Add Community Threat indicators
Action ID:tools.rapid7.add_community_threat_indicators
Add Community Threat indicators. Calls POST /idr/v1/customthreats/key/{key}/indicators/add directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/addIndicators
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
object
required
Free-form documented indicator object containing IP addresses, process hashes, domains, or URLs.
string
required
The key of the Community Threat.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.Assign user to investigation
Action ID:tools.rapid7.assign_investigation
Assign user to investigation. Calls PUT /idr/v2/investigations/{id}/assignee directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/assignUserToInvestigation
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The id or rrn of the investigation.
string
required
The email address of the user to assign to this investigation.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.boolean | null
Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.Default:
null.Close investigations in bulk
Action ID:tools.rapid7.bulk_close_investigations
Close investigations in bulk. Calls POST /idr/v2/investigations/bulk_close directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/bulkCloseInvestigations
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The time investigations are to be closed from.
string
required
The investigation source: ALERT, MANUAL, or HUNT.
string
required
The time investigations are to be closed by.
string | null
The category of alert types to close.Default:
null.string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.string | null
The detection rule RRN.Default:
null.string | null
A disposition to set.Default:
null.integer | null
An optional maximum number to close.Default:
null.boolean | null
Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.Default:
null.Create comment
Action ID:tools.rapid7.create_comment
Create comment. Calls POST /idr/v1/comments directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/createComment
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The target of the comment.
array[string] | null
Attachment RRNs to associate.Default:
null.string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.string | null
The body of the comment.Default:
null.Create Community Threat
Action ID:tools.rapid7.create_community_threat
Create Community Threat. Calls POST /idr/v1/customthreats directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/createCommunityThreat
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
object
required
Free-form documented indicator object containing IP addresses, process hashes, domains, or URLs.
string
required
The Community Threat name.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.string | null
The note.Default:
null.Create InsightAppSec vulnerability comment
Action ID:tools.rapid7.create_appsec_vulnerability_comment
Create vulnerability comment. Calls POST /ias/v1/vulnerabilities/{vuln_id}/comments directly.
Reference: https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/create-vulnerability-comment
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The content of the Vulnerability Comment.
string
required
The identifier of the vulnerability.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.Create investigation
Action ID:tools.rapid7.create_investigation
Create investigation. Calls POST /idr/v2/investigations directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/createInvestigation
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The name of the investigation.
object | null
The user assigned to this investigation.Default:
null.string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.string | null
The disposition for the investigation. Defaults to UNDECIDED.Default:
null.boolean | null
Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.Default:
null.string | null
The priority for the investigation. Defaults to UNSPECIFIED.Default:
null.string | null
The status of the investigation. Defaults to OPEN.Default:
null.Create investigation from alerts
Action ID:tools.rapid7.create_investigation_from_alerts
Create investigation from alerts. Calls POST /idr/at/alerts/ops/investigate directly.
Reference: https://docs.rapid7.com/insightidr/api/alert-triage/#operation/investigateAlerts
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The investigation disposition.
string
required
The organization the investigation belongs to.
object
required
The search terms to match against.
string
required
The investigation status.
string
required
The investigation title.
string | null
The assigned user identifier.Default:
null.string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.string | null
The reason for creating the investigation.Default:
null.string | null
The investigation priority.Default:
null.array[string] | null
The tags to apply.Default:
null.Delete comment
Action ID:tools.rapid7.delete_comment
Delete comment. Calls DELETE /idr/v1/comments/{rrn} directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/deleteComment
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The RRN of the comment.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.Delete Community Threat
Action ID:tools.rapid7.delete_community_threat
Delete Community Threat. Calls POST /idr/v1/customthreats/key/{key}/delete directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/deleteCommunityThreat
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The key of a Community Threat.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.string | null
The reason for deleting the Community Threat.Default:
null.Get account by RRN
Action ID:tools.rapid7.get_account
Get account by RRN. Calls GET /idr/v1/accounts/{rrn} directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/findAccountByRrn
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The RRN of the account.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.Get alert
Action ID:tools.rapid7.get_alert
Get alert. Calls GET /idr/at/alerts/{alert_rrn} directly.
