--- title: Rapid7 InsightIDR V2 slug: connectors/rapid7-insightidr-v2 docTags: createdAt: 2026-06-09T16:30:16.864Z --- Rapid7 InsightIDR is a SIEM solution that helps organizations detect, investigate, and respond to security threats. Rapid7 InsightIDR is a comprehensive security information and event management (SIEM) solution that provides advanced threat detection and response capabilities. This connector enables seamless integration with Swimlane Turbine, allowing users to automate incident response and streamline security operations. By leveraging this integration, users can efficiently manage investigations, execute saved queries, and retrieve alerts and evidence, enhancing their security posture and operational efficiency. ## Prerequisites Before you can use the Rapid7 InsightIDR V2 connector for Turbine, you'll need access to the Rapid7 InsightIDR API. This requires the following: - an API key authentication using the following parameters: - URL: The endpoint URL for accessing the Rapid7 InsightIDR API. - API Key: A valid API key for authenticating requests to the Rapid7 InsightIDR API. ## Capabilities This connector provides the following capabilities: - Assign User to Investigation - Bulk Close Investigations - Create a Saved Query - Create investigation - Delete a Saved Query - Get Investigation - Get Product List Alerts by Investigation - List Alerts Investigation - List All Saved Queries - List Investigations - Retrieve Evidence for Alert - Run Saved Query - Search investigations - Set Disposition Investigation - Set Priority Investigation *... and so on* ## Asset Setup Fill in the region parameter with the data center used for your account. To find the data center, log in to your insightIDR account, then look at the URL of the home page. The URL should look similar to this: [REGION](http://REGION.idr.insight.rapid7.com) indicates your data center. Enter that as the value in the region parameter. ## Actions Setup You need a threat key in order to use actions that manage threats. If you do not have a threat to use, follow the instructions here to create a new threat. For actions that take datetime inputs, you can use any standard datetime format. ## Notes - [All API documentation](https://docs.rapid7.com/insightidr/insightidr-rest-api/) ## Additional Documentation - [Rapid7 InsightIDR V2 Connector Documentation](https://docs.swimlane.com/connectors/rapid7-insightidr-v2) - [Rapid7 InsightIDR V2 API Documentation](https://docs.rapid7.com/insightidr/insightidr-rest-api/) - [Rapid7 InsightIDR V2 Authentication Guide](https://docs.swimlane.com/authentication-guides/rapid7-insightidr-v2) # Configurations ## API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | X-Api-Key | API key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Assign User to Investigation Assign a user to an investigation in Rapid7 InsightIDR V2 by specifying the investigation ID and user's email address. ### Endpoint - **URL:** `idr/v2/investigations/{{id}}/assignee` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------------------ | | `path_parameters.id` | string | Required | Parameters for the Assign User to Investigation action | | `parameters.multi-customer` | boolean | Optional | Parameters for the Assign User to Investigation action | | `headers` | object | Required | HTTP headers for the request | | `headers.Accept-version` | string | Required | HTTP headers for the request | | `user_email_address` | string | Optional | Parameter for Assign User to Investigation | ### Input Example `{"parameters":{"multi-customer":false},"json_body":{"user_email_address":"example@test.com"},"path_parameters":{"id":"3726c3aa-a4d8-4be4-969d-ff2c156ddd78"},"headers":{"Accept-version":"investigations-preview"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `assignee` | object | Output field: assignee | | `assignee.email` | string | Output field: assignee.email | | `assignee.name` | string | Name of the resource | | `created_time` | string | Time value | | `disposition` | string | Output field: disposition | | `first_alert_time` | string | Time value | | `last_accessed` | string | Output field: last\_accessed | | `latest_alert_time` | string | Time value | | `organization_id` | string | Unique identifier | | `priority` | string | Output field: priority | | `responsibility` | string | Output field: responsibility | | `rrn` | string | Output field: rrn | | `source` | string | Output field: source | | `status` | string | Status value | | `tags` | array | Output field: tags | | `title` | string | Output field: title | ### Output Example `{"assignee":{"email":"user@example.com","name":"Example Name"},"created_time":"string","disposition":"string","first_alert_time":"string","last_accessed":"string","latest_alert_time":"string","organization_id":"string","priority":"string","responsibility":"string","rrn":"string","source":"string","status":"active","tags":["string"],"title":"string"}` ## Bulk Close Investigations Close multiple investigations in Rapid7 InsightIDR within a specified date range. Requires 'from', 'source', and 'to' parameters. ### Endpoint - **URL:** `idr/v2/investigations/bulk_close` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | --------------------------------------- | | `headers` | object | Required | HTTP headers for the request | | `headers.Accept-version` | string | Required | HTTP headers for the request | | `alert_type` | string | Optional | Type of the resource | | `detection_rule_rrn` | string | Optional | Parameter