Individual Log Sets action
parameters.query	string	Optional	Parameters for the Query Individual Log Sets action
parameters.from	string	Optional	Parameters for the Query Individual Log Sets action
parameters.to	string	Optional	Parameters for the Query Individual Log Sets action
parameters.time_range	string	Optional	Parameters for the Query Individual Log Sets action
parameters.kvp_info	string	Optional	Parameters for the Query Individual Log Sets action
parameters.label	string	Optional	Parameters for the Query Individual Log Sets action
parameters.labels	string	Optional	Parameters for the Query Individual Log Sets action
parameters.sequence_number	string	Optional	Parameters for the Query Individual Log Sets action

Input Example

{"parameters":{"query":"where(foo=bar)","from":"2020-09-17T18:24:57+00:00","to":"1600367097846","time_range":"last 20 minutes","kvp_info":"false","label":"","labels":"","sequence_number":""},"path_parameters":{"id":"1fb16e4a-237e-4bf6-8bbe-5aafda850f3a"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
logs	array	Output field: logs
leql	object	Output field: leql
leql.statement	string	Output field: leql.statement
leql.during	object	Output field: leql.during
leql.during.from	number	Output field: leql.during.from
leql.during.to	number	Output field: leql.during.to
events	array	Output field: events
events.labels	array	Output field: events.labels
events.labels.links	array	Output field: events.labels.links
events.labels.links.rel	string	Output field: events.labels.links.rel
events.labels.links.href	string	Output field: events.labels.links.href
events.labels.id	string	Unique identifier
events.timestamp	number	Output field: events.timestamp
events.sequence_number	number	Output field: events.sequence_number
events.log_id	string	Unique identifier
events.message	string	Response message
events.links	array	Output field: events.links
events.links.rel	string	Output field: events.links.rel
events.links.href	string	Output field: events.links.href
events.sequence_number_str	number	Output field: events.sequence_number_str
events.kvp_info	array	Output field: events.kvp_info
events.kvp_info.key	object	Output field: events.kvp_info.key
events.kvp_info.key.text	string	Output field: events.kvp_info.key.text

Output Example

{"status_code":404,"response_headers":{"Date":"Thu, 15 Dec 2022 18:36:49 GMT","Content-Type":"application/json","Content-Length":"43","Connection":"keep-alive","R7-Correlation-Id":"89318875-0b80-4e24-a99b-e19be82be430","vary":"Origin","Access-Control-Allow-Credentials":"true","RateLimit-Limit":"1500","RateLimit-Reset":"899","RateLimit-Remaining":"1499","X-RateLimit-Limit":"1500","X-RateLimit-Reset":"899","X-RateLimit-Remaining":"1499"},"reason":"Not Found","json_body":{"logs":["565c1b7b-c08b-4c8...

Query Individual Logs

Retrieve specific log entries from Rapid7 InsightIDR using a unique log identifier provided in the path parameters.

Endpoint

URL: log_search/query/logs/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Query Individual Logs action
parameters.query	string	Optional	Parameters for the Query Individual Logs action
parameters.kvp_info	boolean	Optional	Parameters for the Query Individual Logs action
parameters.label	string	Optional	Parameters for the Query Individual Logs action
parameters.labels	string	Optional	Parameters for the Query Individual Logs action
parameters.sequence_number	string	Optional	Parameters for the Query Individual Logs action
parameters.time_range	string	Optional	Parameters for the Query Individual Logs action

Input Example

{"parameters":{"query":"where(foo=bar)","kvp_info":false,"label":"","labels":"","sequence_number":"","time_range":"Yesterday"},"path_parameters":{"id":"4241b964-2bfd-4135-938e-d9b6f412ad66"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
logs	array	Output field: logs
progress	number	Output field: progress
events	array	Output field: events
events.file_name	string	Name of the resource
events.file	string	Output field: events.file
links	array	Output field: links
links.rel	string	Output field: links.rel
links.href	string	Output field: links.href
id	string	Unique identifier
leql	object	Output field: leql
leql.statement	object	Output field: leql.statement
leql.during	object	Output field: leql.during
leql.during.from	number	Output field: leql.during.from
leql.during.to	number	Output field: leql.during.to
leql.during.time_range	string	Output field: leql.during.time_range

