Rapid7 InsightIDR V2

Rapid7 InsightIDR is a SIEM solution that helps organizations detect, investigate, and respond to security threats.

Rapid7 InsightIDR is a comprehensive security information and event management (SIEM) solution that provides advanced threat detection and response capabilities. This connector enables seamless integration with Swimlane Turbine, allowing users to automate incident response and streamline security operations. By leveraging this integration, users can efficiently manage investigations, execute saved queries, and retrieve alerts and evidence, enhancing their security posture and operational efficiency.

Prerequisites

Before you can use the Rapid7 InsightIDR V2 connector for Turbine, you'll need access to the Rapid7 InsightIDR API. This requires the following:

an API key authentication using the following parameters:

URL: The endpoint URL for accessing the Rapid7 InsightIDR API.

API Key: A valid API key for authenticating requests to the Rapid7 InsightIDR API.

Capabilities

This connector provides the following capabilities:

Assign User to Investigation

Bulk Close Investigations

Create a Saved Query

Create investigation

Delete a Saved Query

Get Investigation

Get Product List Alerts by Investigation

List Alerts Investigation

List All Saved Queries

List Investigations

Retrieve Evidence for Alert

Run Saved Query

Search investigations

Set Disposition Investigation

Set Priority Investigation ... and so on

Asset Setup

Fill in the region parameter with the data center used for your account. To find the data center, log in to your insightIDR account, then look at the URL of the home page. The URL should look similar to this:

REGION indicates your data center. Enter that as the value in the region parameter.

Actions Setup

You need a threat key in order to use actions that manage threats. If you do not have a threat to use, follow the instructions here to create a new threat.

For actions that take datetime inputs, you can use any standard datetime format.

Notes

All API documentation

Additional Documentation

Rapid7 InsightIDR V2 Connector Documentation

Rapid7 InsightIDR V2 API Documentation

Rapid7 InsightIDR V2 Authentication Guide

Configurations

API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
X-Api-Key	API key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Assign User to Investigation

Assign a user to an investigation in Rapid7 InsightIDR V2 by specifying the investigation ID and user's email address.

Endpoint

URL: idr/v2/investigations/{{id}}/assignee

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Assign User to Investigation action
parameters.multi-customer	boolean	Optional	Parameters for the Assign User to Investigation action
headers	object	Required	HTTP headers for the request
headers.Accept-version	string	Required	HTTP headers for the request
user_email_address	string	Optional	Parameter for Assign User to Investigation

Input Example

{"parameters":{"multi-customer":false},"json_body":{"user_email_address":"[email protected]"},"path_parameters":{"id":"3726c3aa-a4d8-4be4-969d-ff2c156ddd78"},"headers":{"Accept-version":"investigations-preview"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
assignee	object	Output field: assignee
assignee.email	string	Output field: assignee.email
assignee.name	string	Name of the resource
created_time	string	Time value
disposition	string	Output field: disposition
first_alert_time	string	Time value
last_accessed	string	Output field: last_accessed
latest_alert_time	string	Time value
organization_id	string	Unique identifier
priority	string	Output field: priority
responsibility	string	Output field: responsibility
rrn	string	Output field: rrn
source	string	Output field: source
status	string	Status value
tags	array	Output field: tags
title	string	Output field: title

Output Example

{"assignee":{"email":"[email protected]","name":"Example Name"},"created_time":"string","disposition":"string","first_alert_time":"string","last_accessed":"string","latest_alert_time":"string","organization_id":"string","priority":"string","responsibility":"string","rrn":"string","source":"string","status":"active","tags":["string"],"title":"string"}

Bulk Close Investigations

Close multiple investigations in Rapid7 InsightIDR within a specified date range. Requires 'from', 'source', and 'to' parameters.

