> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rapid7

> Reference for the Tracecat Rapid7 integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Add Community Threat indicators

Action ID: `tools.rapid7.add_community_threat_indicators`

Add Community Threat indicators. Calls POST /idr/v1/customthreats/key/\{key}/indicators/add directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/addIndicators](https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/addIndicators)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="indicators" type="object" required>
  Free-form documented indicator object containing IP addresses, process hashes, domains, or URLs.
</ParamField>

<ParamField path="key" type="string" required>
  The key of the Community Threat.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

## Assign user to investigation

Action ID: `tools.rapid7.assign_investigation`

Assign user to investigation. Calls PUT /idr/v2/investigations/\{id}/assignee directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/assignUserToInvestigation](https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/assignUserToInvestigation)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  The id or rrn of the investigation.
</ParamField>

<ParamField path="user_email_address" type="string" required>
  The email address of the user to assign to this investigation.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="multi_customer" type="boolean | null">
  Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.

  Default: `null`.
</ParamField>

## Close investigations in bulk

Action ID: `tools.rapid7.bulk_close_investigations`

Close investigations in bulk. Calls POST /idr/v2/investigations/bulk\_close directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/bulkCloseInvestigations](https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/bulkCloseInvestigations)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="from" type="string" required>
  The time investigations are to be closed from.
</ParamField>

<ParamField path="source" type="string" required>
  The investigation source: ALERT, MANUAL, or HUNT.
</ParamField>

<ParamField path="to" type="string" required>
  The time investigations are to be closed by.
</ParamField>

<ParamField path="alert_type" type="string | null">
  The category of alert types to close.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="detection_rule_rrn" type="string | null">
  The detection rule RRN.

  Default: `null`.
</ParamField>

<ParamField path="disposition" type="string | null">
  A disposition to set.

  Default: `null`.
</ParamField>

<ParamField path="max_investigations_to_close" type="integer | null">
  An optional maximum number to close.

  Default: `null`.
</ParamField>

<ParamField path="multi_customer" type="boolean | null">
  Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.

  Default: `null`.
</ParamField>

## Create comment

Action ID: `tools.rapid7.create_comment`

Create comment. Calls POST /idr/v1/comments directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/createComment](https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/createComment)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="target" type="string" required>
  The target of the comment.
</ParamField>

<ParamField path="attachments" type="array[string] | null">
  Attachment RRNs to associate.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="body" type="string | null">
  The body of the comment.

  Default: `null`.
</ParamField>

## Create Community Threat

Action ID: `tools.rapid7.create_community_threat`

Create Community Threat. Calls POST /idr/v1/customthreats directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/createCommunityThreat](https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/createCommunityThreat)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="indicators" type="object" required>
  Free-form documented indicator object containing IP addresses, process hashes, domains, or URLs.
</ParamField>

<ParamField path="threat" type="string" required>
  The Community Threat name.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="note" type="string | null">
  The note.

  Default: `null`.
</ParamField>

## Create InsightAppSec vulnerability comment

Action ID: `tools.rapid7.create_appsec_vulnerability_comment`

Create vulnerability comment. Calls POST /ias/v1/vulnerabilities/\{vuln\_id}/comments directly.

Reference: [https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/create-vulnerability-comment](https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/create-vulnerability-comment)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="content" type="string" required>
  The content of the Vulnerability Comment.
</ParamField>

<ParamField path="vuln_id" type="string" required>
  The identifier of the vulnerability.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

## Create investigation

Action ID: `tools.rapid7.create_investigation`

Create investigation. Calls POST /idr/v2/investigations directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/createInvestigation](https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/createInvestigation)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="title" type="string" required>
  The name of the investigation.
</ParamField>

<ParamField path="assignee" type="object | null">
  The user assigned to this investigation.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="disposition" type="string | null">
  The disposition for the investigation. Defaults to UNDECIDED.

  Default: `null`.
</ParamField>

<ParamField path="multi_customer" type="boolean | null">
  Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.

  Default: `null`.
</ParamField>

<ParamField path="priority" type="string | null">
  The priority for the investigation. Defaults to UNSPECIFIED.

  Default: `null`.
</ParamField>

<ParamField path="status" type="string | null">
  The status of the investigation. Defaults to OPEN.

  Default: `null`.
</ParamField>

## Create investigation from alerts

Action ID: `tools.rapid7.create_investigation_from_alerts`

Create investigation from alerts. Calls POST /idr/at/alerts/ops/investigate directly.

