SIEM (InsightIDR) REST API
Copy link

Here, you can view the APIs that are available in SIEM (InsightIDR), along with their capabilities. For all other Rapid7 APIs, view the Insight Platform API overview.

Accounts & Users
Copy link

The Accounts and Users API allows you to search for and find SIEM (InsightIDR) accounts. A user is a container with all the associated account information from SIEM (InsightIDR). An account is what that user logs into, such as Active Directory or an Office 365 user token.

Capabilities

Alerts
Copy link

If you’re a Managed Detection and Response customer with access to the Alerts experience, the Alerts API allows you to search, view, and modify existing alerts. Read more about alerts.

Capabilities:

Assets
Copy link

The Assets API allows you to find and search SIEM (InsightIDR) assets. An asset is a single device that is connected to your network or under your management, such as a server, laptop, or virtual machine. When you feed data to SIEM (InsightIDR), you are able to see a variety of metrics about your assets, such as data collection issues, the number of assets monitored with the Insight Agent, restricted assets, and unique processes that are happening on assets.

Capabilities

Attachments
Copy link

The Attachments API allows you to upload, list, download, and delete attachments.

Capabilities

Audit
Copy link

The Audit API allows you to track and record activity for investigative purposes.

Comments
Copy link

The Comments APIs allows you to create, list, and delete comments.

Capabilities

Community Threats
Copy link

These threat APIs allow you to add or replace indicators for Community Threats.

Capabilities

Detection Rules
Copy link

The Detection Rules REST API allows you to programmatically perform the actions available in the SIEM (InsightIDR) Detection Rules UI. Read more about Detection Rules.

Investigations
Copy link

The Investigations APIs allows you to view any existing investigations, modify or close investigations, and set the investigation status.

With Version 1 of the API, you can pull data from SIEM (InsightIDR) investigations into your preferred security and case tracking tools. The API can be used to:

  • Retrieve a list of investigations
  • Close investigations in bulk
  • Assign a user to an investigation
  • Set the status of an investigation

In addition to all of the tasks you can perform with Version 1 of the API, Version 2 can be used to:

  • Create investigations
  • Search investigations
  • List alerts associated with the specified investigation
  • Update an investigation
  • Set the disposition
  • Set the status or set the priority
  • Get a list of Rapid7 product alerts associated with the specified investigation

Version 2
Copy link

Capabilities

Version 1
Copy link

Capabilities

The Log Search REST API allows you to perform the majority of the actions available through the IDR Log Search UI, and has some additional functionality that is not available through the UI. You may use this API to automate common tasks (for example, via shell scripts), and to generally interact with Log Management (InsightOps) programmatically.