Endpoint

URL: idr/v2/investigations/bulk_close

Method: POST

Input

Argument Name	Type	Required	Description
headers	object	Required	HTTP headers for the request
headers.Accept-version	string	Required	HTTP headers for the request
alert_type	string	Optional	Type of the resource
detection_rule_rrn	string	Optional	Parameter for Bulk Close Investigations
disposition	string	Optional	Parameter for Bulk Close Investigations
from	string	Optional	Parameter for Bulk Close Investigations
max_investigations_to_close	number	Optional	Parameter for Bulk Close Investigations
source	string	Optional	Parameter for Bulk Close Investigations
to	string	Optional	Parameter for Bulk Close Investigations

Input Example

{"json_body":{"alert_type":"Attacker Behavior Detected","detection_rule_rrn":"string","disposition":"BENIGN","from":"2023-07-19T03:21:57.980Z","max_investigations_to_close":10,"source":"MANUAL","to":"2023-07-20T03:21:57.980Z"},"headers":{"Accept-version":"investigations-preview"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
ids	array	Unique identifier
num_closed	number	Output field: num_closed

Output Example

{"status_code":200,"response_headers":{},"reason":"","json_body":{"ids":["581134c9-2510-4010-865c-7ae81761315b","114c706d-e64a-4731-997b-9115beef3026"],"num_closed":2}}

Create a Saved Query

Initiate the creation of a saved query in Rapid7 InsightIDR using provided 'saved_query' details.

Endpoint

URL: /log_search/query/saved_queries

Method: POST

Input

Argument Name	Type	Required	Description
saved_query	object	Optional	Parameter for Create a Saved Query
saved_query.name	string	Required	The name for the Saved Query.
saved_query.leql	object	Required	Parameter for Create a Saved Query
saved_query.leql.during	object	Optional	Parameter for Create a Saved Query
saved_query.leql.during.from	number	Optional	The start of the time range for the query, as a UNIX timestamp in milliseconds.
saved_query.leql.during.to	number	Optional	The end of the time range for the query, as a UNIX timestamp in milliseconds.
saved_query.leql.during.time_range	string	Optional	Relative time range (instead of absolute from + to time range). Possible values are "yesterday", "today" and "last x timeunits" where x is the number of time unit back from the current server time. Supported time units (case insensitive) are min(s) or minute(s), hr(s) or hour(s), day(s), week(s), month(s) and year(s).
saved_query.leql.statement	string	Required	The LEQL query run against the log(s). If empty, the query retrieves all log entries in the specified time range.
saved_query.logs	array	Optional	The log keys of the logs which the query is run against.

Input Example

{"json_body":{"saved_query":{"name":"saved-query-2","leql":{"statement":"where(test)"}}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
saved_query	object	Output field: saved_query
saved_query.id	string	Unique identifier
saved_query.name	string	Name of the resource
saved_query.leql	object	Output field: saved_query.leql
saved_query.leql.statement	string	Output field: saved_query.leql.statement
saved_query.leql.during	object	Output field: saved_query.leql.during
saved_query.leql.during.time_range	object	Output field: saved_query.leql.during.time_range
saved_query.leql.during.to	object	Output field: saved_query.leql.during.to
saved_query.leql.during.from	object	Output field: saved_query.leql.during.from
saved_query.logs	array	Output field: saved_query.logs

Output Example

{"status_code":201,"response_headers":{"Date":"Fri, 21 Jun 2024 09:18:35 GMT","Content-Type":"application/json","Content-Length":"180","Connection":"keep-alive","Vary":"Origin, Accept-Encoding, Origin","Location":"https://us3.api.insight.rapid7.com/log_search/query/saved_queries/00000000-0000-...","Strict-Transport-Security":"max-age=31536000; includeSubDomains","R7-Correlation-Id":"3f4f3a96-4af9-4229-9303-30dd632beb93","Access-Control-Allow-Credentials":"true","Access-Control-Expose-Headers":"R...

Create Investigation

Initiate a manual investigation in Rapid7 InsightIDR V2 using custom headers and JSON body data.