Output Example

{"status_code":202,"response_headers":{"Date":"Thu, 15 Dec 2022 15:18:39 GMT","Content-Type":"application/json","Content-Length":"322","Connection":"keep-alive","R7-Correlation-Id":"b2ce1333-657e-4823-bd3b-8e24ea69c8df","Vary":"Accept-Encoding, Origin","Content-Encoding":"gzip","Access-Control-Allow-Credentials":"true","RateLimit-Limit":"1500","RateLimit-Reset":"837","RateLimit-Remaining":"1498","X-RateLimit-Limit":"1500","X-RateLimit-Reset":"837","X-RateLimit-Remaining":"1498"},"reason":"Accept...

Query Multiple Log Sets

Execute a query across multiple log sets in Rapid7 InsightIDR using the provided logset name as a parameter.

Endpoint

URL: log_search/query/logsets

Method: GET

Input

Argument Name	Type	Required	Description
parameters.logset_name	string	Required	Parameters for the Query Multiple Log Sets action
parameters.from	string	Optional	Parameters for the Query Multiple Log Sets action
parameters.to	string	Optional	Parameters for the Query Multiple Log Sets action
parameters.label	string	Optional	Parameters for the Query Multiple Log Sets action
parameters.labels	string	Optional	Parameters for the Query Multiple Log Sets action
parameters.per_page	string	Optional	Parameters for the Query Multiple Log Sets action
parameters.kvp_info	string	Optional	Parameters for the Query Multiple Log Sets action
parameters.sequence_number	string	Optional	Parameters for the Query Multiple Log Sets action

Input Example

{"parameters":{"logset_name":"Endpoint Activity, Unparsed Data","from":"2020-09-17t18:24:57+00:00","to":"1600367097846","label":"00000000-0000-0000-0000-000000000001","labels":"00000000-0000-0000-0000-000000000001:21b21bb8-8869-4e2c-98df-684892e4e112","per_page":"10","kvp_info":"false","sequence_number":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
logs	array	Output field: logs
leql	object	Output field: leql
leql.statement	string	Output field: leql.statement
leql.during	object	Output field: leql.during
leql.during.from	number	Output field: leql.during.from
leql.during.to	number	Output field: leql.during.to
events	array	Output field: events
events.labels	array	Output field: events.labels
events.labels.links	array	Output field: events.labels.links
events.labels.links.rel	string	Output field: events.labels.links.rel
events.labels.links.href	string	Output field: events.labels.links.href
events.labels.id	string	Unique identifier
events.timestamp	number	Output field: events.timestamp
events.sequence_number	number	Output field: events.sequence_number
events.log_id	string	Unique identifier
events.message	string	Response message
events.links	array	Output field: events.links
events.links.rel	string	Output field: events.links.rel
events.links.href	string	Output field: events.links.href
events.sequence_number_str	number	Output field: events.sequence_number_str
events.kvp_info	array	Output field: events.kvp_info
events.kvp_info.key	object	Output field: events.kvp_info.key
events.kvp_info.key.text	string	Output field: events.kvp_info.key.text

Output Example

{"status_code":404,"response_headers":{"Date":"Thu, 15 Dec 2022 18:20:15 GMT","Content-Type":"application/json","Content-Length":"43","Connection":"keep-alive","R7-Correlation-Id":"c3c8f87a-6ac7-4ced-acd9-757e6bac80af","vary":"Origin","Access-Control-Allow-Credentials":"true","RateLimit-Limit":"1500","RateLimit-Reset":"899","RateLimit-Remaining":"1499","X-RateLimit-Limit":"1500","X-RateLimit-Reset":"899","X-RateLimit-Remaining":"1499"},"reason":"Not Found","json_body":{"logs":["565c1b7b-c08b-4c8...

Query Multiple Logs

Execute a query across multiple log sets in Rapid7 InsightIDR using the 'logs' parameter provided in the JSON body input.

