InsightIDR REST API

Here, you can view the APIs that are available in InsightIDR, along with their capabilities. For all other Rapid7 APIs, view the Insight Platform API overview.

Accounts & Users

The Accounts and Users API allows you to search for and find InsightIDR accounts. A user is a container with all the associated account information from InsightIDR. An account is what that user logs into, such as Active Directory or an Office 365 user token.

Capabilities

• Search Account
  
• Get Account by RRN
  
• Search Local Accounts
  
• Get Local Account by RRN
  
• Search Users
  
• Get User by RRN

Assets

The Assets API allows you to find and search InsightIDR assets. An asset is a single device that is connected to your network or under your management, such as a server, laptop, or virtual machine. When you feed data to InsightIDR, you are able to see a variety of metrics about your assets, such as data collection issues, the number of assets monitored with the Insight Agent, restricted assets, and unique processes that are happening on assets.

Capabilities

• Search Assets
  
• Get Asset by RRN

Attachments

The Attachments API allows you to upload, list, download, and delete attachments.

Capabilities

• List attachments
  
• Upload attachment
  
• Download attachment
  
• Delete an attachment
  
• Get attachment information

Comments

The Comments APIs allows you to create, list, and delete comments.

Capabilities

• List comments
  
• Create comment
  
• Delete a comment

Community Threats

These threat APIs allow you to add or replace indicators for Community Threats.

Capabilities

• Create a Community Threat
  
• Delete a Community Threat
  
• Add indicators to a Community Threat
  
• Replace indicators for a Community Threat

Investigations

The Investigations APIs allows you to view any existing investigations, modify or close investigations, and set the investigation status.

With Version 1 of the API, you can pull data from InsightIDR investigations into your preferred security and case tracking tools. The API can be used to:

• Retrieve a list of investigations
• Close investigations in bulk
• Assign a user to an investigation
• Set the status of an investigation

In addition to all of the tasks you can perform with Version 1 of the API, Version 2 can be used to:

• Create investigations
• Search investigations
• List alerts associated with the specified investigation
• Update an investigation
• Set the disposition
• Set the status or set the priority
• Get a list of Rapid7 product alerts associated with the specified investigation

Version 2 (Open Preview)

Capabilities

• List investigation
  
• Create investigation
  
• Search for investigations
  
• Close investigations in bulk
  
• List alerts associated with the specified investigation
  
• Get a list of Rapid7 product alerts associated with the specified investigation
  
• Get investigation
  
• Update investigation
  
• Assign user to investigation
  
• Set the disposition of an investigation
  
• Set the priority of an investigation
  
• Set the status of an investigation

Version 1

Capabilities

• List investigation
  
• Close investigations in bulk
  
• Assign user to investigation
  
• Set the status of an investigation

Log Search API

The Log Search REST API allows you to perform the majority of the actions available through the IDR Log Search UI, and has some additional functionality that is not available through the UI. You may use this API to automate common tasks (for example, via shell scripts), and to generally interact with InsightOps programmatically.

• Query Log Data
• Saved Queries
• Pre-Computed Queries
• Manage Logs
• Manage Logsets
• Manage Custom Alerts
• Manage Custom Alert Notification Settings
• Manage Custom Alert Notification Targets
• Basic Detection Rule Labels
• Manage LEQL Variables
• Download Log Data
• Export Log Data To CSV
• Explore The Size of Your Log Data
• Backup Your Log Data To S3
• Retrieve The Most Common Keys Within Your Log Data