for Bulk Close Investigations | | `disposition` | string | Optional | Parameter for Bulk Close Investigations | | `from` | string | Optional | Parameter for Bulk Close Investigations | | `max_investigations_to_close` | number | Optional | Parameter for Bulk Close Investigations | | `source` | string | Optional | Parameter for Bulk Close Investigations | | `to` | string | Optional | Parameter for Bulk Close Investigations | ### Input Example `{"json_body":{"alert_type":"Attacker Behavior Detected","detection_rule_rrn":"string","disposition":"BENIGN","from":"2023-07-19T03:21:57.980Z","max_investigations_to_close":10,"source":"MANUAL","to":"2023-07-20T03:21:57.980Z"},"headers":{"Accept-version":"investigations-preview"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `ids` | array | Unique identifier | | `num_closed` | number | Output field: num\_closed | ### Output Example `{"status_code":200,"response_headers":{},"reason":"","json_body":{"ids":["581134c9-2510-4010-865c-7ae81761315b","114c706d-e64a-4731-997b-9115beef3026"],"num_closed":2}}` ## Create a Saved Query Initiate the creation of a saved query in Rapid7 InsightIDR using provided 'saved\_query' details. ### Endpoint - **URL:** `/log_search/query/saved_queries` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `saved_query` | object | Optional | Parameter for Create a Saved Query | | `saved_query.name` | string | Required | The name for the Saved Query. | | `saved_query.leql` | object | Required | Parameter for Create a Saved Query | | `saved_query.leql.during` | object | Optional | Parameter for Create a Saved Query | | `saved_query.leql.during.from` | number | Optional | The start of the time range for the query, as a UNIX timestamp in milliseconds. | | `saved_query.leql.during.to` | number | Optional | The end of the time range for the query, as a UNIX timestamp in milliseconds. | | `saved_query.leql.during.time_range` | string | Optional | Relative time range (instead of absolute from + to time range). Possible values are "yesterday", "today" and "last x timeunits" where x is the number of time unit back from the current server time. Supported time units (case insensitive) are min(s) or minute(s), hr(s) or hour(s), day(s), week(s), month(s) and year(s). | | `saved_query.leql.statement` | string | Required | The LEQL query run against the log(s). If empty, the query retrieves all log entries in the specified time range. | | `saved_query.logs` | array | Optional | The log keys of the logs which the query is run against. | ### Input Example `{"json_body":{"saved_query":{"name":"saved-query-2","leql":{"statement":"where(test)"}}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `saved_query` | object | Output field: saved\_query | | `saved_query.id` | string | Unique identifier | | `saved_query.name` | string | Name of the resource | | `saved_query.leql` | object | Output field: saved\_query.leql | | `saved_query.leql.statement` | string | Output field: saved\_query.leql.statement | | `saved_query.leql.during` | object | Output field: saved\_query.leql.during | | `saved_query.leql.during.time_range` | object | Output field: saved\_query.leql.during.time\_range | | `saved_query.leql.during.to` | object | Output field: saved\_query.leql.during.to | | `saved_query.leql.during.from` | object | Output field: saved\_query.leql.during.from | | `saved_query.logs` | array | Output field: saved\_query.logs | ### Output Example `{"status_code":201,"response_headers":{"Date":"Fri, 21 Jun 2024 09:18:35 GMT","Content-Type":"application/json","Content-Length":"180","Connection":"keep-alive","Vary":"Origin, Accept-Encoding, Origin","Location":"https://us3.api.insight.rapid7.com/log_search/query/saved_queries/00000000-0000-...","Strict-Transport-Security":"max-age=31536000; includeSubDomains","R7-Correlation-Id":"3f4f3a96-4af9-4229-9303-30dd632beb93","Access-Control-Allow-Credentials":"true","Access-Control-Expose-Headers":"R...` ## Create Investigation Initiate a manual investigation in Rapid7 InsightIDR V2 using custom headers and JSON body data. ### Endpoint - **URL:** `idr/v2/investigations` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ---------------------------------- | | `headers` | object | Required | HTTP headers for the request | | `headers.Accept-version` | string | Required | HTTP headers for the request | | `assignee` | object | Optional | Parameter for Create Investigation | | `assignee.email` | string | Optional | Parameter for Create Investigation | | `disposition` | string | Optional | Parameter for Create Investigation | | `priority` | string | Optional | Parameter for Create Investigation | | `status` | string | Optional | Status value | | `title` | string | Optional | Parameter for Create Investigation | ### Input Example `{"json_body":{"assignee":{"email":"example@test.com"},"disposition":" BENIGN","priority":"LOW","status":"OPEN","title":"Jane Smith"},"headers":{"Accept-version":"investigations-preview"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `assignee` | object | Output field: assignee | | `assignee.email` | string | Output field: assignee.email | | `assignee.name` | string | Name of the resource | | `created_time` | string | Time value | | `disposition` | string | Output field: disposition | | `first_alert_time` | string | Time value | | `last_accessed` | string | Output field: last\_accessed | | `latest_alert_time` | string | Time value | | `organization_id` | string | Unique identifier | | `priority` | string | Output field: priority | | `responsibility` | string | Output field: responsibility | | `rrn` | string | Output field: rrn | | `source` | string | Output field: source | | `status` | string | Status value | | `tags` | array | Output field: tags | | `title` | string | Output field: title | ### Output Example `{"assignee":{"email":"user@example.com","name":"Example Name"},"created_time":"string","disposition":"string","first_alert_time":"string","last_accessed":"string","latest_alert_time":"string","organization_id":"string","priority":"string","responsibility":"string","rrn":"string","source":"string","status":"active","tags":["string"],"title":"string"}` ## Delete a Saved Query Remove a specified saved query from Rapid7 InsightIDR using the provided unique saved\_query\_id. ### Endpoint - **URL:** `/log_search/query/saved_queries/{{saved_query_id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | -------------------------- | | `path_parameters.saved_query_id` | string | Required | The ID of the saved query. | ### Input Example `{"path_parameters":{"saved_query_id":"00000000-0000-1616-0000-000000000000"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"status_code":204,"response_headers":{"Date":"Fri, 21 Jun 2024 09:07:47 GMT","Connection":"keep-alive","Vary":"Origin, Origin","Strict-Transport-Security":"max-age=31536000; includeSubDomains","R7-Correlation-Id":"5d143985-8028-4204-a2f9-f18e1848b30b","Access-Control-Allow-Credentials":"true","Access-Control-Expose-Headers":"R7-Correlation-Id","RateLimit-Limit":"1500","RateLimit-Reset":"445","RateLimit-Remaining":"1497","X-RateLimit-Limit":"1500","X-RateLimit-Reset":"445","X-RateLimit-Remaining...` ## Get Investigation Retrieve a specific investigation in Rapid7 InsightIDR V2 using the unique identifier (id) provided in path parameters. ### Endpoint - **URL:** `idr/v2/investigations/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Investigation action | | `parameters.multi-customer` | boolean | Optional | Parameters for the Get Investigation action | | `headers` | object | Required | HTTP headers for the request | | `headers.Accept-version` | string | Required | HTTP headers for the request | ### Input Example `{"parameters":{"multi-customer":false},"path_parameters":{"id":"3726c3aa-a4d8-4be4-969d-ff2c156ddd78"},"headers":{"Accept-version":"investigations-preview"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `assignee` | object | Output field: assignee | | `assignee.email` | string | Output field: assignee.email | | `assignee.name` | string | Name of the resource | | `created_time` | string | Time value | | `disposition` | string | Output field: disposition | | `first_alert_time` | string | Time value | | `last_accessed` | string | Output field: last\_accessed | | `latest_alert_time` | string | Time value | | `organization_id` | string | Unique identifier | | `priority` | string | Output field: priority | | `responsibility` | string | Output field: responsibility | | `rrn` | string | Output field: rrn | | `source` | string | Output field: source | | `status` | string | Status value | | `tags` | array | Output field: tags | | `title` | string | Output field: title | ### Output Example `{"assignee":{"email":"user@example.com","name":"Example Name"},"created_time":"string","disposition":"string","first_alert_time":"string","last_accessed":"string","latest_alert_time":"string","organization_id":"string","priority":"string","responsibility":"string","rrn":"string","source":"string","status":"active","tags":["string"],"title":"string"}` ## Get Product List Alerts by Investigation Retrieve all Rapid7 InsightIDR alerts associated with a given investigation identifier, using specified path parameters and headers. ### Endpoint - **URL:** `idr/v2/investigations/{{identifier}}/rapid7-product-alerts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------------------------------------------------ | | `path_parameters.identifier` | string | Required | Parameters for the Get Product List Alerts by Investigation action | | `parameters.multi-customer` | boolean | Optional | Parameters for the Get Product List Alerts by Investigation action | | `headers` | object | Required | HTTP headers for the request | | `headers.Accept-version` | string | Required | HTTP headers for the request | ### Input Example `{"parameters":{"multi-customer":false},"path_parameters":{"identifier":"3726c3aa-a4d8-4be4-969d-ff2c156ddd78"},"headers":{"Accept-version":"investigations-preview"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 25 Jul 2023 05:13:19 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Expires":"0","Pragma":"no-cache","X-Content-Type-Options":"nosniff","X-Frame-Options":"DENY","X-XSS-Protection":"1; mode=block","vary":"Origin","Access-Control-Allow-Credentials":"true"},"reason":"OK","json_body":[{"threat_command_details":{},"type":"THREAT_COMMAND"...