Endpoint

URL: log_search/query/logs

Method: POST

Input

Argument Name	Type	Required	Description
parameters.per_page	number	Optional	Number of log entries to return per page, up to 500(the maximum allowed).
parameters.export_format	string	Optional	If included, the query results will be exported to the given format. Currently only csv is supported. This parameter is only for non-statistical search queries (i.e. no 'calculate' and/or 'groupby' clauses). Results are limited to the first 1 million log entries, and only one export job may run per account at a time. Results are limited to the first 1 million log entries, and only one export job may run per account at a time. The response will be a 202, and the response body will contain a link for polling the export job (on the /exports/ endpoint).
parameters.kvp_info	boolean	Optional	When set to true, the events object that is returned will additionally contain information about all the key-value pairs in each returned log entry.
parameters.most_recent_first	boolean	Optional	When set to true, the query returns the most recent events first. When set to false, it returns the oldest events first.
parameters.labels	string	Optional	A set of ':' separated label UUIDs. Only entries which have a label matching one of these UUIDs will be returned. This only works with non-statistical queries (i.e. no 'groupby' or 'calculate' clauses). Takes precedence over the 'label' parameter.
parameters.sequence_number	number	Optional	If this query parameter is included, the query results will additionally include all log entries received in the from millisecond which have sequence numbers larger than the one specified. Sequence numbers are identifiers used to distinguish between log entries received in the same millisecond. If a log entry was split up into several log entries during ingestion, then those chunks are ordered by sequence number.
logs	array	Optional	The log keys of the logs which the query is run against.
leql	object	Optional	The LEQL statement of the query, along with the time range.
leql.during	object	Optional	Parameter for Query Multiple Logs
leql.during.from	number	Optional	The start of the time range for the query, as a UNIX timestamp in milliseconds.
leql.during.to	number	Optional	The end of the time range for the query, as a UNIX timestamp in milliseconds.
leql.during.time_range	string	Optional	Relative time range (instead of absolute from + to time range). Possible values are yesterday, today last x timeunits where x is the number of time unit back from the current server time. Supported time units (case insensitive) - min(s) or minute(s), hr(s) or hour(s), day(s), week(s), month(s), year(s).
leql.statement	string	Optional	The LEQL query run against the log(s). If empty, the query retrieves all log entries in the specified time range. Cannot be empty for saved queries.

Input Example

{"parameters":{"per_page":50,"export_format":"csv","kvp_info":true,"most_recent_first":true,"labels":"00000000-0000-0000-0000-000000000001:21b21bb8-8869-4e2c-98df-684892e4e112","sequence_number":2234733321019952000},"json_body":{"logs":["565c1b7b-c08b-4c87-a42a-ab08bad56071","c78579a8-8b20-4e6a-d4c0-5287198a263b"],"leql":{"during":{"from":1609629856000,"to":1609629992000,"time_range":"last 1 hour"},"statement":"where(931dde6c60>=800)"}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
logs	array	Output field: logs
progress	number	Output field: progress
events	array	Output field: events
links	array	Output field: links
links.rel	string	Output field: links.rel
links.href	string	Output field: links.href
id	string	Unique identifier
leql	object	Output field: leql
leql.statement	object	Output field: leql.statement
leql.during	object	Output field: leql.during
leql.during.from	number	Output field: leql.during.from
leql.during.to	number	Output field: leql.during.to

Output Example

{"status_code":202,"response_headers":{"Date":"Wed, 14 Dec 2022 21:27:14 GMT","Content-Type":"application/json","Content-Length":"494","Connection":"keep-alive","R7-Correlation-Id":"0611c3c7-7edd-4d1f-80c5-4e6d31883898","vary":"Origin","Access-Control-Allow-Credentials":"true","RateLimit-Limit":"1500","RateLimit-Reset":"899","RateLimit-Remaining":"1499","X-RateLimit-Limit":"1500","X-RateLimit-Reset":"899","X-RateLimit-Remaining":"1499"},"reason":"Accepted","json_body":{"logs":["4241b964-2bfd-413...