Reference: https://docs.rapid7.com/insightidr/api/alert-triage/#operation/getAlert
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The unique identifier of the alert.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.Get alert actors
Action ID:tools.rapid7.get_alert_actors
Get alert actors. Calls GET /idr/at/alerts/{alert_rrn}/actors directly.
Reference: https://docs.rapid7.com/insightidr/api/alert-triage/#operation/getAlertActors
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The unique identifier of the alert.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.integer | null
The zero-based page index.Default:
null.integer | null
The page size.Default:
null.Get alert evidences
Action ID:tools.rapid7.get_alert_evidences
Get alert evidences. Calls GET /idr/at/alerts/{alert_rrn}/evidences directly.
Reference: https://docs.rapid7.com/insightidr/api/alert-triage/#operation/getAlertEvidences
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The unique identifier of the alert.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.integer | null
The zero-based page index.Default:
null.integer | null
The page size.Default:
null.Get alerts
Action ID:tools.rapid7.get_alerts
Get alerts. Calls POST /idr/at/alerts/ops/rrns directly.
Reference: https://docs.rapid7.com/insightidr/api/alert-triage/#operation/getAlertsByRrn
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
array[string]
required
The alert RRNs to retrieve.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.array[string] | null
Additional fields to include.Default:
null.boolean | null
Return a 404 when no alerts are found.Default:
null.Get asset by RRN
Action ID:tools.rapid7.get_asset
Get asset by RRN. Calls GET /idr/v1/assets/{rrn} directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/findAssetByRrn
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The RRN of the asset.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.Get attachment metadata
Action ID:tools.rapid7.get_attachment_metadata
Get attachment metadata. Calls GET /idr/v1/attachments/{rrn}/metadata directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/getAttachment
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The RRN of the attachment.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.Get InsightAppSec app
Action ID:tools.rapid7.get_appsec_app
Get app. Calls GET /ias/v1/apps/{app_id} directly.
Reference: https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-app
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The identifier of the app.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.Get InsightAppSec scan
Action ID:tools.rapid7.get_appsec_scan
Get scan. Calls GET /ias/v1/scans/{scan_id} directly.
Reference: https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-scan
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The identifier of the scan.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.Get InsightAppSec scan execution details
Action ID:tools.rapid7.get_appsec_scan_execution_details
Get scan execution details. Calls GET /ias/v1/scans/{scan_id}/execution-details directly.
Reference: https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-scan-execution-details
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The identifier of the scan.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.Get InsightAppSec vulnerability
Action ID:tools.rapid7.get_appsec_vulnerability
Get vulnerability. Calls GET /ias/v1/vulnerabilities/{vuln_id} directly.
Reference: https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-vulnerability
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The identifier of the vulnerability.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.Get InsightVM asset
Action ID:tools.rapid7.get_vm_asset
Get asset. Calls GET /vm/v4/integration/assets/{id} directly.
Reference: https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/getIntegrationAsset
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The identifier of the asset.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.string | null
Asset comparison time.Default:
null.string | null
Current comparison time.Default:
null.boolean | null
Include inter-snapshot remediations.Default:
null.boolean | null
Include already-existing vulnerabilities.Default:
null.boolean | null
Include unique identifiers.Default:
null.Get InsightVM scan
Action ID:tools.rapid7.get_vm_scan
Get scan. Calls GET /vm/v4/integration/scan/{id} directly.
Reference: https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/getScan
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The identifier of the scan.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.boolean | null
Include additional scan details.Default:
null.Get investigation
Action ID:tools.rapid7.get_investigation
Get investigation. Calls GET /idr/v2/investigations/{id} directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/getInvestigationById
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The id or rrn of the investigation.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.boolean | null
Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.Default:
null.Get user by RRN
Action ID:tools.rapid7.get_user
Get user by RRN. Calls GET /idr/v1/users/{rrn} directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/getUserByRrn
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The RRN of the user.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.List alert fields
Action ID:tools.rapid7.list_alert_fields
List alert fields. Calls GET /idr/at/alerts/fields directly.
