Rapid7 ASM Assessments, Assets, Certificates, Cloud, Data, Domains, Exposures, Files, Findings, Groups, Identities, and Integrations Tables

Tables

Rapid7SurfaceCommandAssessments

Contains metadata and summary details for Surface Command assessments in Rapid7, including their duration, description, and associated data sources.

Name	Type	Description
ConfigID	integer	Identifier referencing the configuration or environment context in which the assessment data is stored.
ID	string	Unique identifier for the specific Surface Command assessment record.
Description	string	Text summarizing the purpose or focus of the assessment.
EndDate	datetime	Date and time when the assessment concluded.
Name	string	Human-readable name assigned to the assessment.
StartDate	datetime	Date and time when the assessment began.
BatchDate	datetime	Timestamp indicating when the record was last collected or updated in the dataset.
SourcesSerialized	string	Serialized data or list describing the data sources used during the assessment.

Rapid7SurfaceCommandAssets

Contains detailed metadata for assets discovered by Rapid7 Surface Command, including ownership, cloud relationships, operational state, system properties, and detection history.

Name	Type	Description
ConfigID	integer	Identifier referencing the configuration or environment context where the asset record is defined.
ID	string	Unique identifier for the specific asset within Rapid7 Surface Command.
Active	boolean	Indicates whether the asset is currently active in the environment.
AgentVersion	string	Version of the Rapid7 agent or integration component installed on the asset.
AssetClass	string	Classification of the asset (e.g., `Server`, `Workstation`, `IoT`).
AssetTag	string	Unique tag or label used to identify and categorize the asset.
AssetType	string	Type of asset (e.g., `Virtual Machine`, `Container`, `Endpoint`).
Cloud	boolean	Cloud provider or environment where the asset resides (e.g., `AWS`, `Azure`, `GCP`).
CPUs	integer	Number of CPUs or processing cores allocated to the asset.
Description	string	Text description providing context or details about the asset.
EndpointDefinitionsDate	datetime	Timestamp indicating when the endpoint’s definitions or configurations were last updated.
EndpointFirstSeen	datetime	Date when the endpoint was first detected by Surface Command.

Rapid7SurfaceCommandCases

Stores information about case management within Rapid7 Surface Command, detailing creation, ownership, lifecycle state, and associated system components.

Name	Type	Description
ConfigID	integer	Identifier referencing the configuration or environment context where the case record is defined.
ID	string	Unique identifier for the specific case within Rapid7 Surface Command.
AffectedComponentsSerialized	string	Serialized list of affected systems, assets, or components associated with the case.
AssignedToUser	string	Username or identifier of the user currently assigned to the case.
CaseStatus	string	Current status of the case (e.g., `Open`, `In Progress`, `Closed`, `Resolved`).
ClosedDate	datetime	Timestamp indicating when the case was officially closed.
CreatedByUser	string	Username or identifier of the user who created the case.
CreatedDate	datetime	Timestamp indicating when the case was initially created.
Description	string	Text providing context or details about the issue or event being tracked in the case.
IsPartOfRef	string	Indicates whether the case is part of a reference or grouped set of cases.
Name	string	Human-readable name or title of the case.
URL	string	Direct URL link to the case details within the Rapid7 Surface Command platform.
Rapid7SurfaceCommandParentCaseID	string	Identifier linking the case to a parent case, if it is part of a hierarchical or related case group.
Rapid7SurfaceCommandParentCaseConfigID	integer	Configuration context identifier associated with the parent case relationship.
BatchDate	datetime	Date and time when this case record was last collected or updated in the dataset.
SourcesSerialized	string	Serialized list of data sources or integrations contributing information to the case.

Rapid7SurfaceCommandCertificates

Stores details about SSL/TLS certificates detected across cloud and network environments, including validity, ownership, issuer details, and lifecycle tracking information.