Replace Indicators for Threat

Replace all indicators for a specified threat in Rapid7 InsightIDR, requiring a threat key and format specification.

Endpoint

URL: idr/v1/customthreats/key/{{key}}/indicators/replace

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.key	string	Required	Parameters for the Replace Indicators for Threat action
parameters.format	string	Required	Parameters for the Replace Indicators for Threat action
ips	array	Optional	Parameter for Replace Indicators for Threat
hashes	array	Optional	Parameter for Replace Indicators for Threat
domain_names	array	Optional	Name of the resource
urls	array	Optional	URL endpoint for the request

Input Example

{"parameters":{"format":"json"},"json_body":{"ips":["192.108.0.1"],"hashes":["b95663ec7339033cf1fde459a34b6606"],"domain_names":["mailxpy.com"],"urls":[" http://www.mailxpy.com/login/index.php"]},"path_parameters":{"key":"723dc6a0-ae08-4404-986c-36310f15b679"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
rejected_indicators	array	Output field: rejected_indicators
threat	object	Output field: threat
threat.indicator_count	number	Count value
threat.name	string	Name of the resource
threat.note	string	Output field: threat.note
threat.published	boolean	Output field: threat.published

Output Example

{"status_code":404,"response_headers":{"Date":"Thu, 15 Dec 2022 20:19:07 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Expires":"0","Pragma":"no-cache","X-Content-Type-Options":"nosniff","X-Frame-Options":"DENY","X-XSS-Protection":"1; mode=block","vary":"Origin","Access-Control-Allow-Credentials":"true"},"reason":"Not Found","json_body":{"rejected_indicators":["blacklisted","invalid...

Retrieve a Single Alert

Retrieve a specific alert from Rapid7 InsightIDR using the unique Resource Resolution Name (RRN) provided as a path parameter.

Endpoint

URL: /idr/at/alerts/{{alert_rrn}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alert_rrn	string	Required	The unique identifier of the alert.

Input Example

{"path_parameters":{"alert_rrn":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
rrn	string	Output field: rrn
version	number	Output field: version
created_at	string	Output field: created_at
updated_at	string	Output field: updated_at
alerted_at	string	Output field: alerted_at
ingested_at	string	Output field: ingested_at
external_source	string	Output field: external_source
external_id	string	Unique identifier
organization	object	Output field: organization
organization.id	string	Unique identifier
organization.name	string	Name of the resource
organization.region	string	Output field: organization.region
organization.product_token	string	Output field: organization.product_token
organization.customer_id	string	Unique identifier
organization.customer_name	string	Name of the resource
organization.customer_code	string	Output field: organization.customer_code
organization.customer_group	string	Output field: organization.customer_group
organization.flags	array	Output field: organization.flags
title	string	Output field: title
type	string	Type of the resource
rule	object	Output field: rule
rule.rrn	string	Output field: rule.rrn
rule.name	string	Name of the resource

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"rrn":"string","version":0,"created_at":"2019-08-24T14:15:22Z","updated_at":"2019-08-24T14:15:22Z","alerted_at":"2019-08-24T14:15:22Z","ingested_at":"2019-08-24T14:15:22Z","external_source":"string","external_id":"string","organization":{"id":"string","name":"string","region":"string","product_token":"string","customer_id":"string","customer_name":"string","customer_code":"string","customer_group":"string","flags":[]},"title":"s...

Retrieve Evidence for Alert

Retrieve evidence for a specific alert in Rapid7 InsightIDR using the unique Alert RRN. Path parameters and headers are required.

Endpoint

URL: /idr/at/alerts/{{alert_rrn}}/evidences

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alert_rrn	string	Required	The unique identifier of the alert.
parameters.index	number	Optional	The index of the page to retrieve (zero-indexed).
parameters.size	number	Optional	The size of the page to retrieve.
headers	object	Required	HTTP headers for the request
headers.Accept-Version	string	Required	Acknowledges the API preview status.