Endpoint

URL: idr/v2/investigations

Method: POST

Input

Argument Name	Type	Required	Description
headers	object	Required	HTTP headers for the request
headers.Accept-version	string	Required	HTTP headers for the request
assignee	object	Optional	Parameter for Create Investigation
assignee.email	string	Optional	Parameter for Create Investigation
disposition	string	Optional	Parameter for Create Investigation
priority	string	Optional	Parameter for Create Investigation
status	string	Optional	Status value
title	string	Optional	Parameter for Create Investigation

Input Example

{"json_body":{"assignee":{"email":"[email protected]"},"disposition":" BENIGN","priority":"LOW","status":"OPEN","title":"Jane Smith"},"headers":{"Accept-version":"investigations-preview"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
assignee	object	Output field: assignee
assignee.email	string	Output field: assignee.email
assignee.name	string	Name of the resource
created_time	string	Time value
disposition	string	Output field: disposition
first_alert_time	string	Time value
last_accessed	string	Output field: last_accessed
latest_alert_time	string	Time value
organization_id	string	Unique identifier
priority	string	Output field: priority
responsibility	string	Output field: responsibility
rrn	string	Output field: rrn
source	string	Output field: source
status	string	Status value
tags	array	Output field: tags
title	string	Output field: title

Output Example

Delete a Saved Query

Remove a specified saved query from Rapid7 InsightIDR using the provided unique saved_query_id.

Endpoint

URL: /log_search/query/saved_queries/{{saved_query_id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.saved_query_id	string	Required	The ID of the saved query.

Input Example

{"path_parameters":{"saved_query_id":"00000000-0000-1616-0000-000000000000"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"status_code":204,"response_headers":{"Date":"Fri, 21 Jun 2024 09:07:47 GMT","Connection":"keep-alive","Vary":"Origin, Origin","Strict-Transport-Security":"max-age=31536000; includeSubDomains","R7-Correlation-Id":"5d143985-8028-4204-a2f9-f18e1848b30b","Access-Control-Allow-Credentials":"true","Access-Control-Expose-Headers":"R7-Correlation-Id","RateLimit-Limit":"1500","RateLimit-Reset":"445","RateLimit-Remaining":"1497","X-RateLimit-Limit":"1500","X-RateLimit-Reset":"445","X-RateLimit-Remaining...

Get Investigation

Retrieve a specific investigation in Rapid7 InsightIDR V2 using the unique identifier (id) provided in path parameters.

Endpoint

URL: idr/v2/investigations/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Get Investigation action
parameters.multi-customer	boolean	Optional	Parameters for the Get Investigation action
headers	object	Required	HTTP headers for the request
headers.Accept-version	string	Required	HTTP headers for the request

Input Example

{"parameters":{"multi-customer":false},"path_parameters":{"id":"3726c3aa-a4d8-4be4-969d-ff2c156ddd78"},"headers":{"Accept-version":"investigations-preview"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
assignee	object	Output field: assignee
assignee.email	string	Output field: assignee.email
assignee.name	string	Name of the resource
created_time	string	Time value
disposition	string	Output field: disposition
first_alert_time	string	Time value
last_accessed	string	Output field: last_accessed
latest_alert_time	string	Time value
organization_id	string	Unique identifier
priority	string	Output field: priority
responsibility	string	Output field: responsibility
rrn	string	Output field: rrn
source	string	Output field: source
status	string	Status value
tags	array	Output field: tags
title	string	Output field: title

Output Example

Get Product List Alerts by Investigation

Retrieve all Rapid7 InsightIDR alerts associated with a given investigation identifier, using specified path parameters and headers.

Endpoint

URL: idr/v2/investigations/{{identifier}}/rapid7-product-alerts

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.identifier	string	Required	Parameters for the Get Product List Alerts by Investigation action
parameters.multi-customer	boolean	Optional	Parameters for the Get Product List Alerts by Investigation action
headers	object	Required	HTTP headers for the request
headers.Accept-version	string	Required	HTTP headers for the request

Input Example

{"parameters":{"multi-customer":false},"path_parameters":{"identifier":"3726c3aa-a4d8-4be4-969d-ff2c156ddd78"},"headers":{"Accept-version":"investigations-preview"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 25 Jul 2023 05:13:19 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Expires":"0","Pragma":"no-cache","X-Content-Type-Options":"nosniff","X-Frame-Options":"DENY","X-XSS-Protection":"1; mode=block","vary":"Origin","Access-Control-Allow-Credentials":"true"},"reason":"OK","json_body":[{"threat_command_details":{},"type":"THREAT_COMMAND"...

List Alerts Investigation

Retrieve all alerts associated with a given investigation in Rapid7 InsightIDR V2 using the unique identifier and required path parameters.

