Rapid7 Application Security Tables

The Rapid7 Application Security integration uses the following tables

Tables

Rapid7IASApps

Stores Rapid7 InsightAppSec application records representing the web applications registered for dynamic security scanning.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the application.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
NamestringDisplay name of the application as defined in InsightAppSec.
DescriptionstringOptional description providing additional context about the application.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASTargets

Contains scan target records defining the domain URLs or IP addresses associated with InsightAppSec applications.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the scan target.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
DomainstringDomain URL or IP address of the web application target to be scanned.
EnabledbooleanIndicates whether the target is currently enabled for scanning.
ArchivedbooleanIndicates whether the target has been archived and is no longer actively used.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASBlackouts

Records blackout window configurations that define scheduled periods during which scans are blocked from running.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the blackout window.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
NamestringDisplay name of the blackout window.
ScopestringScope of the blackout, indicating whether it applies at the application or organization level (e.g., APP, ORG).
EnabledbooleanIndicates whether the blackout window is currently enabled.
ActivebooleanIndicates whether the blackout window is currently active and blocking scans.
AppIDstringIdentifier of the application to which this blackout window is scoped, if applicable.
FirstStartdatetimeTimestamp of the first scheduled start of the blackout window.
FirstEnddatetimeTimestamp of the first scheduled end of the blackout window.
LastStartdatetimeTimestamp of the most recent start of the blackout window.
BlackoutFrequencyTypestringRecurrence frequency type of the blackout window (e.g., ONCE, DAILY, WEEKLY, MONTHLY).
BlackoutFrequencyIntervalintegerNumeric interval between recurrences of the blackout window, based on the frequency type.
RrulestringRFC 5545 iCalendar recurrence rule (RRULE) string defining the blackout window's recurrence schedule.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASScanConfigs

Stores scan configuration records defining the settings, attack templates, engine assignments, and incremental scan options used to scan applications.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the scan configuration.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
NamestringDisplay name of the scan configuration.
DescriptionstringOptional description providing additional context about the scan configuration.
AppIDstringIdentifier of the application this scan configuration belongs to.
AttackTemplateIDstringIdentifier of the attack template used by this scan configuration to determine which attack modules are run.
IncrementalbooleanIndicates whether incremental scanning is enabled, limiting attacks to new or changed URLs since the last scan.
EngineAssignmentTypestringMethod used to assign a scan engine to this configuration (e.g., DEFAULT, ENGINE, ENGINE_GROUP).
EngineAssignmentIDstringIdentifier of the specific engine or engine group assigned to this scan configuration.
EngineAssignmentEnvironmentstringDeployment environment of the assigned scan engine (e.g., CLOUD, ON_PREMISE).
ErrorsSerializedstringSerialized list of validation errors associated with the scan configuration.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASSchedules

Contains scan schedule records that define the automated recurrence rules for triggering scans against scan configurations.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the scan schedule.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
NamestringDisplay name of the scan schedule.
EnabledbooleanIndicates whether the scan schedule is currently enabled and will trigger scans automatically.
ScanConfigIDstringIdentifier of the scan configuration this schedule is associated with.
FirstStartdatetimeTimestamp of the first scheduled scan start defined by this schedule.
LastStartdatetimeTimestamp of the most recent scheduled scan start triggered by this schedule.
ScheduleFrequencyTypestringRecurrence frequency type for the schedule (e.g., ONCE, DAILY, WEEKLY, MONTHLY).
ScheduleFrequencyIntervalintegerNumeric interval between recurrences of the schedule, based on the frequency type.
RrulestringRFC 5545 iCalendar recurrence rule (RRULE) string defining the schedule's recurrence pattern.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASScans

Records individual scan executions in InsightAppSec, including submission details, status, scan type, and completion information.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the scan.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
AppIDstringIdentifier of the application this scan was run against.
ScanConfigIDstringIdentifier of the scan configuration used to run this scan.
SubmitterIDstringIdentifier of the user or entity that submitted the scan.
SubmitterTypestringType of entity that submitted the scan (e.g., USER, SCHEDULE, API).
SubmitTimedatetimeTimestamp when the scan was submitted.
CompletionTimedatetimeTimestamp when the scan completed.
StatusstringCurrent status of the scan (e.g., PENDING, RUNNING, COMPLETE, FAILED, PAUSED, BLACKED_OUT).
ScanTypestringType of scan performed (e.g., REGULAR, VALIDATION, CRAWL_ONLY).
ValidationParentScanIDstringIdentifier of the parent scan this validation scan is based on, if applicable.
SpecializedScanParametersIDstringIdentifier of the specialized scan parameters record associated with this scan.
SpecializedScanParametersScanIDstringScan ID referenced within the specialized scan parameters for this scan.
SpecializedScanParametersParentScanIDstringParent scan ID referenced within the specialized scan parameters, used for incremental or validation scans.
FailureReasonstringDescription of the reason the scan failed, if applicable.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASScanEvents

Stores log events captured during scan execution, providing a real-time audit trail of scan actions and status transitions.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the scan event record.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
ScanIDstringIdentifier of the scan this event is associated with.
TimestringTimestamp when the scan event occurred.
EventstringDescription of the scan event that occurred (e.g., Scan started, Authentication failed, Scan completed).
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASVulnerabilities

Primary table of vulnerabilities discovered by InsightAppSec scans, including severity, status, root cause, CVSS score, and discovery timestamps.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the vulnerability.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
AppIDstringIdentifier of the application in which the vulnerability was discovered.
RootCauseUrlstringURL of the application endpoint where the vulnerability was identified.
RootCauseParameterstringHTTP parameter that was the root cause or attack vector for the vulnerability.
RootCauseMethodstringHTTP method associated with the vulnerable request (e.g., GET, POST, PUT).
SeveritystringSeverity level of the vulnerability (e.g., INFORMATIONAL, LOW, MEDIUM, HIGH, CRITICAL).
StatusstringCurrent remediation status of the vulnerability (e.g., UNREVIEWED, REVIEWED, FALSE_POSITIVE, REMEDIATED_MANUALLY, REMEDIATED).
FirstDiscovereddatetimeTimestamp when the vulnerability was first discovered by a scan.
LastDiscovereddatetimeTimestamp when the vulnerability was most recently confirmed by a scan.
NewlyDiscoveredbooleanIndicates whether the vulnerability was newly discovered in the most recent scan run.
VectorStringstringCVSS vector string representing the scoring metrics for the vulnerability.
VulnerabilityScorefloatNumeric CVSS-based score quantifying the severity of the vulnerability (0.0–10.0).
InsightUiUrlstringDirect URL to the vulnerability detail page in the InsightAppSec user interface.
UpdatedTimedatetimeTimestamp when the vulnerability record was last updated.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASVulnerabilityComments

Contains comments added by users to vulnerability records, including content, author, and creation and update timestamps.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the vulnerability comment.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
VulnerabilityIDstringIdentifier of the vulnerability this comment is associated with.
AuthorIDstringIdentifier of the user who originally authored the comment.
LastUpdateAuthorIDstringIdentifier of the user who last updated the comment.
ContentstringText content of the comment added to the vulnerability.
Rapid7CreateTimestringTimestamp when the comment was originally created.
Rapid7UpdateTimestringTimestamp when the comment was most recently updated.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASVulnerabilityDiscoveries

Records each scan event in which a vulnerability was discovered, linking vulnerabilities to the specific scans that identified them.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the vulnerability discovery record.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
VulnerabilityIDstringIdentifier of the vulnerability this discovery record is associated with.
ScanIDstringIdentifier of the scan during which the vulnerability was discovered.
DiscoveredstringTimestamp when the vulnerability was discovered during the associated scan.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASVulnerabilityUpdates

Stores update events applied to vulnerability records, capturing the source of each change and a serialized list of field-level modifications.

NameTypeDescription
Rapid7IASVulnerabilityIDstringIdentifier of the vulnerability this update record is associated with.
IDstringUnique Rapid7-generated UUID identifying the vulnerability update record.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
CreateTimestringTimestamp when the vulnerability update was recorded.
VulnerabilityUpdateSourceSourceIdstringIdentifier of the source entity (such as a user or scan) that triggered the vulnerability update.
VulnerabilityUpdateSourceSourceTypestringType of source that triggered the update (e.g., USER, SCAN).
ChangesSerializedstringSerialized list of field-level changes included in this vulnerability update.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASVulnerabilityChanges

Contains individual field-level change records for vulnerability updates, capturing the field name, previous value, and new value.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the vulnerability change record.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
FieldstringName of the vulnerability field that was changed (e.g., status, severity).
PreviousValuestringValue of the field before the change was applied.
NewValuestringValue of the field after the change was applied.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASVariances

Records individual attack variances associated with vulnerabilities, including the attack payload, proof of exploitation, and external references.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the variance record.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
OriginalExchangeIDstringIdentifier of the original HTTP exchange (request/response) that the attack was based on.
ModuleIDstringIdentifier of the attack module that generated this variance.
AttackIDstringIdentifier of the specific attack that was executed to produce this variance.
AttackValuestringPayload or value injected by the attack during the variance.
MessagestringHuman-readable message describing the finding or outcome of the attack variance.
ProofstringEvidence string extracted from the application response that confirms the vulnerability.
ReferencesSerializedstringSerialized list of external references (such as CVEs or CWEs) related to this variance.
ProofDescriptionstringHuman-readable description explaining the significance of the proof extracted from the response.
OriginalValuestringOriginal value of the attacked parameter before the attack payload was injected.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASAttackExchanges

Stores the raw HTTP request and response pairs captured during attack exchanges, providing full evidence for variance findings.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the attack exchange record.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
VarianceIDstringIdentifier of the variance this attack exchange is associated with.
RequeststringRaw HTTP request sent by the scanner during the attack exchange.
ResponsestringRaw HTTP response received from the application during the attack exchange.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASAppFiles

Contains application file records such as macros, traffic files, and API definitions uploaded and associated with InsightAppSec applications.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the application file.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
AppIDstringIdentifier of the application this file is associated with.
NamestringDisplay name of the application file.
DescriptionstringOptional description of the application file and its purpose.
TypestringType classification of the application file (e.g., MACRO, TRAFFIC, SELENIUM, OPENAPI).
LockedbooleanIndicates whether the file is locked and cannot be modified.
OwnerIDstringIdentifier of the user who owns the application file.
ContentAvailablebooleanIndicates whether the file content is available for download.
LastUpdatedByUserIDstringIdentifier of the user who last updated the application file.
LastUpdateddatetimeTimestamp when the application file was last updated.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASAppTags

Records tags applied to InsightAppSec applications, used for categorization and filtering within the platform.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the application tag.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
AppIDstringIdentifier of the application this tag is associated with.
NamestringName of the tag applied to the application.
CreatorIDstringIdentifier of the user who created the tag.
Rapid7CreateTimestringTimestamp when the application tag was created.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASReports

Stores generated report records for InsightAppSec applications, including report type, format, generation status, and ownership.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the report.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
NamestringDisplay name of the report.
TypestringType of report generated (e.g., COMPLIANCE, EXECUTIVE_SUMMARY, VULNERABILITY).
FormatstringFile format of the generated report (e.g., PDF, HTML, CSV).
OwnerIDstringIdentifier of the user who owns or generated the report.
GeneratedDatedatetimeTimestamp when the report was generated.
AppIDstringIdentifier of the application the report is scoped to.
StatusstringCurrent generation status of the report (e.g., PENDING, COMPLETE, FAILED).
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASUsers

Contains user account records for InsightAppSec platform users associated with an integration configuration.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the InsightAppSec user.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASAttackTemplates

Stores attack template definitions that control which attack modules are included in a scan and how they are prioritized and configured.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the attack template.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
NamestringDisplay name of the attack template (e.g., All Modules, SQL Injection Only).
DescriptionstringDescription of the attack template and the types of vulnerabilities it is designed to test.
SystemDefinedbooleanIndicates whether the attack template is a built-in system template provided by Rapid7.
BrowserEncodingEnabledbooleanIndicates whether browser-based encoding is applied to attack payloads in this template.
AttackPrioritizationstringStrategy used to prioritize which attacks are executed first (e.g., SEQUENTIAL, SMART).
AdvancedAttacksEnabledbooleanIndicates whether advanced attack techniques are enabled in this template.
FalsePositiveRegexstringRegular expression pattern used to identify and exclude false positive responses from vulnerability findings.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASAttackTemplateModules

Records the individual attack module associations within attack templates, including enabled status, severity overrides, and parameter location targeting.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the attack template module association.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
AttackTemplateIDstringIdentifier of the attack template this module is associated with.
ModuleConfigIDstringIdentifier of the attack module configuration used within this template.
EnabledbooleanIndicates whether this module is enabled within the associated attack template.
ParameterLocationsSerializedstringSerialized list of HTTP parameter locations this module targets (e.g., QUERY, BODY, HEADER, COOKIE).
SeveritystringSeverity level override for findings from this module within the template (e.g., LOW, MEDIUM, HIGH, CRITICAL).
MaxFindingsintegerMaximum number of findings this module is allowed to report within the template before stopping.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASAttackModuleConfigs

Contains attack module configuration records defining the vulnerability types, severity, and parameter targets for individual attack modules.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the attack module configuration.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
NamestringDisplay name of the attack module configuration.
DescriptionstringDescription of the attack module configuration and the vulnerability class it targets.
TypesSerializedstringSerialized list of attack module types included in this configuration (e.g., ACTIVE, PASSIVE).
MaxFindingsintegerMaximum number of findings this module configuration can report before stopping.
SeveritystringDefault severity level for findings from this attack module configuration (e.g., LOW, MEDIUM, HIGH, CRITICAL).
ParameterLocationsSerializedstringSerialized list of HTTP parameter locations targeted by this attack module configuration (e.g., QUERY, BODY, HEADER, COOKIE).
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASModuleConfigs

Stores module configuration records representing the available InsightAppSec attack and passive modules with their default severity and targeting settings.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the module configuration.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
NamestringDisplay name of the module configuration.
DescriptionstringDescription of the module configuration and the vulnerability class it covers.
TypesSerializedstringSerialized list of module types for this configuration (e.g., ACTIVE, PASSIVE).
MaxFindingsintegerMaximum number of findings this module configuration can report before stopping.
SeveritystringDefault severity level for findings from this module configuration (e.g., LOW, MEDIUM, HIGH, CRITICAL).
ParameterLocationsSerializedstringSerialized list of HTTP parameter locations targeted by this module configuration (e.g., QUERY, BODY, HEADER, COOKIE).
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASAttackMetadata

Records metadata for individual attacks within modules, including attack class, type, and descriptive information.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the attack metadata record.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
ModuleIDstringIdentifier of the attack module this metadata belongs to.
TypestringType classification of the attack (e.g., ACTIVE, PASSIVE).
AttackClassstringClass or category of the attack (e.g., SQL_INJECTION, XSS, PATH_TRAVERSAL).
DescriptionstringHuman-readable description of the attack and the vulnerability class it targets.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASAttackDocumentation

Contains documentation for individual attacks, including descriptions, external references, and remediation recommendations.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the attack documentation record.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
ModuleIDstringIdentifier of the attack module this documentation is associated with.
AttackIDstringIdentifier of the specific attack this documentation describes.
ReferencesSerializedstringSerialized list of external references (such as OWASP, CVE, or CWE links) for the attack.
DescriptionstringHuman-readable description of the attack, explaining how it works and what it exploits.
RecommendationstringRecommended remediation steps to address the vulnerability identified by this attack.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASVarianceDocumentation

Stores documentation associated with variance findings, including descriptions, external references, and recommended remediation steps.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the variance documentation record.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
ReferencesSerializedstringSerialized list of external references (such as OWASP, CVE, or CWE links) for the variance.
DescriptionstringHuman-readable description of the variance finding and its security implications.
RecommendationstringRecommended remediation steps to address the vulnerability identified by this variance.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASRootCauses

Contains root cause records identifying the specific URL, HTTP method, and parameter associated with a vulnerability.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the root cause record.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
UrlstringURL of the application endpoint identified as the root cause of the vulnerability.
ParameterstringHTTP parameter identified as the root cause or primary attack vector for the vulnerability.
MethodstringHTTP method associated with the root cause request (e.g., GET, POST, PUT).
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASEngineGroups

Stores engine group definitions used to organize and assign scan engines to scan configurations.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the engine group.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
NamestringDisplay name of the engine group.
DescriptionstringDescription of the engine group and its intended usage.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.

Rapid7IASEngines

Contains scan engine records representing the on-premise or cloud engines used to execute InsightAppSec scans, including version and status details.

NameTypeDescription
IDstringUnique Rapid7-generated UUID identifying the scan engine.
ConfigIDintegerUnique identifier linking the record to a specific Rapid7 InsightAppSec integration configuration.
NamestringDisplay name of the scan engine.
EngineGroupIDstringIdentifier of the engine group this engine belongs to.
StatusstringCurrent operational status of the scan engine (e.g., ACTIVE, INACTIVE, ERROR, UPDATING).
FailureReasonstringDescription of the reason the engine is in a failed or error state, if applicable.
LatestVersionbooleanIndicates whether the engine is running the latest available version of the scan engine software.
UpgradeablebooleanIndicates whether the engine is eligible for an upgrade to a newer version.
AutoUpgradebooleanIndicates whether the engine is configured to automatically upgrade when a new version is available.
BatchDatedatetimeTimestamp indicating when the record was ingested or last refreshed by the integration.


Did this page help you?