Guillaume BOURGEOIS
729c339e2f
REST API integration for Rapid7 InsightIDR. Investigation ingestion (list_investigations) with an exhaustive OCSF mapper and a bundled default incident type, plus 18 commands across investigations (list/get/search/ create/update/assign/set-status/bulk-close), investigation alerts and Rapid7 product alerts, custom threat indicators (add/replace), log management and LEQL log/log-set queries with downloads, and user directory search. API v1/v2 selectable per instance (is_v2) and per command (api_version); multi-customer query parameter supported on v2 calls. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
34 lines
3.4 KiB
YAML
34 lines
3.4 KiB
YAML
name: "Rapid7 InsightIDR Investigations → OCSF"
|
|
description: "Maps a Rapid7 InsightIDR investigation (idr/v2/investigations, results_path = data) to OCSF Incident Finding fields. Investigations aggregate the applicable alert data; use list_investigation_alerts for per-alert detail. v1 (id) and v2 (rrn) shapes are both covered via fallbacks."
|
|
field_mappings:
|
|
title: "title"
|
|
# toSeverity maps CRITICAL→5, HIGH→3, MEDIUM→2, LOW→1; UNSPECIFIED falls back to the rule default.
|
|
severity: "priority"
|
|
# How the investigation was generated (USER / ALERT).
|
|
source: "source"
|
|
# results_path = data; source_path is JSONata over ONE investigation object.
|
|
# Paths absent from a given investigation return nothing and are skipped, so v1/v2 fallbacks are safe.
|
|
ocsf:
|
|
# ── Finding ───────────────────────────────────────────────────────
|
|
- { source_path: "rrn ? rrn : id", ocsf_field: "finding_info.uid" }
|
|
- { source_path: "title", ocsf_field: "finding_info.title" }
|
|
- { source_path: "created_time", ocsf_field: "finding_info.created_time" }
|
|
- { source_path: "last_accessed", ocsf_field: "finding_info.modified_time" }
|
|
- { source_path: "first_alert_time ? first_alert_time : alert.first_event_time", ocsf_field: "finding_info.first_seen_time" }
|
|
- { source_path: "latest_alert_time", ocsf_field: "finding_info.last_seen_time" }
|
|
- { source_path: "tags", ocsf_field: "metadata.labels" }
|
|
# ── Incident state ────────────────────────────────────────────────
|
|
- { source_path: "status", ocsf_field: "status" }
|
|
- { source_path: "priority", ocsf_field: "priority" }
|
|
- { source_path: "disposition", ocsf_field: "disposition" }
|
|
- { source_path: "source", ocsf_field: "activity_name" }
|
|
- { source_path: "responsibility", ocsf_field: "comment" }
|
|
# ── Assignee (User) ───────────────────────────────────────────────
|
|
- { source_path: "assignee.name ? assignee.name : assignee_name", ocsf_field: "assignee.name" }
|
|
- { source_path: "assignee.email ? assignee.email : assignee_email", ocsf_field: "assignee.email_addr" }
|
|
# ── Owning organization ───────────────────────────────────────────
|
|
- { source_path: "organization_id", ocsf_field: "cloud.org.uid" }
|
|
# ── Originating alert (v1 shape) ──────────────────────────────────
|
|
- { source_path: "alert.type", ocsf_field: "finding_info.analytic.name" }
|
|
- { source_path: "alert.type_description", ocsf_field: "finding_info.analytic.desc" }
|