Reference: https://docs.rapid7.com/insightidr/api/alert-triage/#operation/getAlertFields
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.integer | null
The zero-based page index.Default:
null.string | null
Limits results to fields at or below this path.Default:
null.integer | null
The depth to round results to.Default:
null.string | null
Limits results containing the search terms.Default:
null.integer | null
The page size.Default:
null.List attachments
Action ID:tools.rapid7.list_attachments
List attachments. Calls GET /idr/v1/attachments directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/listAttachments
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
Return attachments with this target.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.integer | null
The optional 0-based page index.Default:
null.integer | null
The optional page size.Default:
null.List comments
Action ID:tools.rapid7.list_comments
List comments. Calls GET /idr/v1/comments directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/listComments
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
Return comments with this target.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.integer | null
The optional 0-based page index.Default:
null.integer | null
The optional page size.Default:
null.string | null
The direction in which comments should be sorted.Default:
null.List InsightAppSec apps
Action ID:tools.rapid7.list_appsec_apps
List apps. Calls GET /ias/v1/apps directly.
Reference: https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-apps
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.integer | null
The page index.Default:
null.string | null
The token to retrieve the next page.Default:
null.integer | null
The page size.Default:
null.string | null
The sort criteria.Default:
null.List InsightAppSec scan configs
Action ID:tools.rapid7.list_appsec_scan_configs
List scan configs. Calls GET /ias/v1/scan-configs directly.
Reference: https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-scan-configs
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.boolean | null
Whether to include errors.Default:
null.integer | null
The page index.Default:
null.string | null
The token to retrieve the next page.Default:
null.integer | null
The page size.Default:
null.string | null
The sort criteria.Default:
null.List InsightAppSec scans
Action ID:tools.rapid7.list_appsec_scans
List scans. Calls GET /ias/v1/scans directly.
Reference: https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-scans
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.integer | null
The page index.Default:
null.string | null
The token to retrieve the next page.Default:
null.integer | null
The page size.Default:
null.string | null
The sort criteria.Default:
null.List InsightAppSec vulnerabilities
Action ID:tools.rapid7.list_appsec_vulnerabilities
List vulnerabilities. Calls GET /ias/v1/vulnerabilities directly.
Reference: https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-vulnerabilities
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.integer | null
The page index.Default:
null.string | null
The token to retrieve the next page.Default:
null.integer | null
The page size.Default:
null.string | null
The sort criteria.Default:
null.List InsightVM scan engines
Action ID:tools.rapid7.list_vm_scan_engines
List scan engines. Calls GET /vm/v4/integration/scan/engine directly.
Reference: https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/getScanEngines
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.integer | null
The zero-based page index.Default:
null.integer | null
The number of records per page.Default:
null.List InsightVM scans
Action ID:tools.rapid7.list_vm_scans
List scans. Calls GET /vm/v4/integration/scan directly.
Reference: https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/getScans
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.boolean | null
Include additional scan details.Default:
null.integer | null
The zero-based page index.Default:
null.integer | null
The number of records per page.Default:
null.List InsightVM sites
Action ID:tools.rapid7.list_vm_sites
List sites. Calls POST /vm/v4/integration/sites directly.
