Skip to Content
InsightvmHIDDEN

Bulk Export API

Introduction

Using Bulk Export API, you can bulk export your asset and vulnerability data using a GraphQL API. The data is returned in Parquet format and can be downloaded for use in your business intelligence tools.

To bulk export API data to Parquet files, complete the following:

  1. Choose the endpoint for your region.
  2. Initiate the generation of export files.
  3. Query the ID returned.
  4. Download the parquet files.

Authorization

⚠️

Permissions

You require Platform Administrator permissions to carry out API Bulk Export.

Authorization is performed by passing your API user key via a single HTTP header: X-Api-Key. The user key must be passed to all requests. This can be generated from the Insight Platform key management page. For information on generating and managing API keys, see Managing Platform API Keys.

Endpoints

RegionURI
United States - 1https://us.api.insight.rapid7.com/export/graphql
United States - 2https://us2.api.insight.rapid7.com/export/graphql
United States - 3https://us3.api.insight.rapid7.com/export/graphql
Europehttps://eu.api.insight.rapid7.com/export/graphql
Canadahttps://ca.api.insight.rapid7.com/export/graphql
Australiahttps://au.api.insight.rapid7.com/export/graphql
Japanhttps://ap.api.insight.rapid7.com/export/graphql

Initiating the export

Complete these steps to create and retrieve the export files in Parquet.

Step 1: Mutation to initiate export

The mutations initiate the generation of the export files for Policy and Vulnerability data, respectively:

Vulnerability:

mutation CreateVulnerabilityExport { createVulnerabilityExport(input:{}) { id } }

Step 2: Export query

To retrieve the URLs to download the Parquet files, you must query the ID returned when initiating the export. The results will return a URL where you can download the Parquet files.

⚠️

Export considerations

The data is refreshed by the system once a day. You can make multiple export requests, however overuse of this method may result in throttling.

query GetExport { export(id: "YzY1ODk5YzQtNjkwNi00MDRjLTk3NDQtNjRhOGNkNWFkNDIx"){ id status dataset timestamp result { prefix urls } } }

Parquet files

These schemas provide an overview of the fields returned in the files at the URLs provided:

Vulnerability Export

asset

FieldTypeDefinitionExample
orgIdStringOrganization IDa08de390-bb6a-4297-b1df-9ee58c7beb7a
assetIdStringAsset ID2b2b6a57-9136-4874-8af1-3f9f0a6de60a-default-asset-1
agentIdStringAgent ID586d68c92af55c27b7bfecf7f6df0cb4
awsInstanceIdStringThe Amazon Web Services instance ID of the asset, if applicablei-0e1cc483957bc29d8
azureResourceIdStringThe Azure resource identifier of the asset, if applicable
gcpObjectIdStringThe Google Cloud Platform identifier of the asset, if applicable
macStringThe primary MAC address of the asset0050568A103C
ipStringThe primary IP address of the asset0.0.0.0
hostNameStringThe primary hostname of the assettesthost.us
osArchitectureStringArchitecture of the OS on the assetx86_64
osFamilyStringFamily of the OS on the assetWindows
osProductStringProduct of the OS on the assetWindows Server 2016 Standard Edition
osVendorStringVendor of the OS on the assetMicrosoft
osVersionStringThe OS version on the asset1607
osTypeStringType of OS on the assetServer
sitesListArray of sites the asset belongs to[site1, site2]