Endpoint

URL: idr/v2/investigations/{{identifier}}/alerts

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.identifier	string	Required	Parameters for the List Alerts Investigation action
parameters.index	number	Optional	Parameters for the List Alerts Investigation action
parameters.multi-customer	boolean	Optional	Parameters for the List Alerts Investigation action
parameters.size	number	Optional	Parameters for the List Alerts Investigation action
headers	object	Required	HTTP headers for the request
headers.Accept-version	string	Required	HTTP headers for the request

Input Example

{"parameters":{"index":10,"multi-customer":false,"size":20},"path_parameters":{"identifier":"3726c3aa-a4d8-4be4-969d-ff2c156ddd78"},"headers":{"Accept-version":"investigations-preview"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
metadata	object	Response data
metadata.index	number	Response data
metadata.size	number	Response data
metadata.total_pages	number	Response data
metadata.total_data	number	Response data
data	array	Response data
data.alert_source	string	Response data
data.alert_type	string	Response data
data.alert_type_description	string	Response data
data.created_time	string	Response data
data.detection_rule_rrn	object	Response data
data.detection_rule_rrn.rule_name	string	Response data
data.detection_rule_rrn.rule_rrn	string	Response data
data.first_event_time	string	Response data
data.id	string	Response data
data.latest_event_time	string	Response data
data.title	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 25 Jul 2023 05:00:27 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Expires":"0","Pragma":"no-cache","X-Content-Type-Options":"nosniff","X-Frame-Options":"DENY","X-XSS-Protection":"1; mode=block","vary":"Origin","Access-Control-Allow-Credentials":"true"},"reason":"OK","json_body":{"data":[{}]},"metadata":{"index":10,"size":20,"total...

List All Saved Queries

Retrieve all saved queries from Rapid7 InsightIDR for analysis or investigation purposes.

Endpoint

URL: /log_search/query/saved_queries

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
saved_queries	array	Output field: saved_queries
saved_queries.id	string	Unique identifier
saved_queries.name	string	Name of the resource
saved_queries.leql	object	Output field: saved_queries.leql
saved_queries.leql.statement	string	Output field: saved_queries.leql.statement
saved_queries.leql.during	object	Output field: saved_queries.leql.during
saved_queries.leql.during.time_range	object	Output field: saved_queries.leql.during.time_range
saved_queries.leql.during.to	object	Output field: saved_queries.leql.during.to
saved_queries.leql.during.from	object	Output field: saved_queries.leql.during.from
saved_queries.logs	array	Output field: saved_queries.logs

Output Example

{"status_code":200,"response_headers":{"Date":"Fri, 21 Jun 2024 09:00:13 GMT","Content-Type":"application/json","Content-Length":"191","Connection":"keep-alive","Vary":"Origin, Accept-Encoding, Origin","Strict-Transport-Security":"max-age=31536000; includeSubDomains","R7-Correlation-Id":"14f165c3-d476-45e3-a9f1-13df3a33426b","Access-Control-Allow-Credentials":"true","Access-Control-Expose-Headers":"R7-Correlation-Id","RateLimit-Limit":"1500","RateLimit-Reset":"900","RateLimit-Remaining":"1499","...

List Investigations

Retrieve a paginated list of investigations from Rapid7 InsightIDR using specified request headers.

Endpoint

URL: idr/v2/investigations

Method: GET

Input

Argument Name	Type	Required	Description
parameters.assignee.email	string	Optional	Parameters for the List Investigations action
parameters.end_time	string	Optional	Parameters for the List Investigations action
parameters.index	number	Optional	Parameters for the List Investigations action
parameters.multi-customer	boolean	Optional	Parameters for the List Investigations action
parameters.priorities	string	Optional	Parameters for the List Investigations action
parameters.size	number	Optional	Parameters for the List Investigations action
parameters.sort	string	Optional	Parameters for the List Investigations action
parameters.sources	string	Optional	Parameters for the List Investigations action
parameters.start_time	string	Optional	Parameters for the List Investigations action
parameters.statuses	string	Optional	Parameters for the List Investigations action
parameters.tags	string	Optional	Parameters for the List Investigations action
headers	object	Required	HTTP headers for the request
headers.Accept-version	string	Required	HTTP headers for the request