Reference: [https://docs.rapid7.com/insightidr/api/alert-triage/#operation/investigateAlerts](https://docs.rapid7.com/insightidr/api/alert-triage/#operation/investigateAlerts)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="disposition" type="string" required>
  The investigation disposition.
</ParamField>

<ParamField path="organization_id" type="string" required>
  The organization the investigation belongs to.
</ParamField>

<ParamField path="search" type="object" required>
  The search terms to match against.
</ParamField>

<ParamField path="status" type="string" required>
  The investigation status.
</ParamField>

<ParamField path="title" type="string" required>
  The investigation title.
</ParamField>

<ParamField path="assignee_id" type="string | null">
  The assigned user identifier.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="comment" type="string | null">
  The reason for creating the investigation.

  Default: `null`.
</ParamField>

<ParamField path="priority" type="string | null">
  The investigation priority.

  Default: `null`.
</ParamField>

<ParamField path="tags" type="array[string] | null">
  The tags to apply.

  Default: `null`.
</ParamField>

## Delete comment

Action ID: `tools.rapid7.delete_comment`

Delete comment. Calls DELETE /idr/v1/comments/\{rrn} directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/deleteComment](https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/deleteComment)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="rrn" type="string" required>
  The RRN of the comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

## Delete Community Threat

Action ID: `tools.rapid7.delete_community_threat`

Delete Community Threat. Calls POST /idr/v1/customthreats/key/\{key}/delete directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/deleteCommunityThreat](https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/deleteCommunityThreat)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="key" type="string" required>
  The key of a Community Threat.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="reason" type="string | null">
  The reason for deleting the Community Threat.

  Default: `null`.
</ParamField>

## Get account by RRN

Action ID: `tools.rapid7.get_account`

Get account by RRN. Calls GET /idr/v1/accounts/\{rrn} directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/findAccountByRrn](https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/findAccountByRrn)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="rrn" type="string" required>
  The RRN of the account.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

## Get alert

Action ID: `tools.rapid7.get_alert`

Get alert. Calls GET /idr/at/alerts/\{alert\_rrn} directly.

Reference: [https://docs.rapid7.com/insightidr/api/alert-triage/#operation/getAlert](https://docs.rapid7.com/insightidr/api/alert-triage/#operation/getAlert)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="alert_rrn" type="string" required>
  The unique identifier of the alert.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

## Get alert actors

Action ID: `tools.rapid7.get_alert_actors`

Get alert actors. Calls GET /idr/at/alerts/\{alert\_rrn}/actors directly.

Reference: [https://docs.rapid7.com/insightidr/api/alert-triage/#operation/getAlertActors](https://docs.rapid7.com/insightidr/api/alert-triage/#operation/getAlertActors)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="alert_rrn" type="string" required>
  The unique identifier of the alert.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="index" type="integer | null">
  The zero-based page index.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The page size.

  Default: `null`.
</ParamField>

## Get alert evidences

Action ID: `tools.rapid7.get_alert_evidences`

Get alert evidences. Calls GET /idr/at/alerts/\{alert\_rrn}/evidences directly.

Reference: [https://docs.rapid7.com/insightidr/api/alert-triage/#operation/getAlertEvidences](https://docs.rapid7.com/insightidr/api/alert-triage/#operation/getAlertEvidences)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="alert_rrn" type="string" required>
  The unique identifier of the alert.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="index" type="integer | null">
  The zero-based page index.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The page size.

  Default: `null`.
</ParamField>

## Get alerts

Action ID: `tools.rapid7.get_alerts`

Get alerts. Calls POST /idr/at/alerts/ops/rrns directly.

Reference: [https://docs.rapid7.com/insightidr/api/alert-triage/#operation/getAlertsByRrn](https://docs.rapid7.com/insightidr/api/alert-triage/#operation/getAlertsByRrn)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="rrns" type="array[string]" required>
  The alert RRNs to retrieve.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="field_ids" type="array[string] | null">
  Additional fields to include.

  Default: `null`.
</ParamField>

<ParamField path="strict" type="boolean | null">
  Return a 404 when no alerts are found.

  Default: `null`.
</ParamField>

## Get asset by RRN

Action ID: `tools.rapid7.get_asset`

Get asset by RRN. Calls GET /idr/v1/assets/\{rrn} directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/findAssetByRrn](https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/findAssetByRrn)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="rrn" type="string" required>
  The RRN of the asset.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

## Get attachment metadata

Action ID: `tools.rapid7.get_attachment_metadata`

Get attachment metadata. Calls GET /idr/v1/attachments/\{rrn}/metadata directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/getAttachment](https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/getAttachment)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="rrn" type="string" required>
  The RRN of the attachment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

## Get InsightAppSec app

Action ID: `tools.rapid7.get_appsec_app`

Get app. Calls GET /ias/v1/apps/\{app\_id} directly.