Reference: https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/getSites
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.string | null
The stateless cursor.Default:
null.integer | null
The zero-based page index.Default:
null.integer | null
The number of records per page.Default:
null.string | null
The sort criteria.Default:
null.List investigation alerts
Action ID:tools.rapid7.list_investigation_alerts
List investigation alerts. Calls GET /idr/v2/investigations/{identifier}/alerts directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/listInvestigationAlerts
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The ID of the investigation.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.integer | null
The page index.Default:
null.boolean | null
Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.Default:
null.integer | null
The page size.Default:
null.List investigation product alerts
Action ID:tools.rapid7.list_investigation_product_alerts
List investigation product alerts. Calls GET /idr/v2/investigations/{identifier}/rapid7-product-alerts directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/getInvestigationRapid7ProductAlertInfo
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The ID of the investigation.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.boolean | null
Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.Default:
null.List investigations
Action ID:tools.rapid7.list_investigations
List investigations. Calls GET /idr/v2/investigations directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/listInvestigations
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string | null
A user’s email address. Only investigations assigned to that user will be included.Default:
null.string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.string | null
The time an investigation is closed. Must be an ISO-formatted timestamp.Default:
null.integer | null
The optional 0-based index of the page to retrieve.Default:
null.boolean | null
Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.Default:
null.string | null
A comma-separated list of investigation priorities to include.Default:
null.integer | null
The optional size of the page to retrieve.Default:
null.string | null
A field and direction separated by a comma.Default:
null.string | null
A comma-separated list of investigation sources to include.Default:
null.string | null
The time an investigation is opened. Must be an ISO-formatted timestamp.Default:
null.string | null
A comma-separated list of investigation statuses to include.Default:
null.string | null
A comma-separated list of tags to include.Default:
null.List log sets
Action ID:tools.rapid7.list_logsets
List log sets. Calls GET /log_search/management/logsets directly.
Reference: https://docs.rapid7.com/insightidr/log-search-api/#operation/getManagementLogsets
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.List logs
Action ID:tools.rapid7.list_logs
List logs. Calls GET /log_search/management/logs directly.
Reference: https://docs.rapid7.com/insightidr/log-search-api/#operation/getLogs
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.List saved queries
Action ID:tools.rapid7.list_saved_queries
List saved queries. Calls GET /log_search/query/saved_queries directly.
Reference: https://docs.rapid7.com/insightidr/log-search-api/#operation/listSavedQueries
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.Poll query
Action ID:tools.rapid7.poll_query
Poll query. Calls GET /log_search/query/{id} directly.
Reference: https://docs.rapid7.com/insightidr/log-search-api/#operation/pollQuery
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The continuation id generated when the query started.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.string | null
An alternative relative time range.Default:
null.Query individual logs
Action ID:tools.rapid7.query_log
Submit a log query. Responses may be HTTP 202 with a links continuation URL requiring polling via poll_query. Calls GET /log_search/query/logs/{log_keys} directly.
Reference: https://docs.rapid7.com/insightidr/log-search-api/#operation/getQueryLogs
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The log key.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.integer | null
Start UNIX timestamp in milliseconds.Default:
null.boolean | null
Include key-value pair information.Default:
null.boolean | null
Return most recent events first.Default:
null.integer | null
Number of entries per page, up to 500.Default:
null.string | null
A valid LEQL query.Default:
null.integer | null
Sequence number for incremental results.Default:
null.string | null
An alternative relative time range.Default:
null.integer | null
End UNIX timestamp in milliseconds.Default:
null.Query multiple logs
Action ID:tools.rapid7.query_logs
Query multiple logs. Calls POST /log_search/query/logs directly.
Reference: https://docs.rapid7.com/insightidr/log-search-api/#operation/postQueryLogs
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
object
required
LEQL object containing statement and during fields.
array[string]
required
The logs to query.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.boolean | null
Include key-value pair information.Default:
null.boolean | null
Return most recent events first.Default:
null.integer | null
Number of entries per page, up to 500.Default:
null.integer | null
Sequence number for incremental results.Default:
null.Remove investigation alert
Action ID:tools.rapid7.remove_investigation_alert
Remove investigation alert. Calls DELETE /idr/v2/investigations/{identifier}/alerts/{alertRrn} directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/removeAlertFromInvestigation
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The alert RRN.
string
required
The investigation id or rrn.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.boolean | null
Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.Default:
null.Replace Community Threat indicators
Action ID:tools.rapid7.replace_community_threat_indicators
Replace Community Threat indicators. Calls POST /idr/v1/customthreats/key/{key}/indicators/replace directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/replaceIndicators
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
object
required
Free-form documented indicator object containing IP addresses, process hashes, domains, or URLs.
string
required
The key of the Community Threat.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.Run saved query
Action ID:tools.rapid7.run_saved_query
Run saved query. Calls GET /log_search/query/saved_query/{saved_query_id} directly.