Name	Type	Description
ConfigID	integer	Identifier linking the certificate record to its configuration or environment context.
ID	string	Unique identifier assigned to the certificate within Rapid7 Surface Command.
Active	boolean	Indicates whether the certificate is currently valid and in use.
Cloud	boolean	Specifies the cloud provider associated with the certificate (e.g., `AWS`, `Azure`, `GCP`).
CloudAccount	string	The account or subscription name under which the certificate is managed.
Description	string	Text providing context or additional details about the certificate’s purpose or use.
Domain	string	The primary domain or hostname to which the certificate applies.
Environment	string	Classification of the environment, such as `Production`, `Staging`, or `Development`.
FirstSeen	datetime	Date and time when the certificate was first detected by Surface Command.
HashesSerialized	string	Serialized collection of hash values related to the certificate for validation or identification.
IsEncrypted	boolean	Indicates whether the certificate data is encrypted at rest or during transfer.
IsExternal	boolean	Specifies if the certificate is associated with an externally facing or public domain.

Rapid7SurfaceCommandCloudAccountGroups

Contains metadata for cloud account groupings within Rapid7 Surface Command, detailing ownership, provider, operational state, and resource visibility across multiple environments.

Name	Type	Description
ConfigID	integer	Identifier referencing the configuration or environment context associated with the cloud account group record.
ID	string	Unique identifier for the specific cloud account group within Rapid7 Surface Command.
Active	boolean	Indicates whether the cloud account group is currently active and being monitored.
Cloud	boolean	Specifies the cloud provider associated with the account group (e.g., `AWS`, `Azure`, `GCP`).
CloudAccount	string	The name or identifier of the cloud account contained within the group.
Description	string	Text providing context or details about the purpose or structure of the cloud account group.
Environment	string	Designation of the environment where the group operates (e.g., `Production`, `Staging`, `Development`).
FirstSeen	datetime	Timestamp marking the first time the cloud account group was detected or added to Surface Command.
IsEncrypted	boolean	Indicates whether encryption is enabled for data or resources associated with the group.
IsExternal	boolean	Specifies if the group or its resources are exposed to external networks or users.
IsPartOfRef	string	Denotes whether the group belongs to a reference or collection of related configurations.
LastSeen	datetime	The most recent date and time when the cloud account group was observed.

Rapid7SurfaceCommandCloudAccounts

Provides detailed information about individual cloud accounts monitored by Rapid7 Surface Command, including provider metadata, ownership, environment, and operational state.

Name	Type	Description
ConfigID	integer	Identifier linking the record to its configuration or environment context.
ID	string	Unique identifier for the cloud account record in Rapid7 Surface Command.
AccountID	string	The external account identifier provided by the cloud platform (e.g., `AWS Account ID`, `Azure Subscription ID`).
Active	boolean	Indicates whether the cloud account is currently active and monitored.
Cloud	boolean	Specifies the cloud provider associated with the account (e.g., `AWS`, `Azure`, `GCP`).
CloudAccount	string	The human-readable name or alias of the cloud account.
Description	string	Text description providing details about the account’s role, ownership, or scope.
Environment	string	The environment classification for the account (e.g., `Production`, `Development`, `Testing`).
FirstSeen	datetime	Timestamp when the cloud account was first detected or added to Surface Command.
IsEncrypted	boolean	Indicates whether encryption is enabled for the account or its associated resources.
IsExternal	boolean	Specifies if the account manages externally facing or third-party resources.
IsPartOfRef	string	Denotes whether the account is part of a reference or grouped data set.

Rapid7SurfaceCommandCloudOrganizations

Contains metadata and contextual information for cloud organizations monitored by Rapid7 Surface Command, including ownership, provider details, operational state, and hierarchical relationships to accounts and environments.