` ## List Alerts Investigation Retrieve all alerts associated with a given investigation in Rapid7 InsightIDR V2 using the unique identifier and required path parameters. ### Endpoint - **URL:** `idr/v2/investigations/{{identifier}}/alerts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | --------------------------------------------------- | | `path_parameters.identifier` | string | Required | Parameters for the List Alerts Investigation action | | `parameters.index` | number | Optional | Parameters for the List Alerts Investigation action | | `parameters.multi-customer` | boolean | Optional | Parameters for the List Alerts Investigation action | | `parameters.size` | number | Optional | Parameters for the List Alerts Investigation action | | `headers` | object | Required | HTTP headers for the request | | `headers.Accept-version` | string | Required | HTTP headers for the request | ### Input Example `{"parameters":{"index":10,"multi-customer":false,"size":20},"path_parameters":{"identifier":"3726c3aa-a4d8-4be4-969d-ff2c156ddd78"},"headers":{"Accept-version":"investigations-preview"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `metadata` | object | Response data | | `metadata.index` | number | Response data | | `metadata.size` | number | Response data | | `metadata.total_pages` | number | Response data | | `metadata.total_data` | number | Response data | | `data` | array | Response data | | `data.alert_source` | string | Response data | | `data.alert_type` | string | Response data | | `data.alert_type_description` | string | Response data | | `data.created_time` | string | Response data | | `data.detection_rule_rrn` | object | Response data | | `data.detection_rule_rrn.rule_name` | string | Response data | | `data.detection_rule_rrn.rule_rrn` | string | Response data | | `data.first_event_time` | string | Response data | | `data.id` | string | Response data | | `data.latest_event_time` | string | Response data | | `data.title` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 25 Jul 2023 05:00:27 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Expires":"0","Pragma":"no-cache","X-Content-Type-Options":"nosniff","X-Frame-Options":"DENY","X-XSS-Protection":"1; mode=block","vary":"Origin","Access-Control-Allow-Credentials":"true"},"reason":"OK","json_body":{"data":[{}]},"metadata":{"index":10,"size":20,"total...` ## List All Saved Queries Retrieve all saved queries from Rapid7 InsightIDR for analysis or investigation purposes. ### Endpoint - **URL:** `/log_search/query/saved_queries` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | ---------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `saved_queries` | array | Output field: saved\_queries | | `saved_queries.id` | string | Unique identifier | | `saved_queries.name` | string | Name of the resource | | `saved_queries.leql` | object | Output field: saved\_queries.leql | | `saved_queries.leql.statement` | string | Output field: saved\_queries.leql.statement | | `saved_queries.leql.during` | object | Output field: saved\_queries.leql.during | | `saved_queries.leql.during.time_range` | object | Output field: saved\_queries.leql.during.time\_range | | `saved_queries.leql.during.to` | object | Output field: saved\_queries.leql.during.to | | `saved_queries.leql.during.from` | object | Output field: saved\_queries.leql.during.from | | `saved_queries.logs` | array | Output field: saved\_queries.logs | ### Output Example `{"status_code":200,"response_headers":{"Date":"Fri, 21 Jun 2024 09:00:13 GMT","Content-Type":"application/json","Content-Length":"191","Connection":"keep-alive","Vary":"Origin, Accept-Encoding, Origin","Strict-Transport-Security":"max-age=31536000; includeSubDomains","R7-Correlation-Id":"14f165c3-d476-45e3-a9f1-13df3a33426b","Access-Control-Allow-Credentials":"true","Access-Control-Expose-Headers":"R7-Correlation-Id","RateLimit-Limit":"1500","RateLimit-Reset":"900","RateLimit-Remaining":"1499","...` ## List Investigations Retrieve a paginated list of investigations from Rapid7 InsightIDR using specified request headers. ### Endpoint - **URL:** `idr/v2/investigations` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | --------------------------------------------- | | `parameters.assignee.email` | string | Optional | Parameters for the List Investigations action | | `parameters.end_time` | string | Optional | Parameters for the List Investigations action | | `parameters.index` | number | Optional | Parameters for the List Investigations action | | `parameters.multi-customer` | boolean | Optional | Parameters for the List Investigations action | | `parameters.priorities` | string | Optional | Parameters for the List Investigations action | | `parameters.size` | number | Optional | Parameters for the List Investigations action | | `parameters.sort` | string | Optional | Parameters for the List Investigations action | | `parameters.sources` | string | Optional | Parameters for the List Investigations action | | `parameters.start_time` | string | Optional | Parameters for the List Investigations action | | `parameters.statuses` | string | Optional | Parameters for the List Investigations action | | `parameters.tags` | string | Optional | Parameters for the List Investigations action | | `headers` | object | Required | HTTP headers for the request | | `headers.Accept-version` | string | Required | HTTP headers for the request | ### Input Example `{"parameters":{"assignee.email":"vemula.dilip@swimlane.com","end_time":"2018-07-04T00:00:00Z","index":10,"multi-customer":false,"priorities":"LOW","size":20,"sort":"priority,DESC","sources":"USER,ALERT","start_time":"2018-07-04T00:00:00Z","statuses":"OPEN","tags":"Incident"},"headers":{"Accept-version":"investigations-preview"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.assignee` | object | Response data | | `data.assignee.email` | string | Response data | | `data.assignee.name` | string | Response data | | `data.created_time` | string | Response data | | `data.disposition` | string | Response data | | `data.first_alert_time` | string | Response data | | `data.last_accessed` | string | Response data | | `data.latest_alert_time` | string | Response data | | `data.organization_id` | string | Response data | | `data.priority` | string | Response data | | `data.responsibility` | string | Response data | | `data.rrn` | string | Response data | | `data.source` | string | Response data | | `data.status` | string | Response data | | `data.tags` | array | Response data | | `data.title` | string | Response data | | `metadata` | object | Response data | | `metadata.index` | number | Response data | | `metadata.size` | number | Response data | | `metadata.total_data` | number | Response data | | `metadata.total_pages` | number | Response data | ### Output Example `{"data":[{"assignee":{},"created_time":"string","disposition":"string","first_alert_time":"string","last_accessed":"string","latest_alert_time":"string","organization_id":"string","priority":"string","responsibility":"string","rrn":"string","source":"string","status":"active","tags":[],"title":"string"}],"metadata":{"index":123,"size":123,"total_data":123,"total_pages":123}}` ## Retrieve Evidence for Alert Retrieve associated evidence for a specific alert in Rapid7 InsightIDR using the alert's unique resource name (RRN). ### Endpoint - **URL:** `/idr/at/alerts/{{alert_rrn}}/evidences` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------------- | | `path_parameters.alert_rrn` | string | Required | The unique identifier of the alert. | | `parameters.index` | number | Optional | The index of the page to retrieve (zero-indexed). | | `parameters.size` | number | Optional | The size of the page to retrieve. | | `headers` | object | Required | HTTP headers for the request | | `headers.Accept-Version` | string | Required | Acknowledges the API preview status. | ### Input Example `{"parameters":{"index":0,"size":1},"path_parameters":{"alert_rrn":"14457f42-5f94-4125-aa6d-b3de4346f2bd"},"headers":{"Accept-Version":"strong-force-preview"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `evidences` | array | Unique identifier | | `evidences.rrn` | string | Unique identifier | | `evidences.version` | number | Unique identifier | | `evidences.created_at` | string | Unique identifier | | `evidences.updated_at` | string | Unique identifier | | `evidences.evented_at` | string | Unique identifier | | `evidences.external_source` | string | Unique identifier | | `evidences.event_type` | string | Unique identifier | | `evidences.data` | string | Response data | | `metadata` | object | Response data | | `metadata.index` | number | Response data | | `metadata.size` | number | Response data | | `metadata.items_in_index` | number | Response data | | `metadata.total_items` | number | Response data | | `metadata.is_last_index` | boolean | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Fri, 21 Jun 2024 08:01:46 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","r7-correlation-id":"04bad1e4-ac8d-4645-adc2-9d4d3588cb80","vary":"accept-encoding, Origin","content-encoding":"gzip","x-envoy-upstream-service-time":"261","server":"istio-envoy","x-envoy-decorator-operation":"protonclass1apigatewayapp.default.svc.cluster.local:9873/*","Access-Control-Allow-Credentials":"true","Access-Control-Expo...` ## Run Saved Query Execute a predefined saved query in Rapid7 InsightIDR using the provided 'saved\_query\_id' to retrieve relevant data. ### Endpoint - **URL:** `/log_search/query/saved_query/{{saved_query_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.saved_query_id` | string | Required | The ID of the saved query. | | `parameters.time_range` | string | Optional | An alternative to the from and to query parameters. Possible values are "yesterday", "today" and "last x timeunits" where x is the number of time unit back from the current server time. Supported time units (case insensitive) are min(s) or minute(s), hr(s) or hour(s), day(s), week(s), month(s) and year(s). If "time\_range" is used, then the "from" and "to" query parameters must not be used. | | `parameters.from` | number | Optional | The start of the time range for the query, as a UNIX timestamp in milliseconds. | | `parameters.to` | number | Optional | The end of the time range for the query, as a UNIX timestamp in milliseconds. | | `parameters.per_page` | number | Optional | Number of log entries to return per page, up to 500(the maximum allowed). | | `parameters.kvp_info` | boolean | Optional | When set to true, the events object that is returned will additionally contain information about all the key-value pairs in each returned log entry. | | `parameters.most_recent_first` | boolean | Optional | When set to true, the query returns the most recent events first. When set to false, it returns the oldest events first. | ### Input Example `{"parameters":{"time_range":"last 6 months","from":1460557604000,"to":1460557604000,"per_page":50,"kvp_info":true,"most_recent_first":false},"path_parameters":{"saved_query_id":"00000000-0000-00cf-0000-000000000000"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `logs` | array | Output field: logs | | `leql` | object | Output field: leql | | `leql.statement` | string | Output field: leql.statement | | `leql.during` | object | Output field: leql.during | | `leql.during.from` | number | Output field: leql.during.from | | `leql.during.to` | number | Output field: leql.during.to | | `events` | array | Output field: events | | `events.labels` | array | Output field: events.labels | | `events.labels.links` | array | Output field: events.labels.links | | `events.labels.links.rel` | string | Output