Input Example

{"parameters":{"index":0,"size":1},"path_parameters":{"alert_rrn":"14457f42-5f94-4125-aa6d-b3de4346f2bd"},"headers":{"Accept-Version":"strong-force-preview"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
evidences	array	Unique identifier
evidences.rrn	string	Unique identifier
evidences.version	number	Unique identifier
evidences.created_at	string	Unique identifier
evidences.updated_at	string	Unique identifier
evidences.evented_at	string	Unique identifier
evidences.external_source	string	Unique identifier
evidences.event_type	string	Unique identifier
evidences.data	string	Response data
metadata	object	Response data
metadata.index	number	Response data
metadata.size	number	Response data
metadata.items_in_index	number	Response data
metadata.total_items	number	Response data
metadata.is_last_index	boolean	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Fri, 21 Jun 2024 08:01:46 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","r7-correlation-id":"04bad1e4-ac8d-4645-adc2-9d4d3588cb80","vary":"accept-encoding, Origin","content-encoding":"gzip","x-envoy-upstream-service-time":"261","server":"istio-envoy","x-envoy-decorator-operation":"protonclass1apigatewayapp.default.svc.cluster.local:9873/*","Access-Control-Allow-Credentials":"true","Access-Control-Expo...

Retrieve Multiple Alerts

Retrieve multiple alerts from Rapid7 InsightIDR using a list of Record Resource Names (RRNs) provided in the JSON body.

Endpoint

URL: /idr/at/alerts/ops/rrns

Method: POST

Input

Argument Name	Type	Required	Description
parameters.strict	boolean	Optional	Indicates whether to return a 404 error if no alerts are found.
rrns	array	Optional	The RRNs for the alerts to retrieve.
field_ids	array	Optional	Additional fields to include for each alert. No additional fields are included if field_ids is empty.

Input Example

{"parameters":{"strict":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
alerts	array	Output field: alerts
alerts.rrn	string	Output field: alerts.rrn
alerts.version	number	Output field: alerts.version
alerts.created_at	string	Output field: alerts.created_at
alerts.updated_at	string	Output field: alerts.updated_at
alerts.alerted_at	string	Output field: alerts.alerted_at
alerts.ingested_at	string	Output field: alerts.ingested_at
alerts.external_source	string	Output field: alerts.external_source
alerts.external_id	string	Unique identifier
alerts.organization	object	Output field: alerts.organization
alerts.organization.id	string	Unique identifier
alerts.organization.name	string	Name of the resource
alerts.organization.region	string	Output field: alerts.organization.region
alerts.organization.product_token	string	Output field: alerts.organization.product_token
alerts.organization.customer_id	string	Unique identifier
alerts.organization.customer_name	string	Name of the resource
alerts.organization.customer_code	string	Output field: alerts.organization.customer_code
alerts.organization.customer_group	string	Output field: alerts.organization.customer_group
alerts.organization.flags	array	Output field: alerts.organization.flags
alerts.title	string	Output field: alerts.title
alerts.type	string	Type of the resource
alerts.rule	object	Output field: alerts.rule
alerts.rule.rrn	string	Output field: alerts.rule.rrn

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"alerts":[{}],"region_failures":[{}]}}

Run Saved Query

Execute a predefined saved query in Rapid7 InsightIDR using the unique identifier 'saved_query_id'.

Endpoint

URL: /log_search/query/saved_query/{{saved_query_id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.saved_query_id	string	Required	The ID of the saved query.
parameters.time_range	string	Optional	An alternative to the from and to query parameters. Possible values are "yesterday", "today" and "last x timeunits" where x is the number of time unit back from the current server time. Supported time units (case insensitive) are min(s) or minute(s), hr(s) or hour(s), day(s), week(s), month(s) and year(s). If "time_range" is used, then the "from" and "to" query parameters must not be used.
parameters.from	number	Optional	The start of the time range for the query, as a UNIX timestamp in milliseconds.
parameters.to	number	Optional	The end of the time range for the query, as a UNIX timestamp in milliseconds.
parameters.per_page	number	Optional	Number of log entries to return per page, up to 500(the maximum allowed).
parameters.kvp_info	boolean	Optional	When set to true, the events object that is returned will additionally contain information about all the key-value pairs in each returned log entry.
parameters.most_recent_first	boolean	Optional	When set to true, the query returns the most recent events first. When set to false, it returns the oldest events first.