asset_vulnerability

FieldTypeDefinitionExample
orgIdStringOrganization IDa08de390-bb6a-4297-b1df-9ee58c7beb7a
assetIdStringAsset ID2b2b6a57-9136-4874-8af1-3f9f0a6de60a-default-asset-1
vulnIdStringVulnerability IDmsft-cve-2023-29372
portIntegerThe scanned port the vulnerability is present on, if applicable22
protocolStringThe scanned protocol the vulnerability is present on, if applicableTCP
nicStringThe scanned network interface, if applicable
proofStringProof describing how the asset is vulnerable to the vulnerability<p><p>Vulnerable OS: Microsoft Windows Server 2012 R2 Standard Edition<p></p></p><p>Based on the following 3 results:<ol><li><p>Microsoft patch KB5027282 is not installed.</p></li><li><p>Microsoft patch KB5027271 is not installed.</p></li><li><p><ul><li>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion<ul><li>UBR - contains unexpected value 20337</li></ul></li></ul></p></li></ol></p></p>
firstFoundTimestampTimestampTimestamp of when the vulnerability was found on the asset2023-11-06T11:40:37.000Z
titleStringThe title of the vulnerabilityMicrosoft CVE-2023-29372: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
descriptionStringThe description of the vulnerability, containing a mix of HTML/XML contentMicrosoft CVE-2023-29372: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
cvssAccessComplexityStringThe CVSS V2 access complexity of the vulnerabilityM
cvssAccessVectorStringThe CVSS V2 access vector of the vulnerabilityN
cvssAuthenticationStringThe CVSS V2 authentication of the vulnerabilityN
cvssAvailabilityImpactStringThe CVSS V2 availability impact of the vulnerabilityC
cvssConfidentialityImpactStringThe CVSS V2 confidentiality impact of the vulnerabilityC
cvssIntegrityImpactStringThe CVSS V2 integrity impact of the vulnerabilityC
cvssScoreDoubleThe CVSS V2 score of the vulnerability8.8
cvssV3AttackVectorStringThe CVSS V3 attack vector (AV) of the vulnerabilityNetwork
cvssV3AttackComplexityStringThe CVSS V3 attack complexity (AC) of the vulnerabilityLow
cvssV3PrivilegesRequiredStringThe CVSS V3 privileges required (PR) of the vulnerabilityNone
cvssV3UserInteractionStringThe CVSS V3 user interaction (UI) of the vulnerabilityRequired
cvssV3ScopeStringThe CVSS V3 scope (S) of the vulnerabilityUnchanged
cvssV3ConfidentialityStringThe CVSS V3 confidentiality (C) of the vulnerabilityHigh
cvssV3IntegrityStringThe CVSS V3 integrity (I) of the vulnerabilityHigh
cvssV3AvailabilityStringThe CVSS V3 availability (A) of the vulnerabilityHigh
cvssV3ScoreDoubleThe CVSS V3 score of the vulnerability8.8
cvssV3SeverityStringThe CVSS V3 severity of the vulnerabilityHigh
cvssV3SeverityRankIntegerThe CVSS V3 severity rank of the vulnerability4
skillLevelStringThe skill level of the vulnerabilityunknown
skillLevelRankIntegerThe skill level rank of the vulnerability4
severityStringThe severity of the vulnerabilityCritical
severityRankThe severity rank of the vulnerability3
severityScoreIntegerThe severity score of the vulnerability9
hasExploitsBooleanWhether there are exploits associated with the vulnerabilityfalse
hasMalwareBooleanWhether there is malware associated with the vulnerabilityfalse
threatFeedExistsBooleanWhether a threat feed exists for the vulnerabilityfalse
pciCompliantBooleanWhether the vulnerability is PCI compliantfalse
pciSeverityIntegerThe PCI severity of the vulnerability5
riskScoreDoubleThe real risk score of the vulnerability. Used only when riskScoreV2_0 is not present348.70102
riskScoreV2_0IntegerThe active risk score of the vulnerability589
cvesListAn array of CVE IDs applicable to the vulnerability[CVE-2023-29372]
dateAddedTimestampTimestamp of when the vulnerability was added2023-06-13T00:00:00.000Z
dateModifiedTimestampTimestamp of when the vulnerability was modified2023-06-15T00:00:00.000Z
datePublishedTimestamp of when the vulnerability was published2023-06-13T00:00:00.000Z

Downloading the Parquet files

  • Each time URLs are generated to download the files, the URLs are valid for 15 minutes. The files can be downloaded as many times as needed within the 15 minute time frame.
  • These files are retained for 30 days only. Attempting to query the exports after 30 days will return an error message.