field: events.labels.links.rel | | `events.labels.links.href` | string | Output field: events.labels.links.href | | `events.labels.id` | string | Unique identifier | | `events.timestamp` | number | Output field: events.timestamp | | `events.sequence_number` | number | Output field: events.sequence\_number | | `events.log_id` | string | Unique identifier | | `events.message` | string | Response message | | `events.links` | array | Output field: events.links | | `events.links.rel` | string | Output field: events.links.rel | | `events.links.href` | string | Output field: events.links.href | | `events.sequence_number_str` | number | Output field: events.sequence\_number\_str | | `events.kvp_info` | array | Output field: events.kvp\_info | | `events.kvp_info.key` | object | Output field: events.kvp\_info.key | | `events.kvp_info.key.text` | string | Output field: events.kvp\_info.key.text | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"logs":["565c1b7b-c08b-4c87-a42a-ab08bad56071"],"leql":{"statement":"where(931dde6c60>=800)","during":{}},"events":[{},{}]}}` ## Search Investigations Perform a search for investigations in Rapid7 InsightIDR V2 using specified criteria and return matching results. Requires headers and path parameters. ### Endpoint - **URL:** `idr/v2/investigations/{{_search}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ----------------------------------------------- | | `parameters.index` | number | Optional | Parameters for the Search Investigations action | | `parameters.multi-customer` | boolean | Optional | Parameters for the Search Investigations action | | `parameters.size` | number | Optional | Parameters for the Search Investigations action | | `headers` | object | Required | HTTP headers for the request | | `headers.Accept-version` | string | Required | HTTP headers for the request | | `path_parameters._search` | string | Required | Parameters for the Search Investigations action | | `end_time` | string | Optional | Time value | | `search` | array | Optional | Parameter for Search Investigations | | `search.field` | string | Optional | Parameter for Search Investigations | | `search.operator` | string | Optional | Parameter for Search Investigations | | `search.value` | object | Optional | Value for the parameter | | `sort` | array | Optional | Parameter for Search Investigations | | `sort.field` | string | Optional | Parameter for Search Investigations | | `sort.order` | string | Optional | Parameter for Search Investigations | | `start_time` | string | Optional | Time value | | `title` | string | Optional | Parameter for Search Investigations | ### Input Example `{"parameters":{"index":0,"multi-customer":true,"size":20},"json_body":{"end_time":"2018-07-04T00:00:00Z","search":[{"field":"name","operator":"EQUALS","value":{}}],"sort":[{"field":"name","order":"ASC"}],"start_time":"2018-07-04T00:00:00Z","title":"start time"},"headers":{"Accept-version":"investigations-preview"},"path_parameters":{"_search":"search"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.assignee` | object | Response data | | `data.assignee.email` | string | Response data | | `data.assignee.name` | string | Response data | | `data.created_time` | string | Response data | | `data.disposition` | string | Response data | | `data.first_alert_time` | string | Response data | | `data.last_accessed` | string | Response data | | `data.latest_alert_time` | string | Response data | | `data.organization_id` | string | Response data | | `data.priority` | string | Response data | | `data.responsibility` | string | Response data | | `data.rrn` | string | Response data | | `data.source` | string | Response data | | `data.status` | string | Response data | | `data.tags` | array | Response data | | `data.title` | string | Response data | | `metadata` | object | Response data | | `metadata.index` | number | Response data | | `metadata.size` | number | Response data | | `metadata.total_data` | number | Response data | | `metadata.total_pages` | number | Response data | ### Output Example `{"data":[{"assignee":{},"created_time":"string","disposition":"string","first_alert_time":"string","last_accessed":"string","latest_alert_time":"string","organization_id":"string","priority":"string","responsibility":"string","rrn":"string","source":"string","status":"active","tags":[],"title":"string"}],"metadata":{"index":123,"size":123,"total_data":123,"total_pages":123}}` ## Set Disposition Investigation Update the disposition of an investigation in Rapid7 InsightIDR using its ID and return the updated details. Requires path parameters: disposition and id. ### Endpoint - **URL:** `idr/v2/investigations/{{id}}/disposition/{{disposition}}` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | ------------------------------------------------------- | | `path_parameters.disposition` | string | Required | Parameters for the Set Disposition Investigation action | | `path_parameters.id` | string | Required | Parameters for the Set Disposition Investigation action | | `parameters.multi-customer` | boolean | Optional | Parameters for the Set Disposition Investigation action | | `headers` | object | Required | HTTP headers for the request | | `headers.Accept-version` | string | Required | HTTP headers for the request | ### Input Example `{"parameters":{"multi-customer":false},"path_parameters":{"disposition":"BENIGN","id":"3726c3aa-a4d8-4be4-969d-ff2c156ddd78"},"headers":{"Accept-version":"investigations-preview"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `assignee` | object | Output field: assignee | | `assignee.email` | string | Output field: assignee.email | | `assignee.name` | string | Name of the resource | | `created_time` | string | Time value | | `disposition` | string | Output field: disposition | | `first_alert_time` | string | Time value | | `last_accessed` | string | Output field: last\_accessed | | `latest_alert_time` | string | Time value | | `organization_id` | string | Unique identifier | | `priority` | string | Output field: priority | | `responsibility` | string | Output field: responsibility | | `rrn` | string | Output field: rrn | | `source` | string | Output field: source | | `status` | string | Status value | | `tags` | array | Output field: tags | | `title` | string | Output field: title | ### Output Example `{"assignee":{"email":"user@example.com","name":"Example Name"},"created_time":"string","disposition":"string","first_alert_time":"string","last_accessed":"string","latest_alert_time":"string","organization_id":"string","priority":"string","responsibility":"string","rrn":"string","source":"string","status":"active","tags":["string"],"title":"string"}` ## Set Priority Investigation Assign a priority level to a specific investigation in Rapid7 InsightIDR using the investigation's ID or RRN. Requires path parameters: ID and priority, along with headers. ### Endpoint - **URL:** `idr/v2/investigations/{{id}}/priority/{{priority}}` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ---------------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Set Priority Investigation action | | `path_parameters.priority` | string | Required | Parameters for the Set Priority Investigation action | | `parameters.multi-customer` | boolean | Optional | Parameters for the Set Priority Investigation action | | `headers` | object | Required | HTTP headers for the request | | `headers.Accept-version` | string | Required | HTTP headers for the request | ### Input Example `{"parameters":{"multi-customer":false},"path_parameters":{"id":"3726c3aa-a4d8-4be4-969d-ff2c156ddd78","priority":"UNSPECIFIED"},"headers":{"Accept-version":"investigations-preview"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `assignee` | object | Output field: assignee | | `assignee.email` | string | Output field: assignee.email | | `assignee.name` | string | Name of the resource | | `created_time` | string | Time value | | `disposition` | string | Output field: disposition | | `first_alert_time` | string | Time value | | `last_accessed` | string | Output field: last\_accessed | | `latest_alert_time` | string | Time value | | `organization_id` | string | Unique identifier | | `priority` | string | Output field: priority | | `responsibility` | string | Output field: responsibility | | `rrn` | string | Output field: rrn | | `source` | string | Output field: source | | `status` | string | Status value | | `tags` | array | Output field: tags | | `title` | string | Output field: title | ### Output Example `{"assignee":{"email":"user@example.com","name":"Example Name"},"created_time":"string","disposition":"string","first_alert_time":"string","last_accessed":"string","latest_alert_time":"string","organization_id":"string","priority":"string","responsibility":"string","rrn":"string","source":"string","status":"active","tags":["string"],"title":"string"}` ## Set Status Investigation Update the status of a specified investigation in Rapid7 InsightIDR V2 using its unique ID or RRN, requiring path parameters. ### Endpoint - **URL:** `idr/v2/investigations/{{id}}/status/{{status}}` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | -------------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Set Status Investigation action | | `path_parameters.status` | string | Required | Parameters for the Set Status Investigation action | | `parameters.multi-customer` | boolean | Optional | Parameters for the Set Status Investigation action | | `headers` | object | Required | HTTP headers for the request | | `headers.Accept-version` | string | Required | HTTP headers for the request | | `disposition` | string | Optional | Parameter for Set Status Investigation | | `threat_command_close_reason` | string | Optional | Response reason phrase | | `threat_command_free_text` | string | Optional | Parameter for Set Status Investigation | ### Input Example `{"parameters":{"multi-customer":false},"json_body":{"disposition":"BENIGN","threat_command_close_reason":"ProblemSolved","threat_command_free_text":"string"},"path_parameters":{"id":"3726c3aa-a4d8-4be4-969d-ff2c156ddd78","status":"INVESTIGATING"},"headers":{"Accept-version":"investigations-preview"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `assignee` | object | Output field: assignee | | `assignee.email` | string | Output field: assignee.email | | `assignee.name` | string | Name of the resource | | `created_time` | string | Time value | | `disposition` | string | Output field: disposition | | `first_alert_time` | string | Time value | | `last_accessed` | string | Output field: last\_accessed | | `latest_alert_time` | string | Time value | | `organization_id` | string | Unique identifier | | `priority` | string | Output field: priority | | `responsibility` | string | Output field: responsibility | | `rrn` | string | Output field: rrn | | `source` | string | Output field: source | | `status` | string | Status value | | `tags` | array | Output field: tags | | `title` | string | Output field: title | ### Output Example `{"assignee":{"email":"user@example.com","name":"Example Name"},"created_time":"string","disposition":"string","first_alert_time":"string","last_accessed":"string","latest_alert_time":"string","organization_id":"string","priority":"string","responsibility":"string","rrn":"string","source":"string","status":"active","tags":["string"],"title":"string"}` ## Update Investigation Update specific fields of an investigation in Rapid7 InsightIDR using the provided ID or RRN, with required path parameters and headers. ### Endpoint - **URL:** `idr/v2/investigations/{{id}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | ---------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Update Investigation action | | `parameters.multi-customer` | boolean | Optional | Parameters for the Update Investigation action | | `headers` | object | Required | HTTP headers for the request | | `headers.Accept-version` | string | Required | HTTP headers for the request | | `assignee` | object | Optional | Parameter for Update Investigation | | `assignee.email` | string | Optional | Parameter for Update Investigation | | `disposition` | string | Optional | Parameter for Update Investigation | | `priority` | string | Optional | Parameter for Update Investigation | | `status` | string | Optional | Status value | | `threat_command_close_reason` | string | Optional | Response reason phrase | | `threat_command_free_text` | string | Optional | Parameter for Update Investigation | | `title` | string | Optional | Parameter for Update Investigation | ### Input Example `{"parameters":{"multi-customer":false},"json_body":{"assignee":{"email":"example@test.com"},"disposition":"BENIGN","priority":"CRITICAL","status":"OPEN","threat_command_close_reason":"ProblemSolved","threat_command_free_text":"string","title":"assignee"},"path_parameters":{"id":"9caa4d10-350d-4065-a0d6-99163abfebc7"},"headers":{"Accept-version":"investigations-preview"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `assignee` | object | Output field: assignee | | `assignee.email` | string | Output field: assignee.email | | `assignee.name` | string | Name of the resource | | `created_time` | string | Time value | | `disposition` | string | Output field: disposition | | `first_alert_time` | string | Time value | | `last_accessed` | string | Output field: last\_accessed | | `latest_alert_time` | string | Time value | | `organization_id` | string | Unique identifier | | `priority` | string | Output field: priority | | `responsibility` | string | Output field: responsibility | | `rrn` | string | Output field: rrn | | `source` | string | Output field: source | | `status` | string | Status value | | `tags` | array | Output field: tags | | `title` | string | Output field: title | ### Output Example `{"assignee":{"email":"user@example.com","name":"Example Name"},"created_time":"string","disposition":"string","first_alert_time":"string","last_accessed":"string","latest_alert_time":"string","organization_id":"string","priority":"string","responsibility":"string","rrn":"string","source":"string","status":"active","tags":["string"],"title":"string"}` # Response Headers | **Header** | **Description** | **Example** | | -------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Access-Control-Allow-Credentials | HTTP response header: Access-Control-Allow-Credentials | true | | Access-Control-Expose-Headers | HTTP response header: Access-Control-Expose-Headers | R7-Correlation-Id | | Cache-Control | Directives for caching mechanisms | no-cache, no-store, max-age=0, must-revalidate | | Connection | HTTP response header: Connection | keep-alive | | content-encoding | HTTP response header: content-encoding | gzip | | Content-Length | The length of the response body in bytes | 180 | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Wed, 19 Jul 2023 14:14:41 GMT | | Expires | The date/time after which the response is considered stale | 0 | | Location | The URL to redirect a page to | [https://us3.api.insight.rapid7.com/log\_search/query/saved\_queries/00000000-0000-1618-0000-000000000000](https://us3.api.insight.rapid7.com/log_search/query/saved_queries/00000000-0000-1618-0000-000000000000) | | Pragma | HTTP response header: Pragma | no-cache | | R7-Correlation-Id | HTTP response header: R7-Correlation-Id | 5d143985-8028-4204-a2f9-f18e1848b30b | | RateLimit-Limit | HTTP response header: RateLimit-Limit | 1500 | | RateLimit-Remaining | HTTP response header: RateLimit-Remaining | 1497 | | RateLimit-Reset | HTTP response header: RateLimit-Reset | 445 | | server | Information about the software used by the origin server | istio-envoy | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000; includeSubDomains | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | vary | HTTP response header: vary | Origin | | X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff | | x-envoy-decorator-operation | HTTP response header: x-envoy-decorator-operation | protonclass1apigatewayapp.default.svc.cluster.local:9873/\* | | x-envoy-upstream-service-time | HTTP response header: x-envoy-upstream-service-time | 261 | | X-Frame-Options | HTTP response header: X-Frame-Options | DENY | | X-RateLimit-Limit | The number of requests allowed in the current rate limit window | 1500 | | X-RateLimit-Remaining | The number of requests remaining in the current rate limit window | 1497 | | X-RateLimit-Reset | The time at which the current rate limit window resets | 445 | | X-XSS-Protection | HTTP response header: X-XSS-Protection | 1; mode=block |