Input Example

{"parameters":{"assignee.email":"[email protected]","end_time":"2018-07-04T00:00:00Z","index":10,"multi-customer":false,"priorities":"LOW","size":20,"sort":"priority,DESC","sources":"USER,ALERT","start_time":"2018-07-04T00:00:00Z","statuses":"OPEN","tags":"Incident"},"headers":{"Accept-version":"investigations-preview"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.assignee	object	Response data
data.assignee.email	string	Response data
data.assignee.name	string	Response data
data.created_time	string	Response data
data.disposition	string	Response data
data.first_alert_time	string	Response data
data.last_accessed	string	Response data
data.latest_alert_time	string	Response data
data.organization_id	string	Response data
data.priority	string	Response data
data.responsibility	string	Response data
data.rrn	string	Response data
data.source	string	Response data
data.status	string	Response data
data.tags	array	Response data
data.title	string	Response data
metadata	object	Response data
metadata.index	number	Response data
metadata.size	number	Response data
metadata.total_data	number	Response data
metadata.total_pages	number	Response data

Output Example

{"data":[{"assignee":{},"created_time":"string","disposition":"string","first_alert_time":"string","last_accessed":"string","latest_alert_time":"string","organization_id":"string","priority":"string","responsibility":"string","rrn":"string","source":"string","status":"active","tags":[],"title":"string"}],"metadata":{"index":123,"size":123,"total_data":123,"total_pages":123}}

Retrieve Evidence for Alert

Retrieve associated evidence for a specific alert in Rapid7 InsightIDR using the alert's unique resource name (RRN).

Endpoint

URL: /idr/at/alerts/{{alert_rrn}}/evidences

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alert_rrn	string	Required	The unique identifier of the alert.
parameters.index	number	Optional	The index of the page to retrieve (zero-indexed).
parameters.size	number	Optional	The size of the page to retrieve.
headers	object	Required	HTTP headers for the request
headers.Accept-Version	string	Required	Acknowledges the API preview status.

Input Example

{"parameters":{"index":0,"size":1},"path_parameters":{"alert_rrn":"14457f42-5f94-4125-aa6d-b3de4346f2bd"},"headers":{"Accept-Version":"strong-force-preview"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
evidences	array	Unique identifier
evidences.rrn	string	Unique identifier
evidences.version	number	Unique identifier
evidences.created_at	string	Unique identifier
evidences.updated_at	string	Unique identifier
evidences.evented_at	string	Unique identifier
evidences.external_source	string	Unique identifier
evidences.event_type	string	Unique identifier
evidences.data	string	Response data
metadata	object	Response data
metadata.index	number	Response data
metadata.size	number	Response data
metadata.items_in_index	number	Response data
metadata.total_items	number	Response data
metadata.is_last_index	boolean	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Fri, 21 Jun 2024 08:01:46 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","r7-correlation-id":"04bad1e4-ac8d-4645-adc2-9d4d3588cb80","vary":"accept-encoding, Origin","content-encoding":"gzip","x-envoy-upstream-service-time":"261","server":"istio-envoy","x-envoy-decorator-operation":"protonclass1apigatewayapp.default.svc.cluster.local:9873/*","Access-Control-Allow-Credentials":"true","Access-Control-Expo...

Run Saved Query

Execute a predefined saved query in Rapid7 InsightIDR using the provided 'saved_query_id' to retrieve relevant data.

Endpoint

URL: /log_search/query/saved_query/{{saved_query_id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.saved_query_id	string	Required	The ID of the saved query.
parameters.time_range	string	Optional	An alternative to the from and to query parameters. Possible values are "yesterday", "today" and "last x timeunits" where x is the number of time unit back from the current server time. Supported time units (case insensitive) are min(s) or minute(s), hr(s) or hour(s), day(s), week(s), month(s) and year(s). If "time_range" is used, then the "from" and "to" query parameters must not be used.
parameters.from	number	Optional	The start of the time range for the query, as a UNIX timestamp in milliseconds.
parameters.to	number	Optional	The end of the time range for the query, as a UNIX timestamp in milliseconds.
parameters.per_page	number	Optional	Number of log entries to return per page, up to 500(the maximum allowed).
parameters.kvp_info	boolean	Optional	When set to true, the events object that is returned will additionally contain information about all the key-value pairs in each returned log entry.
parameters.most_recent_first	boolean	Optional	When set to true, the query returns the most recent events first. When set to false, it returns the oldest events first.