Input Example

{"parameters":{"time_range":"last 6 months","from":1460557604000,"to":1460557604000,"per_page":50,"kvp_info":true,"most_recent_first":false},"path_parameters":{"saved_query_id":"00000000-0000-00cf-0000-000000000000"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
logs	array	Output field: logs
leql	object	Output field: leql
leql.statement	string	Output field: leql.statement
leql.during	object	Output field: leql.during
leql.during.from	number	Output field: leql.during.from
leql.during.to	number	Output field: leql.during.to
events	array	Output field: events
events.labels	array	Output field: events.labels
events.labels.links	array	Output field: events.labels.links
events.labels.links.rel	string	Output field: events.labels.links.rel
events.labels.links.href	string	Output field: events.labels.links.href
events.labels.id	string	Unique identifier
events.timestamp	number	Output field: events.timestamp
events.sequence_number	number	Output field: events.sequence_number
events.log_id	string	Unique identifier
events.message	string	Response message
events.links	array	Output field: events.links
events.links.rel	string	Output field: events.links.rel
events.links.href	string	Output field: events.links.href
events.sequence_number_str	number	Output field: events.sequence_number_str
events.kvp_info	array	Output field: events.kvp_info
events.kvp_info.key	object	Output field: events.kvp_info.key
events.kvp_info.key.text	string	Output field: events.kvp_info.key.text

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"logs":["565c1b7b-c08b-4c87-a42a-ab08bad56071"],"leql":{"statement":"where(931dde6c60>=800)","during":{}},"events":[{},{}]}}

Set Investigation Status

Update an existing investigation's status in Rapid7 InsightIDR using the provided ID and status values.

Endpoint

URL: idr/v1/investigations/{{id}}/status/{{status}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Set Investigation Status action
path_parameters.status	string	Required	Parameters for the Set Investigation Status action

Input Example

{"path_parameters":{"id":"723dc6a0-ae08-4404-986c-36310f15b679","status":"OPEN"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
rrn	string	Output field: rrn
title	string	Output field: title
status	string	Status value
source	string	Output field: source
disposition	string	Output field: disposition
alerts	array	Output field: alerts
alerts.type	string	Type of the resource
alerts.type_description	string	Type of the resource
alerts.first_event_time	string	Time value
created_time	string	Time value

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 15 Dec 2022 19:19:41 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Expires":"0","Pragma":"no-cache","X-Content-Type-Options":"nosniff","X-Frame-Options":"DENY","X-XSS-Protection":"1; mode=block","vary":"Origin","Access-Control-Allow-Credentials":"true"},"reason":"OK","json_body":{"id":"723dc6a0-ae08-4404-986c-36310f15b679","rrn":"r...

SOC - InsightIDR to Turbine Schema

Automatically discover Rapid7 InsightIDR investigations within a time window, fetch related alerts and optional evidence/actors, and return Swimlane Turbine Schema objects.

Endpoint

Method: POST

Input

Argument Name	Type	Required	Description
parameters.alert_organization	string	Optional	Organization name to tag Turbine Schema alerts.
parameters.start_time	string	Optional	ISO-8601 UTC start of the investigation search window. Defaults to 24 hours ago.
parameters.end_time	string	Optional	ISO-8601 UTC end of the investigation search window. Defaults to now.
parameters.statuses	string	Optional	Comma-separated investigation statuses to include.
parameters.investigation_limit	number	Optional	Maximum number of investigations to process.
parameters.max_alerts_per_investigation	number	Optional	Maximum alerts to enrich per investigation.
parameters.include_evidence	boolean	Optional	If true, fetch alert evidences and actors for enrichment.