Reference: https://docs.rapid7.com/insightidr/log-search-api/#operation/useSavedQuery
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The id of the saved query.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.integer | null
Start UNIX timestamp in milliseconds.Default:
null.boolean | null
Include key-value pair information.Default:
null.boolean | null
Return most recent events first.Default:
null.integer | null
Number of entries per page.Default:
null.string | null
An alternative relative time range.Default:
null.integer | null
End UNIX timestamp in milliseconds.Default:
null.Search accounts
Action ID:tools.rapid7.search_accounts
Search accounts. Calls POST /idr/v1/accounts/_search directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/searchAccounts
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.integer | null
The optional 0-based page index.Default:
null.array[object] | null
Search criteria with field, operator, and value.Default:
null.integer | null
The optional page size.Default:
null.array[object] | null
Sorting information with field and order.Default:
null.Search alerts
Action ID:tools.rapid7.search_alerts
Search alerts. Calls POST /idr/at/alerts/ops/search directly.
Reference: https://docs.rapid7.com/insightidr/api/alert-triage/#operation/searchAlerts
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
object
required
The search terms to match against.
array[object] | null
Aggregations to apply.Default:
null.string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.array[string] | null
Additional fields to include.Default:
null.integer | null
The zero-based page index.Default:
null.boolean | null
Return only alert RRNs when true.Default:
null.integer | null
The page size.Default:
null.array[object] | null
The sort order.Default:
null.Search assets
Action ID:tools.rapid7.search_assets
Search assets. Calls POST /idr/v1/assets/_search directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/searchAssets
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.integer | null
The optional 0-based page index.Default:
null.array[object] | null
Search criteria with field, operator, and value.Default:
null.integer | null
The optional page size.Default:
null.array[object] | null
Sorting information with field and order.Default:
null.Search InsightAppSec
Action ID:tools.rapid7.search_appsec
Search. Calls POST /ias/v1/search directly.
Reference: https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/perform-search
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The query for the Search.
string
required
Resource type: APP, SCAN, SCAN_CONFIG, VULNERABILITY, VULNERABILITY_DISCOVERY, ATTACK_TEMPLATE, TARGET, ENGINE, ENGINE_GROUP, SCHEDULE, BLACKOUT, FILE, TAG, or REPORT.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.integer | null
The page index.Default:
null.boolean | null
Whether to limit data.Default:
null.string | null
The token to retrieve the next page.Default:
null.integer | null
The page size.Default:
null.string | null
The sort criteria.Default:
null.Search InsightVM assets
Action ID:tools.rapid7.search_vm_assets
Search assets. Calls POST /vm/v4/integration/assets directly.
Reference: https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/searchIntegrationAssets
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string | null
Filter expression for assets.Default:
null.string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.string | null
Asset comparison time.Default:
null.string | null
Current comparison time.Default:
null.string | null
Use the cursor from the previous response.Default:
null.boolean | null
Include inter-snapshot remediations.Default:
null.boolean | null
Include already-existing vulnerabilities.Default:
null.boolean | null
Include unique identifiers.Default:
null.integer | null
The zero-based page index.Default:
null.integer | null
The number of records per page.Default:
null.string | null
The sort criteria.Default:
null.string | null
Filter expression for vulnerabilities.Default:
null.Search InsightVM vulnerabilities
Action ID:tools.rapid7.search_vm_vulnerabilities
Search vulnerabilities. Calls POST /vm/v4/integration/vulnerabilities directly.