Name	Type	Description
ConfigID	integer	Identifier referencing the configuration or environment context in which the cloud organization record resides.
ID	string	Unique identifier for the cloud organization within Rapid7 Surface Command.
Active	boolean	Indicates whether the cloud organization is currently active and monitored.
Cloud	boolean	Specifies the cloud provider associated with the organization (e.g., `AWS`, `Azure`, `GCP`).
CloudAccount	string	The primary cloud account name or identifier connected to the organization.
Description	string	Text providing context, purpose, or details about the cloud organization.
Environment	string	The environment classification the organization belongs to (e.g., `Production`, `Development`, `Test`).
FirstSeen	datetime	Timestamp marking when the organization was first detected or integrated with Surface Command.
IsEncrypted	boolean	Indicates whether encryption is enabled for resources or data within the organization.
IsExternal	boolean	Specifies if the organization’s resources are externally exposed or managed by third parties.
IsPartOfRef	string	Denotes whether the organization is part of a reference group or related dataset.
LastSeen	datetime	Timestamp showing the most recent time the organization was observed or updated.

Rapid7SurfaceCommandDataStorages

Contains detailed information about cloud and on-premise data storage assets monitored by Rapid7 Surface Command, including classification, encryption, sensitivity, ownership, and operational context.

Name	Type	Description
ConfigID	integer	Identifier referencing the configuration or environment context where the data storage record is defined.
ID	string	Unique identifier for the specific data storage resource within Rapid7 Surface Command.
Active	boolean	Indicates whether the data storage resource is currently active and monitored.
AssetClass	string	Classification of the storage asset (e.g., Database, Blob Storage, File Share).
AssetTag	string	Unique tag or label used to categorize or identify the storage resource.
AssetType	string	Type of storage resource (e.g., S3 Bucket, Azure Blob, Google Cloud Storage).
Cloud	boolean	Cloud provider hosting the data storage (e.g., AWS, Azure, GCP).
CloudAccount	string	Name or identifier of the cloud account associated with the storage resource.
Description	string	Text providing details or context about the purpose or use of the data storage asset.
Environment	string	The environment classification (e.g., Production, Staging, Development) where the resource resides.
FirstSeen	datetime	Timestamp marking when the data storage was first discovered or added to Surface Command.
IsEncrypted	boolean	Indicates whether encryption is enabled for the data stored in this resource.

Rapid7SurfaceCommandDomains

Provides detailed metadata for domains tracked within Rapid7 Surface Command, including ownership, registrar data, lifecycle timestamps, and cloud or organizational associations.

Name	Type	Description
ConfigID	integer	Identifier linking the domain record to its configuration or environment context.
ID	string	Unique identifier for the domain within Rapid7 Surface Command.
Active	boolean	Indicates whether the domain is currently active and monitored.
Cloud	boolean	Cloud provider associated with the domain, if applicable (e.g., AWS, Azure, GCP).
CloudAccount	string	The name or identifier of the cloud account the domain is tied to.
Description	string	Additional information describing the domain or its purpose.
Environment	string	Environment classification where the domain belongs (e.g., Production, Staging, Development).
ExpiryDate	datetime	The date when the domain registration is set to expire.
FirstSeen	datetime	Timestamp marking when the domain was first detected by Surface Command.
IsEncrypted	boolean	Specifies whether domain-related data is encrypted.
IsExternal	boolean	Indicates whether the domain is externally facing or internet-exposed.
IsPartOfRef	string	Shows if the domain belongs to a reference or related resource set.

Rapid7SurfaceCommandExposures

Stores identified exposures across assets and environments, capturing severity, description, remediation guidance, and metadata from contributing detection sources.

Name	Type	Description
ConfigID	integer	Identifier linking the exposure record to its configuration or environment context.
ID	string	Unique identifier for the specific exposure within Rapid7 Surface Command.
Description	string	Summary or explanation describing the nature of the exposure.
ExposureTypeSerialized	string	Serialized list of exposure categories or types associated with this record.
Name	string	Human-readable title assigned to the exposure.
Severity	string	Risk or impact level assigned to the exposure (e.g., `Low`, `Medium`, `High`, `Critical`).
Solution	string	Recommended remediation steps or guidance for addressing the exposure.
SourcesSerialized	string	Serialized list of data sources contributing details about the exposure.
TagsSerialized	string	Serialized set of tags used to classify or group the exposure.
BatchDate	datetime	Timestamp indicating when the exposure record was last updated or ingested.