Input Example

{"parameters":{"alert_organization":"Unknown","start_time":"string","end_time":"string","statuses":"active","investigation_limit":20,"max_alerts_per_investigation":50,"include_evidence":true}}

Output

Parameter	Type	Description
status_code	number	200 on success, 4xx/5xx on failure.
body	object	Request body data
body.success	boolean	Request body data
body.message	string	Request body data
body.count	number	Number of Turbine Schema events produced.
body.events	array	One Ingest_Alert-ready object per investigation. Each item has teds_alert (core Turbine Schema incl. alert_uid key field) and extended_alert_fields.
body.events.teds_alert	object	Core Turbine Schema alert. alert_uid is the Signal upsert key field.
body.events.teds_alert.alert_uid	string	Required key field for Ingest_Alert / Upsert Record.
body.events.teds_alert.alert_title	string	Request body data
body.events.teds_alert.alert_severity	string	Request body data
body.events.teds_alert.alert_status	string	Request body data
body.events.teds_alert.alert_confidence	string	Request body data
body.events.teds_alert.alert_assignee	string	Request body data
body.events.teds_alert.alert_source_system	string	Request body data
body.events.teds_alert.alert_updated_timestamp	string	Request body data
body.events.teds_alert.alert_detection_timestamp	string	Request body data
body.events.teds_alert.observables	array	Request body data
body.events.teds_alert.alert_impacted_hostnames	array	Request body data
body.events.teds_alert.alert_impacted_ip_addresses	array	Request body data
body.events.teds_alert.alert_impacted_usernames	array	Request body data
body.events.extended_alert_fields	object	Investigation context mapped to Emit Event Extended_Fields.
body.events.extended_alert_fields.investigation_rrn	string	Request body data
body.events.extended_alert_fields.investigation_status	string	Request body data
body.events.extended_alert_fields.alerts_count	number	Request body data
body.events.extended_alert_fields.evidence_available	boolean	Request body data

Output Example

{"body":{"success":true,"message":"string","count":123,"events":[{}],"errors":[{}]}}

Response Headers

Header	Description	Example
Access-Control-Allow-Credentials	HTTP response header: Access-Control-Allow-Credentials	true
Access-Control-Expose-Headers	HTTP response header: Access-Control-Expose-Headers	R7-Correlation-Id
Cache-Control	Directives for caching mechanisms	no-cache, no-store, max-age=0, must-revalidate
Connection	HTTP response header: Connection	keep-alive
content-encoding	HTTP response header: content-encoding	gzip
Content-Length	The length of the response body in bytes	74
Content-Type	The media type of the resource	application/json; charset=utf-8
Date	The date and time at which the message was originated	Fri, 21 Jun 2024 09:18:35 GMT
Expires	The date/time after which the response is considered stale	0
Location	The URL to redirect a page to	https://us3.api.insight.rapid7.com/log_search/query/saved_queries/00000000-0000-1618-0000-000000000000
Pragma	HTTP response header: Pragma	no-cache
R7-Correlation-Id	HTTP response header: R7-Correlation-Id	6f05e429-c746-43aa-896c-9f283bee6bd3
RateLimit-Limit	HTTP response header: RateLimit-Limit	500
RateLimit-Remaining	HTTP response header: RateLimit-Remaining	1498
RateLimit-Reset	HTTP response header: RateLimit-Reset	380
server	Information about the software used by the origin server	istio-envoy
Set-Cookie	HTTP response header: Set-Cookie	JSESSIONID=19DD27BED4658D41E78B3EF8859972B3; Path=/; HttpOnly
Strict-Transport-Security	HTTP response header: Strict-Transport-Security	max-age=31536000; includeSubDomains
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
vary	HTTP response header: vary	Origin
X-Content-Type-Options	HTTP response header: X-Content-Type-Options	nosniff
x-envoy-decorator-operation	HTTP response header: x-envoy-decorator-operation	protonclass1apigatewayapp.default.svc.cluster.local:9873/*
x-envoy-upstream-service-time	HTTP response header: x-envoy-upstream-service-time	261
X-Frame-Options	HTTP response header: X-Frame-Options	DENY
X-RateLimit-Limit	The number of requests allowed in the current rate limit window	500
X-RateLimit-Remaining	The number of requests remaining in the current rate limit window	1499
X-RateLimit-Reset	The time at which the current rate limit window resets	837
X-XSS-Protection	HTTP response header: X-XSS-Protection	1; mode=block