Input Example

{"parameters":{"time_range":"last 6 months","from":1460557604000,"to":1460557604000,"per_page":50,"kvp_info":true,"most_recent_first":false},"path_parameters":{"saved_query_id":"00000000-0000-00cf-0000-000000000000"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
logs	array	Output field: logs
leql	object	Output field: leql
leql.statement	string	Output field: leql.statement
leql.during	object	Output field: leql.during
leql.during.from	number	Output field: leql.during.from
leql.during.to	number	Output field: leql.during.to
events	array	Output field: events
events.labels	array	Output field: events.labels
events.labels.links	array	Output field: events.labels.links
events.labels.links.rel	string	Output field: events.labels.links.rel
events.labels.links.href	string	Output field: events.labels.links.href
events.labels.id	string	Unique identifier
events.timestamp	number	Output field: events.timestamp
events.sequence_number	number	Output field: events.sequence_number
events.log_id	string	Unique identifier
events.message	string	Response message
events.links	array	Output field: events.links
events.links.rel	string	Output field: events.links.rel
events.links.href	string	Output field: events.links.href
events.sequence_number_str	number	Output field: events.sequence_number_str
events.kvp_info	array	Output field: events.kvp_info
events.kvp_info.key	object	Output field: events.kvp_info.key
events.kvp_info.key.text	string	Output field: events.kvp_info.key.text

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"logs":["565c1b7b-c08b-4c87-a42a-ab08bad56071"],"leql":{"statement":"where(931dde6c60>=800)","during":{}},"events":[{},{}]}}

Search Investigations

Perform a search for investigations in Rapid7 InsightIDR V2 using specified criteria and return matching results. Requires headers and path parameters.

Endpoint

URL: idr/v2/investigations/{{_search}}

Method: POST

Input

Argument Name	Type	Required	Description
parameters.index	number	Optional	Parameters for the Search Investigations action
parameters.multi-customer	boolean	Optional	Parameters for the Search Investigations action
parameters.size	number	Optional	Parameters for the Search Investigations action
headers	object	Required	HTTP headers for the request
headers.Accept-version	string	Required	HTTP headers for the request
path_parameters._search	string	Required	Parameters for the Search Investigations action
end_time	string	Optional	Time value
search	array	Optional	Parameter for Search Investigations
search.field	string	Optional	Parameter for Search Investigations
search.operator	string	Optional	Parameter for Search Investigations
search.value	object	Optional	Value for the parameter
sort	array	Optional	Parameter for Search Investigations
sort.field	string	Optional	Parameter for Search Investigations
sort.order	string	Optional	Parameter for Search Investigations
start_time	string	Optional	Time value
title	string	Optional	Parameter for Search Investigations

Input Example

{"parameters":{"index":0,"multi-customer":true,"size":20},"json_body":{"end_time":"2018-07-04T00:00:00Z","search":[{"field":"name","operator":"EQUALS","value":{}}],"sort":[{"field":"name","order":"ASC"}],"start_time":"2018-07-04T00:00:00Z","title":"start time"},"headers":{"Accept-version":"investigations-preview"},"path_parameters":{"_search":"search"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.assignee	object	Response data
data.assignee.email	string	Response data
data.assignee.name	string	Response data
data.created_time	string	Response data
data.disposition	string	Response data
data.first_alert_time	string	Response data
data.last_accessed	string	Response data
data.latest_alert_time	string	Response data
data.organization_id	string	Response data
data.priority	string	Response data
data.responsibility	string	Response data
data.rrn	string	Response data
data.source	string	Response data
data.status	string	Response data
data.tags	array	Response data
data.title	string	Response data
metadata	object	Response data
metadata.index	number	Response data
metadata.size	number	Response data
metadata.total_data	number	Response data
metadata.total_pages	number	Response data

Output Example

Set Disposition Investigation

Update the disposition of an investigation in Rapid7 InsightIDR using its ID and return the updated details. Requires path parameters: disposition and id.