Reference: [https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-app](https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-app)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="app_id" type="string" required>
  The identifier of the app.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

## Get InsightAppSec scan

Action ID: `tools.rapid7.get_appsec_scan`

Get scan. Calls GET /ias/v1/scans/\{scan\_id} directly.

Reference: [https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-scan](https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-scan)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="scan_id" type="string" required>
  The identifier of the scan.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

## Get InsightAppSec scan execution details

Action ID: `tools.rapid7.get_appsec_scan_execution_details`

Get scan execution details. Calls GET /ias/v1/scans/\{scan\_id}/execution-details directly.

Reference: [https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-scan-execution-details](https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-scan-execution-details)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="scan_id" type="string" required>
  The identifier of the scan.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

## Get InsightAppSec vulnerability

Action ID: `tools.rapid7.get_appsec_vulnerability`

Get vulnerability. Calls GET /ias/v1/vulnerabilities/\{vuln\_id} directly.

Reference: [https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-vulnerability](https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-vulnerability)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="vuln_id" type="string" required>
  The identifier of the vulnerability.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

## Get InsightVM asset

Action ID: `tools.rapid7.get_vm_asset`

Get asset. Calls GET /vm/v4/integration/assets/\{id} directly.

Reference: [https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/getIntegrationAsset](https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/getIntegrationAsset)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  The identifier of the asset.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="comparisonTime" type="string | null">
  Asset comparison time.

  Default: `null`.
</ParamField>

<ParamField path="currentTime" type="string | null">
  Current comparison time.

  Default: `null`.
</ParamField>

<ParamField path="includeInterSnapshotRemediations" type="boolean | null">
  Include inter-snapshot remediations.

  Default: `null`.
</ParamField>

<ParamField path="includeSame" type="boolean | null">
  Include already-existing vulnerabilities.

  Default: `null`.
</ParamField>

<ParamField path="includeUniqueIdentifiers" type="boolean | null">
  Include unique identifiers.

  Default: `null`.
</ParamField>

## Get InsightVM scan

Action ID: `tools.rapid7.get_vm_scan`

Get scan. Calls GET /vm/v4/integration/scan/\{id} directly.

Reference: [https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/getScan](https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/getScan)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  The identifier of the scan.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="includeDetails" type="boolean | null">
  Include additional scan details.

  Default: `null`.
</ParamField>

## Get investigation

Action ID: `tools.rapid7.get_investigation`

Get investigation. Calls GET /idr/v2/investigations/\{id} directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/getInvestigationById](https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/getInvestigationById)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  The id or rrn of the investigation.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="multi_customer" type="boolean | null">
  Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.

  Default: `null`.
</ParamField>

## Get user by RRN

Action ID: `tools.rapid7.get_user`

Get user by RRN. Calls GET /idr/v1/users/\{rrn} directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/getUserByRrn](https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/getUserByRrn)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="rrn" type="string" required>
  The RRN of the user.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

## List alert fields

Action ID: `tools.rapid7.list_alert_fields`

List alert fields. Calls GET /idr/at/alerts/fields directly.

Reference: [https://docs.rapid7.com/insightidr/api/alert-triage/#operation/getAlertFields](https://docs.rapid7.com/insightidr/api/alert-triage/#operation/getAlertFields)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="index" type="integer | null">
  The zero-based page index.

  Default: `null`.
</ParamField>

<ParamField path="path" type="string | null">
  Limits results to fields at or below this path.

  Default: `null`.
</ParamField>

<ParamField path="path_depth" type="integer | null">
  The depth to round results to.

  Default: `null`.
</ParamField>

<ParamField path="search" type="string | null">
  Limits results containing the search terms.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The page size.

  Default: `null`.
</ParamField>

## List attachments

Action ID: `tools.rapid7.list_attachments`

List attachments. Calls GET /idr/v1/attachments directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/listAttachments](https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/listAttachments)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="target" type="string" required>
  Return attachments with this target.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="index" type="integer | null">
  The optional 0-based page index.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The optional page size.

  Default: `null`.
</ParamField>

## List comments

Action ID: `tools.rapid7.list_comments`

List comments. Calls GET /idr/v1/comments directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/listComments](https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/listComments)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="target" type="string" required>
  Return comments with this target.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="index" type="integer | null">
  The optional 0-based page index.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The optional page size.

  Default: `null`.
</ParamField>

<ParamField path="sortDirection" type="string | null">
  The direction in which comments should be sorted.

  Default: `null`.
</ParamField>

## List InsightAppSec apps

Action ID: `tools.rapid7.list_appsec_apps`

List apps. Calls GET /ias/v1/apps directly.

