Rapid7 InsightIDR

Rapid7’s InsightIDR is your security center for incident detection and response, authentication monitoring, and endpoint visibility. Together, these form Extended Detection and Response (XDR). InsightIDR identifies unauthorized access from external and internal threats and highlights suspicious activity so you don’t have to weed through thousands of data streams.

Analytics & SIEM · Rapid7 InsightIDR

Configuration parameters

  • region — Insight cloud server region (required)
  • apiKey — InsightIDR API key
  • apikey_creds —
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • max_fetch — Fetch Limit
  • is_multi_customer — Multi customer
  • is_v2 — Use API Version 2 by default
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (18)

  • rapid7-insight-idr-add-threat-indicators

    Adds new indicators to a threat (IP addresses, hashes, domains, and URLs).

  • rapid7-insight-idr-assign-user

    Assign a user by email to an investigation. Users will receive an email whenever they are assigned to a new investigation.

  • rapid7-insight-idr-close-investigations

    Close all investigations that match the provided request parameters. If there are any investigations found associated with Threat Command alerts within the given request parameters, they will be closed in Threat Command with the close reason, "Other".

  • rapid7-insight-idr-create-investigation

    Create a new investigation manually.

  • rapid7-insight-idr-download-logs

    Downloads logs from your InsightsIDR instance. The maximum number of logs per call is 10.

  • rapid7-insight-idr-get-investigation

    Get a specific investigation. This investigation is specified by either ID or Rapid7 Resource Names (RRN). (If multi-customer is set to true, the investigation_id must be in the RRN format).

  • rapid7-insight-idr-list-investigation-alerts

    Retrieve and list all alerts associated with an investigation, with the given ID or Rapid7 Resource Names (RRN). The listed alerts are sorted in descending order by alert create time. Use rapid7-insight-idr-list-investigations to retrieve all investigation IDs.

  • rapid7-insight-idr-list-investigation-product-alerts

    Retrieve and list all Rapid7 product alerts associated with an investigation, with the given ID or the Rapid7 Resource Names. These alerts are generated by Rapid7 products other than InsightIDR that you have an active license for.

  • rapid7-insight-idr-list-investigations

    List all investigations. Retrieve a list of investigations matching the given request parameters. The investigations are sorted by investigation created_time in descending order. Investigations are an aggregate of the applicable alert data in a single place and are closely tied to Alerts and Detection Rules.

  • rapid7-insight-idr-list-log-sets

    Lists all existing log sets for your InsightsIDR instance.

  • rapid7-insight-idr-list-logs

    Lists all existing logs for an account.

  • rapid7-insight-idr-list-users

    List all users matching the given search/sort criteria or retrieve a user with the given RRN.

  • rapid7-insight-idr-query-log

    Queries within a log for certain values.

  • rapid7-insight-idr-query-log-set

    Queries within a log set for certain values.

  • rapid7-insight-idr-replace-threat-indicators

    Deletes existing indicators from a threat and adds new indicators to the threat.

  • rapid7-insight-idr-search-investigation

    Search for investigations matching the given search/sort criteria.

  • rapid7-insight-idr-set-status

    Set the status of the investigation, which is specified by ID or Rapid7 Resource Names.

  • rapid7-insight-idr-update-investigation

    Updates multiple fields in a single operation for an investigation, specified by ID or Rapid7 Resource Names (RRN). (If multi-customer set to true, the investigation_id must be in the RRN format). Use rapid7-insight-idr-list-investigations to retrieve all investigation IDs.