InsightIDR REST API
Here, you can view the APIs that are available in InsightIDR, along with their capabilities. For all other Rapid7 APIs, view the Insight Platform API overview.
Accounts & Users
The Accounts and Users API allows you to search for and find InsightIDR accounts. A user is a container with all the associated account information from InsightIDR. An account is what that user logs into, such as Active Directory or an Office 365 user token.
Capabilities
- Search Account
- Get Account by RRN
- Search Local Accounts
- Get Local Account by RRN
- Search Users
- Get User by RRN
Assets
The Assets API allows you to find and search InsightIDR assets. An asset is a single device that is connected to your network or under your management, such as a server, laptop, or virtual machine. When you feed data to InsightIDR, you are able to see a variety of metrics about your assets, such as data collection issues, the number of assets monitored with the Insight Agent, restricted assets, and unique processes that are happening on assets.
Capabilities
Attachments
The Attachments API allows you to upload, list, download, and delete attachments.
Capabilities
Comments
The Comments APIs allows you to create, list, and delete comments.
Capabilities
Community Threats
These threat APIs allow you to add or replace indicators for Community Threats.
Capabilities
- Create a Community Threat
- Delete a Community Threat
- Add indicators to a Community Threat
- Replace indicators for a Community Threat
Investigations
The Investigations APIs allows you to view any existing investigations, modify or close investigations, and set the investigation status.
With Version 1 of the API, you can pull data from InsightIDR investigations into your preferred security and case tracking tools. The API can be used to:
- Retrieve a list of investigations
- Close investigations in bulk
- Assign a user to an investigation
- Set the status of an investigation
In addition to all of the tasks you can perform with Version 1 of the API, Version 2 can be used to:
- Create investigations
- Search investigations
- List alerts associated with the specified investigation
- Update an investigation
- Set the disposition
- Set the status or set the priority
- Get a list of Rapid7 product alerts associated with the specified investigation
Version 2 (Open Preview)
Version 2 is still in open preview
This API is still in open preview, therefore may be subject to change. To access this API, you must specify investigations - preview
in an Accept-version header.
Capabilities
- List investigation
- Create investigation
- Search for investigations
- Close investigations in bulk
- List alerts associated with the specified investigation
- Get a list of Rapid7 product alerts associated with the specified investigation
- Get investigation
- Update investigation
- Assign user to investigation
- Set the disposition of an investigation
- Set the priority of an investigation
- Set the status of an investigation
Version 1
Capabilities
- List investigation
- Close investigations in bulk
- Assign user to investigation
- Set the status of an investigation
Log Search API
The Log Search REST API allows you to perform the majority of the actions available through the IDR Log Search UI, and has some additional functionality that is not available through the UI. You may use this API to automate common tasks (for example, via shell scripts), and to generally interact with InsightOps programmatically.
- Query Log Data
- Saved Queries
- Pre-Computed Queries
- Manage Logs
- Manage Logsets
- Manage Custom Alerts
- Manage Custom Alert Notification Settings
- Manage Custom Alert Notification Targets
- Basic Detection Rule Labels
- Manage LEQL Variables
- Download Log Data
- Export Log Data To CSV
- Explore The Size of Your Log Data
- Backup Your Log Data To S3
- Retrieve The Most Common Keys Within Your Log Data