Reference: [https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-apps](https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-apps)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="index" type="integer | null">
  The page index.

  Default: `null`.
</ParamField>

<ParamField path="page_token" type="string | null">
  The token to retrieve the next page.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The page size.

  Default: `null`.
</ParamField>

<ParamField path="sort" type="string | null">
  The sort criteria.

  Default: `null`.
</ParamField>

## List InsightAppSec scan configs

Action ID: `tools.rapid7.list_appsec_scan_configs`

List scan configs. Calls GET /ias/v1/scan-configs directly.

Reference: [https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-scan-configs](https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-scan-configs)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="include_errors" type="boolean | null">
  Whether to include errors.

  Default: `null`.
</ParamField>

<ParamField path="index" type="integer | null">
  The page index.

  Default: `null`.
</ParamField>

<ParamField path="page_token" type="string | null">
  The token to retrieve the next page.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The page size.

  Default: `null`.
</ParamField>

<ParamField path="sort" type="string | null">
  The sort criteria.

  Default: `null`.
</ParamField>

## List InsightAppSec scans

Action ID: `tools.rapid7.list_appsec_scans`

List scans. Calls GET /ias/v1/scans directly.

Reference: [https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-scans](https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-scans)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="index" type="integer | null">
  The page index.

  Default: `null`.
</ParamField>

<ParamField path="page_token" type="string | null">
  The token to retrieve the next page.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The page size.

  Default: `null`.
</ParamField>

<ParamField path="sort" type="string | null">
  The sort criteria.

  Default: `null`.
</ParamField>

## List InsightAppSec vulnerabilities

Action ID: `tools.rapid7.list_appsec_vulnerabilities`

List vulnerabilities. Calls GET /ias/v1/vulnerabilities directly.

Reference: [https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-vulnerabilities](https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/get-vulnerabilities)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="index" type="integer | null">
  The page index.

  Default: `null`.
</ParamField>

<ParamField path="page_token" type="string | null">
  The token to retrieve the next page.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The page size.

  Default: `null`.
</ParamField>

<ParamField path="sort" type="string | null">
  The sort criteria.

  Default: `null`.
</ParamField>

## List InsightVM scan engines

Action ID: `tools.rapid7.list_vm_scan_engines`

List scan engines. Calls GET /vm/v4/integration/scan/engine directly.

Reference: [https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/getScanEngines](https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/getScanEngines)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer | null">
  The zero-based page index.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The number of records per page.

  Default: `null`.
</ParamField>

## List InsightVM scans

Action ID: `tools.rapid7.list_vm_scans`

List scans. Calls GET /vm/v4/integration/scan directly.

Reference: [https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/getScans](https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/getScans)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="includeDetails" type="boolean | null">
  Include additional scan details.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer | null">
  The zero-based page index.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The number of records per page.

  Default: `null`.
</ParamField>

## List InsightVM sites

Action ID: `tools.rapid7.list_vm_sites`

List sites. Calls POST /vm/v4/integration/sites directly.

Reference: [https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/getSites](https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/getSites)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="cursor" type="string | null">
  The stateless cursor.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer | null">
  The zero-based page index.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The number of records per page.

  Default: `null`.
</ParamField>

<ParamField path="sort" type="string | null">
  The sort criteria.

  Default: `null`.
</ParamField>

## List investigation alerts

Action ID: `tools.rapid7.list_investigation_alerts`

List investigation alerts. Calls GET /idr/v2/investigations/\{identifier}/alerts directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/listInvestigationAlerts](https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/listInvestigationAlerts)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="identifier" type="string" required>
  The ID of the investigation.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="index" type="integer | null">
  The page index.

  Default: `null`.
</ParamField>

<ParamField path="multi_customer" type="boolean | null">
  Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The page size.

  Default: `null`.
</ParamField>

## List investigation product alerts

Action ID: `tools.rapid7.list_investigation_product_alerts`

List investigation product alerts. Calls GET /idr/v2/investigations/\{identifier}/rapid7-product-alerts directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/getInvestigationRapid7ProductAlertInfo](https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/getInvestigationRapid7ProductAlertInfo)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="identifier" type="string" required>
  The ID of the investigation.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="multi_customer" type="boolean | null">
  Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.

  Default: `null`.
</ParamField>

## List investigations

Action ID: `tools.rapid7.list_investigations`

List investigations. Calls GET /idr/v2/investigations directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/listInvestigations](https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/listInvestigations)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="assignee_email" type="string | null">
  A user's email address. Only investigations assigned to that user will be included.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="end_time" type="string | null">
  The time an investigation is closed. Must be an ISO-formatted timestamp.