Reference: https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/searchIntegrationVulnerabilities
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.string | null
Use the cursor from the previous response.Default:
null.integer | null
The zero-based page index.Default:
null.integer | null
The number of records per page.Default:
null.string | null
The sort criteria.Default:
null.string | null
Search expression for vulnerabilities.Default:
null.Search investigations
Action ID:tools.rapid7.search_investigations
Search investigations. Calls POST /idr/v2/investigations/_search directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/searchInvestigations
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.string | null
The end time for the investigation search.Default:
null.integer | null
The optional 0-based index of the page to retrieve.Default:
null.boolean | null
Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.Default:
null.array[object] | null
The criteria for which investigations to return.Default:
null.integer | null
The optional size of the page to retrieve.Default:
null.array[object] | null
The sorting information.Default:
null.string | null
The start time for the investigation search.Default:
null.Search local accounts
Action ID:tools.rapid7.search_local_accounts
Search local accounts. Calls POST /idr/v1/assets/local-accounts/_search directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/searchLocalAccounts
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.integer | null
The optional 0-based page index.Default:
null.array[object] | null
Search criteria with field, operator, and value.Default:
null.integer | null
The optional page size.Default:
null.array[object] | null
Sorting information with field and order.Default:
null.Search users
Action ID:tools.rapid7.search_users
Search users. Calls POST /idr/v1/users/_search directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/searchUsers
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.integer | null
The optional 0-based page index.Default:
null.array[object] | null
Search criteria with field, operator, and value.Default:
null.integer | null
The optional page size.Default:
null.array[object] | null
Sorting information with field and order.Default:
null.Set investigation disposition
Action ID:tools.rapid7.set_investigation_disposition
Set investigation disposition. Calls PUT /idr/v2/investigations/{id}/disposition/{disposition} directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/setDisposition
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The new value for the investigation.
string
required
The id or rrn of the investigation.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.boolean | null
Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.Default:
null.Set investigation priority
Action ID:tools.rapid7.set_investigation_priority
Set investigation priority. Calls PUT /idr/v2/investigations/{id}/priority/{priority} directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/setPriority
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The id or rrn of the investigation.
string
required
The new value for the investigation.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.boolean | null
Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.Default:
null.Set investigation status
Action ID:tools.rapid7.set_investigation_status
Set investigation status. Calls PUT /idr/v2/investigations/{id}/status/{status} directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/setStatus
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The id or rrn of the investigation.
string
required
The new value for the investigation.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.boolean | null
Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.Default:
null.object | null
Optional body fields: disposition, threat_command_close_reason, and threat_command_free_text.Default:
null.Start InsightVM scan
Action ID:tools.rapid7.start_vm_scan
Start scan. Calls POST /vm/v4/integration/scan directly.
Reference: https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/startScan
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
object
required
API-native ScanForm body. Fields include asset_ids, credential_sources, engine_ids, name, result_consumer, solution_ids, start_time, and vulnerability_ids.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.Stop InsightVM scan
Action ID:tools.rapid7.stop_vm_scan
Stop scan. Calls POST /vm/v4/integration/scan/{id}/stop directly.
Reference: https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/stopScan
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The identifier of the scan to stop.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.Submit InsightAppSec scan
Action ID:tools.rapid7.submit_appsec_scan
Submit scan. Calls POST /ias/v1/scans directly.
Reference: https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/submit-scan
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The ID of the scan configuration.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.string | null
The type of Scan.Default:
null.Submit InsightAppSec scan action
Action ID:tools.rapid7.submit_appsec_scan_action
Submit scan action. Calls PUT /ias/v1/scans/{scan_id}/action directly.
Reference: https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/submit-scan-action
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The action: PAUSE, RESUME, STOP, AUTHENTICATE, or CANCEL.
string
required
The identifier of the scan.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.Update alert
Action ID:tools.rapid7.update_alert
Update alert. Calls PATCH /idr/at/alerts/{alert_rrn} directly.
Reference: https://docs.rapid7.com/insightidr/api/alert-triage/#operation/patchAlert
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The unique identifier of the alert.
object
required
API-native request body. Fields include status, disposition, priority, assignee, investigation, tags, and comment.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.Update investigation
Action ID:tools.rapid7.update_investigation
Update investigation. Calls PATCH /idr/v2/investigations/{id} directly.
Reference: https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/updateInvestigation
Secrets
Required secrets:rapid7: required valuesRAPID7_API_KEY.
Input fields
string
required
The id or rrn of the investigation.
object
required
API-native request body. Fields include title, status, priority, disposition, assignee, and threat command fields.
string | null
Regional Insight Platform API base URL (e.g. https://eu.api.insight.rapid7.com). Regions: us, us2, us3, eu, ca, au, ap.Default:
null.boolean | null
Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.Default:
null.