Endpoint

URL: idr/v2/investigations/{{id}}/disposition/{{disposition}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.disposition	string	Required	Parameters for the Set Disposition Investigation action
path_parameters.id	string	Required	Parameters for the Set Disposition Investigation action
parameters.multi-customer	boolean	Optional	Parameters for the Set Disposition Investigation action
headers	object	Required	HTTP headers for the request
headers.Accept-version	string	Required	HTTP headers for the request

Input Example

{"parameters":{"multi-customer":false},"path_parameters":{"disposition":"BENIGN","id":"3726c3aa-a4d8-4be4-969d-ff2c156ddd78"},"headers":{"Accept-version":"investigations-preview"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
assignee	object	Output field: assignee
assignee.email	string	Output field: assignee.email
assignee.name	string	Name of the resource
created_time	string	Time value
disposition	string	Output field: disposition
first_alert_time	string	Time value
last_accessed	string	Output field: last_accessed
latest_alert_time	string	Time value
organization_id	string	Unique identifier
priority	string	Output field: priority
responsibility	string	Output field: responsibility
rrn	string	Output field: rrn
source	string	Output field: source
status	string	Status value
tags	array	Output field: tags
title	string	Output field: title

Output Example

Set Priority Investigation

Assign a priority level to a specific investigation in Rapid7 InsightIDR using the investigation's ID or RRN. Requires path parameters: ID and priority, along with headers.

Endpoint

URL: idr/v2/investigations/{{id}}/priority/{{priority}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Set Priority Investigation action
path_parameters.priority	string	Required	Parameters for the Set Priority Investigation action
parameters.multi-customer	boolean	Optional	Parameters for the Set Priority Investigation action
headers	object	Required	HTTP headers for the request
headers.Accept-version	string	Required	HTTP headers for the request

Input Example

{"parameters":{"multi-customer":false},"path_parameters":{"id":"3726c3aa-a4d8-4be4-969d-ff2c156ddd78","priority":"UNSPECIFIED"},"headers":{"Accept-version":"investigations-preview"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
assignee	object	Output field: assignee
assignee.email	string	Output field: assignee.email
assignee.name	string	Name of the resource
created_time	string	Time value
disposition	string	Output field: disposition
first_alert_time	string	Time value
last_accessed	string	Output field: last_accessed
latest_alert_time	string	Time value
organization_id	string	Unique identifier
priority	string	Output field: priority
responsibility	string	Output field: responsibility
rrn	string	Output field: rrn
source	string	Output field: source
status	string	Status value
tags	array	Output field: tags
title	string	Output field: title

Output Example

Set Status Investigation

Update the status of a specified investigation in Rapid7 InsightIDR V2 using its unique ID or RRN, requiring path parameters.

Endpoint

URL: idr/v2/investigations/{{id}}/status/{{status}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Set Status Investigation action
path_parameters.status	string	Required	Parameters for the Set Status Investigation action
parameters.multi-customer	boolean	Optional	Parameters for the Set Status Investigation action
headers	object	Required	HTTP headers for the request
headers.Accept-version	string	Required	HTTP headers for the request
disposition	string	Optional	Parameter for Set Status Investigation
threat_command_close_reason	string	Optional	Response reason phrase
threat_command_free_text	string	Optional	Parameter for Set Status Investigation

Input Example

{"parameters":{"multi-customer":false},"json_body":{"disposition":"BENIGN","threat_command_close_reason":"ProblemSolved","threat_command_free_text":"string"},"path_parameters":{"id":"3726c3aa-a4d8-4be4-969d-ff2c156ddd78","status":"INVESTIGATING"},"headers":{"Accept-version":"investigations-preview"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
assignee	object	Output field: assignee
assignee.email	string	Output field: assignee.email
assignee.name	string	Name of the resource
created_time	string	Time value
disposition	string	Output field: disposition
first_alert_time	string	Time value
last_accessed	string	Output field: last_accessed
latest_alert_time	string	Time value
organization_id	string	Unique identifier
priority	string	Output field: priority
responsibility	string	Output field: responsibility
rrn	string	Output field: rrn
source	string	Output field: source
status	string	Status value
tags	array	Output field: tags
title	string	Output field: title

Output Example

Update Investigation

Update specific fields of an investigation in Rapid7 InsightIDR using the provided ID or RRN, with required path parameters and headers.