  Default: `null`.
</ParamField>

<ParamField path="index" type="integer | null">
  The optional 0-based index of the page to retrieve.

  Default: `null`.
</ParamField>

<ParamField path="multi_customer" type="boolean | null">
  Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.

  Default: `null`.
</ParamField>

<ParamField path="priorities" type="string | null">
  A comma-separated list of investigation priorities to include.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The optional size of the page to retrieve.

  Default: `null`.
</ParamField>

<ParamField path="sort" type="string | null">
  A field and direction separated by a comma.

  Default: `null`.
</ParamField>

<ParamField path="sources" type="string | null">
  A comma-separated list of investigation sources to include.

  Default: `null`.
</ParamField>

<ParamField path="start_time" type="string | null">
  The time an investigation is opened. Must be an ISO-formatted timestamp.

  Default: `null`.
</ParamField>

<ParamField path="statuses" type="string | null">
  A comma-separated list of investigation statuses to include.

  Default: `null`.
</ParamField>

<ParamField path="tags" type="string | null">
  A comma-separated list of tags to include.

  Default: `null`.
</ParamField>

## List log sets

Action ID: `tools.rapid7.list_logsets`

List log sets. Calls GET /log\_search/management/logsets directly.

Reference: [https://docs.rapid7.com/insightidr/log-search-api/#operation/getManagementLogsets](https://docs.rapid7.com/insightidr/log-search-api/#operation/getManagementLogsets)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

## List logs

Action ID: `tools.rapid7.list_logs`

List logs. Calls GET /log\_search/management/logs directly.

Reference: [https://docs.rapid7.com/insightidr/log-search-api/#operation/getLogs](https://docs.rapid7.com/insightidr/log-search-api/#operation/getLogs)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

## List saved queries

Action ID: `tools.rapid7.list_saved_queries`

List saved queries. Calls GET /log\_search/query/saved\_queries directly.

Reference: [https://docs.rapid7.com/insightidr/log-search-api/#operation/listSavedQueries](https://docs.rapid7.com/insightidr/log-search-api/#operation/listSavedQueries)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

## Poll query

Action ID: `tools.rapid7.poll_query`

Poll query. Calls GET /log\_search/query/\{id} directly.

Reference: [https://docs.rapid7.com/insightidr/log-search-api/#operation/pollQuery](https://docs.rapid7.com/insightidr/log-search-api/#operation/pollQuery)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  The continuation id generated when the query started.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="time_range" type="string | null">
  An alternative relative time range.

  Default: `null`.
</ParamField>

## Query individual logs

Action ID: `tools.rapid7.query_log`

Submit a log query. Responses may be HTTP 202 with a links continuation URL requiring polling via poll\_query. Calls GET /log\_search/query/logs/\{log\_keys} directly.

Reference: [https://docs.rapid7.com/insightidr/log-search-api/#operation/getQueryLogs](https://docs.rapid7.com/insightidr/log-search-api/#operation/getQueryLogs)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="log_keys" type="string" required>
  The log key.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="from" type="integer | null">
  Start UNIX timestamp in milliseconds.

  Default: `null`.
</ParamField>

<ParamField path="kvp_info" type="boolean | null">
  Include key-value pair information.

  Default: `null`.
</ParamField>

<ParamField path="most_recent_first" type="boolean | null">
  Return most recent events first.

  Default: `null`.
</ParamField>

<ParamField path="per_page" type="integer | null">
  Number of entries per page, up to 500.

  Default: `null`.
</ParamField>

<ParamField path="query" type="string | null">
  A valid LEQL query.

  Default: `null`.
</ParamField>

<ParamField path="sequence_number" type="integer | null">
  Sequence number for incremental results.

  Default: `null`.
</ParamField>

<ParamField path="time_range" type="string | null">
  An alternative relative time range.

  Default: `null`.
</ParamField>

<ParamField path="to" type="integer | null">
  End UNIX timestamp in milliseconds.

  Default: `null`.
</ParamField>

## Query multiple logs

Action ID: `tools.rapid7.query_logs`

Query multiple logs. Calls POST /log\_search/query/logs directly.

Reference: [https://docs.rapid7.com/insightidr/log-search-api/#operation/postQueryLogs](https://docs.rapid7.com/insightidr/log-search-api/#operation/postQueryLogs)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="leql" type="object" required>
  LEQL object containing statement and during fields.
</ParamField>

<ParamField path="logs" type="array[string]" required>
  The logs to query.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="kvp_info" type="boolean | null">
  Include key-value pair information.

  Default: `null`.
</ParamField>

<ParamField path="most_recent_first" type="boolean | null">
  Return most recent events first.

  Default: `null`.
</ParamField>

<ParamField path="per_page" type="integer | null">
  Number of entries per page, up to 500.

