Rapid7 InsightIDR
Rapid7’s InsightIDR is your security center for incident detection and response, authentication monitoring, and endpoint visibility. Together, these form Extended Detection and Response (XDR). InsightIDR identifies unauthorized access from external and internal threats and highlights suspicious activity so you don’t have to weed through thousands of data streams.
- Category
- Analytics & SIEM
- Pack
- Rapid7_InsightIDR
Configuration parameters
- region — Insight cloud server region (required)
- apiKey — InsightIDR API key
- apikey_creds —
- isFetch — Fetch incidents
- incidentType — Incident type
- incidentFetchInterval — Incidents Fetch Interval
- first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
- max_fetch — Fetch Limit
- is_multi_customer — Multi customer
- is_v2 — Use API Version 2 by default
- insecure — Trust any certificate (not secure)
- proxy — Use system proxy settings
Commands (18)
- rapid7-insight-idr-add-threat-indicators — Adds new indicators to a threat (IP addresses, hashes, domains, and URLs).
- rapid7-insight-idr-assign-user — Assign a user by email to an investigation. Users will receive an email whenever they are assigned to a new investigation.
- rapid7-insight-idr-close-investigations — Close all investigations that match the provided request parameters. If there are any investigations found associated with Threat Command alerts within the given request parameters, they will be closed in Threat Command with the close reason, "Other".
- rapid7-insight-idr-create-investigation — Create a new investigation manually.
- rapid7-insight-idr-download-logs — Downloads logs from your InsightsIDR instance. The maximum number of logs per call is 10.
- rapid7-insight-idr-get-investigation — Get a specific investigation. This investigation is specified by either ID or Rapid7 Resource Names (RRN). (If multi-customer is set to true, the investigation_id must be in the RRN format).
- rapid7-insight-idr-list-investigation-alerts — Retrieve and list all alerts associated with an investigation, with the given ID or Rapid7 Resource Names (RRN). The listed alerts are sorted in descending order by alert create time. Use rapid7-insight-idr-list-investigations to retrieve all investigation IDs.
- rapid7-insight-idr-list-investigation-product-alerts — Retrieve and list all Rapid7 product alerts associated with an investigation, with the given ID or the Rapid7 Resource Names. These alerts are generated by Rapid7 products other than InsightIDR that you have an active license for.
- rapid7-insight-idr-list-investigations — List all investigations. Retrieve a list of investigations matching the given request parameters. The investigations are sorted by investigation created_time in descending order. Investigations are an aggregate of the applicable alert data in a single place and are closely tied to Alerts and Detection Rules.
- rapid7-insight-idr-list-log-sets — Lists all existing log sets for your InsightsIDR instance.
- rapid7-insight-idr-list-logs — Lists all existing logs for an account.
- rapid7-insight-idr-list-users — List all users matching the given search/sort criteria or retrieve a user with the given RRN.
- rapid7-insight-idr-query-log — Queries within a log for certain values.
- rapid7-insight-idr-query-log-set — Queries within a log set for certain values.
- rapid7-insight-idr-replace-threat-indicators — Deletes existing indicators from a threat and adds new indicators to the threat.
- rapid7-insight-idr-search-investigation — Search for investigations matching the given search/sort criteria.
- rapid7-insight-idr-set-status — Set the status of the investigation, which is specified by ID or Rapid7 Resource Names.
- rapid7-insight-idr-update-investigation — Updates multiple fields in a single operation for an investigation, specified by ID or Rapid7 Resource Names (RRN). (If multi-customer set to true, the investigation_id must be in the RRN format). Use rapid7-insight-idr-list-investigations to retrieve all investigation IDs.