Endpoint

URL: idr/v2/investigations/{{id}}

Method: PATCH

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Update Investigation action
parameters.multi-customer	boolean	Optional	Parameters for the Update Investigation action
headers	object	Required	HTTP headers for the request
headers.Accept-version	string	Required	HTTP headers for the request
assignee	object	Optional	Parameter for Update Investigation
assignee.email	string	Optional	Parameter for Update Investigation
disposition	string	Optional	Parameter for Update Investigation
priority	string	Optional	Parameter for Update Investigation
status	string	Optional	Status value
threat_command_close_reason	string	Optional	Response reason phrase
threat_command_free_text	string	Optional	Parameter for Update Investigation
title	string	Optional	Parameter for Update Investigation

Input Example

{"parameters":{"multi-customer":false},"json_body":{"assignee":{"email":"[email protected]"},"disposition":"BENIGN","priority":"CRITICAL","status":"OPEN","threat_command_close_reason":"ProblemSolved","threat_command_free_text":"string","title":"assignee"},"path_parameters":{"id":"9caa4d10-350d-4065-a0d6-99163abfebc7"},"headers":{"Accept-version":"investigations-preview"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
assignee	object	Output field: assignee
assignee.email	string	Output field: assignee.email
assignee.name	string	Name of the resource
created_time	string	Time value
disposition	string	Output field: disposition
first_alert_time	string	Time value
last_accessed	string	Output field: last_accessed
latest_alert_time	string	Time value
organization_id	string	Unique identifier
priority	string	Output field: priority
responsibility	string	Output field: responsibility
rrn	string	Output field: rrn
source	string	Output field: source
status	string	Status value
tags	array	Output field: tags
title	string	Output field: title

Output Example

Response Headers

Header	Description	Example
Access-Control-Allow-Credentials	HTTP response header: Access-Control-Allow-Credentials	true
Access-Control-Expose-Headers	HTTP response header: Access-Control-Expose-Headers	R7-Correlation-Id
Cache-Control	Directives for caching mechanisms	no-cache, no-store, max-age=0, must-revalidate
Connection	HTTP response header: Connection	keep-alive
content-encoding	HTTP response header: content-encoding	gzip
Content-Length	The length of the response body in bytes	180
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Wed, 19 Jul 2023 14:14:41 GMT
Expires	The date/time after which the response is considered stale	0
Location	The URL to redirect a page to	https://us3.api.insight.rapid7.com/log_search/query/saved_queries/00000000-0000-1618-0000-000000000000
Pragma	HTTP response header: Pragma	no-cache
R7-Correlation-Id	HTTP response header: R7-Correlation-Id	5d143985-8028-4204-a2f9-f18e1848b30b
RateLimit-Limit	HTTP response header: RateLimit-Limit	1500
RateLimit-Remaining	HTTP response header: RateLimit-Remaining	1497
RateLimit-Reset	HTTP response header: RateLimit-Reset	445
server	Information about the software used by the origin server	istio-envoy
Strict-Transport-Security	HTTP response header: Strict-Transport-Security	max-age=31536000; includeSubDomains
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
vary	HTTP response header: vary	Origin
X-Content-Type-Options	HTTP response header: X-Content-Type-Options	nosniff
x-envoy-decorator-operation	HTTP response header: x-envoy-decorator-operation	protonclass1apigatewayapp.default.svc.cluster.local:9873/*
x-envoy-upstream-service-time	HTTP response header: x-envoy-upstream-service-time	261
X-Frame-Options	HTTP response header: X-Frame-Options	DENY
X-RateLimit-Limit	The number of requests allowed in the current rate limit window	1500
X-RateLimit-Remaining	The number of requests remaining in the current rate limit window	1497
X-RateLimit-Reset	The time at which the current rate limit window resets	445
X-XSS-Protection	HTTP response header: X-XSS-Protection	1; mode=block