  Default: `null`.
</ParamField>

<ParamField path="sequence_number" type="integer | null">
  Sequence number for incremental results.

  Default: `null`.
</ParamField>

## Remove investigation alert

Action ID: `tools.rapid7.remove_investigation_alert`

Remove investigation alert. Calls DELETE /idr/v2/investigations/\{identifier}/alerts/\{alertRrn} directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/removeAlertFromInvestigation](https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/removeAlertFromInvestigation)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="alertRrn" type="string" required>
  The alert RRN.
</ParamField>

<ParamField path="identifier" type="string" required>
  The investigation id or rrn.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="multi_customer" type="boolean | null">
  Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.

  Default: `null`.
</ParamField>

## Replace Community Threat indicators

Action ID: `tools.rapid7.replace_community_threat_indicators`

Replace Community Threat indicators. Calls POST /idr/v1/customthreats/key/\{key}/indicators/replace directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/replaceIndicators](https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/replaceIndicators)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="indicators" type="object" required>
  Free-form documented indicator object containing IP addresses, process hashes, domains, or URLs.
</ParamField>

<ParamField path="key" type="string" required>
  The key of the Community Threat.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

## Run saved query

Action ID: `tools.rapid7.run_saved_query`

Run saved query. Calls GET /log\_search/query/saved\_query/\{saved\_query\_id} directly.

Reference: [https://docs.rapid7.com/insightidr/log-search-api/#operation/useSavedQuery](https://docs.rapid7.com/insightidr/log-search-api/#operation/useSavedQuery)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="saved_query_id" type="string" required>
  The id of the saved query.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="from" type="integer | null">
  Start UNIX timestamp in milliseconds.

  Default: `null`.
</ParamField>

<ParamField path="kvp_info" type="boolean | null">
  Include key-value pair information.

  Default: `null`.
</ParamField>

<ParamField path="most_recent_first" type="boolean | null">
  Return most recent events first.

  Default: `null`.
</ParamField>

<ParamField path="per_page" type="integer | null">
  Number of entries per page.

  Default: `null`.
</ParamField>

<ParamField path="time_range" type="string | null">
  An alternative relative time range.

  Default: `null`.
</ParamField>

<ParamField path="to" type="integer | null">
  End UNIX timestamp in milliseconds.

  Default: `null`.
</ParamField>

## Search accounts

Action ID: `tools.rapid7.search_accounts`

Search accounts. Calls POST /idr/v1/accounts/\_search directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/searchAccounts](https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/searchAccounts)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="index" type="integer | null">
  The optional 0-based page index.

  Default: `null`.
</ParamField>

<ParamField path="search" type="array[object] | null">
  Search criteria with field, operator, and value.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The optional page size.

  Default: `null`.
</ParamField>

<ParamField path="sort" type="array[object] | null">
  Sorting information with field and order.

  Default: `null`.
</ParamField>

## Search alerts

Action ID: `tools.rapid7.search_alerts`

Search alerts. Calls POST /idr/at/alerts/ops/search directly.

Reference: [https://docs.rapid7.com/insightidr/api/alert-triage/#operation/searchAlerts](https://docs.rapid7.com/insightidr/api/alert-triage/#operation/searchAlerts)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="search" type="object" required>
  The search terms to match against.
</ParamField>

<ParamField path="aggregates" type="array[object] | null">
  Aggregations to apply.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="field_ids" type="array[string] | null">
  Additional fields to include.

  Default: `null`.
</ParamField>

<ParamField path="index" type="integer | null">
  The zero-based page index.

  Default: `null`.
</ParamField>

<ParamField path="rrns_only" type="boolean | null">
  Return only alert RRNs when true.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The page size.

  Default: `null`.
</ParamField>

<ParamField path="sorts" type="array[object] | null">
  The sort order.

  Default: `null`.
</ParamField>

## Search assets

Action ID: `tools.rapid7.search_assets`

Search assets. Calls POST /idr/v1/assets/\_search directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/searchAssets](https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/searchAssets)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="index" type="integer | null">
  The optional 0-based page index.

  Default: `null`.
</ParamField>

<ParamField path="search" type="array[object] | null">
  Search criteria with field, operator, and value.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The optional page size.

  Default: `null`.
</ParamField>

<ParamField path="sort" type="array[object] | null">
  Sorting information with field and order.

  Default: `null`.
</ParamField>

## Search InsightAppSec

Action ID: `tools.rapid7.search_appsec`

Search. Calls POST /ias/v1/search directly.

Reference: [https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/perform-search](https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/perform-search)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="query" type="string" required>
  The query for the Search.
</ParamField>

<ParamField path="type" type="string" required>
  Resource type: APP, SCAN, SCAN\_CONFIG, VULNERABILITY, VULNERABILITY\_DISCOVERY, ATTACK\_TEMPLATE, TARGET, ENGINE, ENGINE\_GROUP, SCHEDULE, BLACKOUT, FILE, TAG, or REPORT.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="index" type="integer | null">
  The page index.

  Default: `null`.
</ParamField>

<ParamField path="limitData" type="boolean | null">
  Whether to limit data.

  Default: `null`.
</ParamField>

<ParamField path="page_token" type="string | null">
  The token to retrieve the next page.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The page size.

  Default: `null`.
</ParamField>

<ParamField path="sort" type="string | null">
  The sort criteria.

  Default: `null`.
</ParamField>

## Search InsightVM assets

Action ID: `tools.rapid7.search_vm_assets`

Search assets. Calls POST /vm/v4/integration/assets directly.

Reference: [https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/searchIntegrationAssets](https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/searchIntegrationAssets)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="asset" type="string | null">
  Filter expression for assets.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="comparisonTime" type="string | null">
  Asset comparison time.

  Default: `null`.
</ParamField>

<ParamField path="currentTime" type="string | null">
  Current comparison time.

  Default: `null`.
</ParamField>

<ParamField path="cursor" type="string | null">
  Use the cursor from the previous response.

  Default: `null`.
</ParamField>

<ParamField path="includeInterSnapshotRemediations" type="boolean | null">
  Include inter-snapshot remediations.

  Default: `null`.
</ParamField>

<ParamField path="includeSame" type="boolean | null">
  Include already-existing vulnerabilities.

  Default: `null`.
</ParamField>

<ParamField path="includeUniqueIdentifiers" type="boolean | null">
  Include unique identifiers.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer | null">
  The zero-based page index.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The number of records per page.

  Default: `null`.
</ParamField>

<ParamField path="sort" type="string | null">
  The sort criteria.

  Default: `null`.
</ParamField>

<ParamField path="vulnerability" type="string | null">
  Filter expression for vulnerabilities.

  Default: `null`.
</ParamField>

## Search InsightVM vulnerabilities

Action ID: `tools.rapid7.search_vm_vulnerabilities`

Search vulnerabilities. Calls POST /vm/v4/integration/vulnerabilities directly.

Reference: [https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/searchIntegrationVulnerabilities](https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/searchIntegrationVulnerabilities)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="cursor" type="string | null">
  Use the cursor from the previous response.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer | null">
  The zero-based page index.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The number of records per page.

  Default: `null`.
</ParamField>

<ParamField path="sort" type="string | null">
  The sort criteria.

  Default: `null`.
</ParamField>

<ParamField path="vulnerability" type="string | null">
  Search expression for vulnerabilities.

  Default: `null`.
</ParamField>

## Search investigations

Action ID: `tools.rapid7.search_investigations`

Search investigations. Calls POST /idr/v2/investigations/\_search directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/searchInvestigations](https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/searchInvestigations)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="end_time" type="string | null">
  The end time for the investigation search.

  Default: `null`.
</ParamField>

<ParamField path="index" type="integer | null">
  The optional 0-based index of the page to retrieve.

  Default: `null`.
</ParamField>

<ParamField path="multi_customer" type="boolean | null">
  Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.

  Default: `null`.
</ParamField>

<ParamField path="search" type="array[object] | null">
  The criteria for which investigations to return.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The optional size of the page to retrieve.

  Default: `null`.
</ParamField>

<ParamField path="sort" type="array[object] | null">
  The sorting information.

  Default: `null`.
</ParamField>

<ParamField path="start_time" type="string | null">
  The start time for the investigation search.

  Default: `null`.
</ParamField>

## Search local accounts

Action ID: `tools.rapid7.search_local_accounts`

Search local accounts. Calls POST /idr/v1/assets/local-accounts/\_search directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/searchLocalAccounts](https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/searchLocalAccounts)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="index" type="integer | null">
  The optional 0-based page index.

  Default: `null`.
</ParamField>

<ParamField path="search" type="array[object] | null">
  Search criteria with field, operator, and value.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The optional page size.

  Default: `null`.
</ParamField>

<ParamField path="sort" type="array[object] | null">
  Sorting information with field and order.

  Default: `null`.
</ParamField>

## Search users

Action ID: `tools.rapid7.search_users`

Search users. Calls POST /idr/v1/users/\_search directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/searchUsers](https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/searchUsers)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="index" type="integer | null">
  The optional 0-based page index.

  Default: `null`.
</ParamField>

<ParamField path="search" type="array[object] | null">
  Search criteria with field, operator, and value.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  The optional page size.

  Default: `null`.
</ParamField>

<ParamField path="sort" type="array[object] | null">
  Sorting information with field and order.

  Default: `null`.
</ParamField>

## Set investigation disposition

Action ID: `tools.rapid7.set_investigation_disposition`

Set investigation disposition. Calls PUT /idr/v2/investigations/\{id}/disposition/\{disposition} directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/setDisposition](https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/setDisposition)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="disposition" type="string" required>
  The new value for the investigation.
</ParamField>

<ParamField path="id" type="string" required>
  The id or rrn of the investigation.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="multi_customer" type="boolean | null">
  Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.

  Default: `null`.
</ParamField>

## Set investigation priority

Action ID: `tools.rapid7.set_investigation_priority`

Set investigation priority. Calls PUT /idr/v2/investigations/\{id}/priority/\{priority} directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/setPriority](https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/setPriority)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  The id or rrn of the investigation.
</ParamField>

<ParamField path="priority" type="string" required>
  The new value for the investigation.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="multi_customer" type="boolean | null">
  Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.

  Default: `null`.
</ParamField>

## Set investigation status

Action ID: `tools.rapid7.set_investigation_status`

Set investigation status. Calls PUT /idr/v2/investigations/\{id}/status/\{status} directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/setStatus](https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/setStatus)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  The id or rrn of the investigation.
</ParamField>

<ParamField path="status" type="string" required>
  The new value for the investigation.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="multi_customer" type="boolean | null">
  Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.

  Default: `null`.
</ParamField>

<ParamField path="payload" type="object | null">
  Optional body fields: disposition, threat\_command\_close\_reason, and threat\_command\_free\_text.

  Default: `null`.
</ParamField>

## Start InsightVM scan

Action ID: `tools.rapid7.start_vm_scan`

Start scan. Calls POST /vm/v4/integration/scan directly.

Reference: [https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/startScan](https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/startScan)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native ScanForm body. Fields include asset\_ids, credential\_sources, engine\_ids, name, result\_consumer, solution\_ids, start\_time, and vulnerability\_ids.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

## Stop InsightVM scan

Action ID: `tools.rapid7.stop_vm_scan`

Stop scan. Calls POST /vm/v4/integration/scan/\{id}/stop directly.

Reference: [https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/stopScan](https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/stopScan)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  The identifier of the scan to stop.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

## Submit InsightAppSec scan

Action ID: `tools.rapid7.submit_appsec_scan`

Submit scan. Calls POST /ias/v1/scans directly.

Reference: [https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/submit-scan](https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/submit-scan)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="scan_config_id" type="string" required>
  The ID of the scan configuration.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="scan_type" type="string | null">
  The type of Scan.

  Default: `null`.
</ParamField>

## Submit InsightAppSec scan action

Action ID: `tools.rapid7.submit_appsec_scan_action`

Submit scan action. Calls PUT /ias/v1/scans/\{scan\_id}/action directly.

Reference: [https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/submit-scan-action](https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#operation/submit-scan-action)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="action" type="string" required>
  The action: PAUSE, RESUME, STOP, AUTHENTICATE, or CANCEL.
</ParamField>

<ParamField path="scan_id" type="string" required>
  The identifier of the scan.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

## Update alert

Action ID: `tools.rapid7.update_alert`

Update alert. Calls PATCH /idr/at/alerts/\{alert\_rrn} directly.

Reference: [https://docs.rapid7.com/insightidr/api/alert-triage/#operation/patchAlert](https://docs.rapid7.com/insightidr/api/alert-triage/#operation/patchAlert)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="alert_rrn" type="string" required>
  The unique identifier of the alert.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native request body. Fields include status, disposition, priority, assignee, investigation, tags, and comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

## Update investigation

Action ID: `tools.rapid7.update_investigation`

Update investigation. Calls PATCH /idr/v2/investigations/\{id} directly.

Reference: [https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/updateInvestigation](https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#operation/updateInvestigation)

### Secrets

Required secrets:

* `rapid7`: required values `RAPID7_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  The id or rrn of the investigation.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native request body. Fields include title, status, priority, disposition, assignee, and threat command fields.
</ParamField>

<ParamField path="base_url" type="string | null">
  Regional Insight Platform API base URL (e.g. [https://eu.api.insight.rapid7.com](https://eu.api.insight.rapid7.com)). Regions: us, us2, us3, eu, ca, au, ap.

  Default: `null`.
</ParamField>

<ParamField path="multi_customer" type="boolean | null">
  Indicates whether the requester has multi-customer access. If set to true, a user API key must be provided.

  Default: `null`.
</ParamField>