Rapid7SurfaceCommandFiles

Catalogs file-level metadata observed across monitored systems, including timestamps, hashing information, encryption status, and associated tags or data sources.

Name	Type	Description
ConfigID	integer	Identifier referencing the configuration or environment context for the file record.
Accessed	string	Timestamp indicating the last time the file was accessed.
Created	string	Timestamp showing when the file was originally created.
Directory	string	The directory path or folder location where the file resides.
Encrypted	boolean	Indicates whether the file is encrypted.
Filehash	string	Primary hash value used to uniquely identify the file’s contents.
Filename	string	Name of the file, including extension.
HashesSerialized	string	Serialized list of associated hash values (e.g., `MD5`, `SHA1`, `SHA256`).
MimeType	string	The file’s MIME type describing its format (e.g., `application/pdf`, `image/png`).
Modified	string	Timestamp indicating when the file was last modified.
Size	integer	Size of the file in bytes.
TagsSerialized	string	Serialized list of tags applied to the file for classification or grouping.
BatchDate	datetime	Timestamp showing when the file record was last updated or ingested.
SourcesSerialized	string	Serialized list of external or internal data sources reporting information about the file.
ID	integer	Unique identifier for the file within Rapid7 Surface Command.

Rapid7SurfaceCommandFindings

Stores all findings detected across assessments, exposures, and vulnerabilities, capturing details such as classification, timestamps, linked entities, and source information.

Name	Type	Description
ConfigID	integer	Identifier linking the finding to its configuration or environment context.
ID	string	Unique identifier for the finding within Rapid7 Surface Command.
Type	string	Classification of the finding (e.g., `vulnerability`, `exposure`, `misconfiguration`).
Description	string	Detailed or summarized explanation describing the nature of the finding.
FirstSeen	datetime	Timestamp marking when the finding was first observed.
LastSeen	datetime	Timestamp indicating when the finding was most recently detected.
Name	string	Human-readable name or label assigned to the finding.
TagsSerialized	string	Serialized list of tags applied to classify or group the finding.
Rapid7SurfaceCommandAssessmentID	string	Identifier linking the finding to a related assessment record.
Rapid7SurfaceCommandAssessmentConfigID	integer	Configuration context associated with the linked assessment.
Rapid7SurfaceCommandVulnerabilityID	string	Identifier referencing an associated vulnerability.
Rapid7SurfaceCommandVulnerabilityConfigID	integer	Configuration context for the related vulnerability record.
Rapid7SurfaceCommandExposureID	string	Identifier connecting the finding to a related exposure.
Rapid7SurfaceCommandExposureConfigID	integer	Configuration context associated with the linked exposure.
BatchDate	datetime	Timestamp indicating when the finding record was last updated or ingested.
AppliesTo	string	Indicates which resource, asset, or entity the finding pertains to.
PartOf	string	Specifies whether the finding belongs to a larger set or grouping.
SourcesSerialized	string	Serialized list of data sources contributing information to this finding.
Status	string	Current lifecycle status of the finding (e.g., `Open`, `Resolved`, `Closed`).

Rapid7SurfaceCommandGroups

Contains detailed records of identity groups discovered by Rapid7 Surface Command, including administrative attributes, authentication details, lifecycle timestamps, and associated metadata.

Name	Type	Description
ConfigID	integer	Identifier referencing the configuration or environment context for the group record.
ID	string	Unique identifier assigned to the group within Rapid7 Surface Command.
Active	boolean	Indicates whether the group is currently active.
Description	string	Text describing the group’s purpose`,` membership`,` or role.
EndDate	datetime	Timestamp showing when the group was deactivated or expired.
FirstSeen	datetime	The date and time when the group was first detected.
HasMFA	boolean	Indicates whether multi-factor authentication is enabled for the group.
IsAdministrator	boolean	Specifies if the group has administrative privileges.
IsExternal	boolean	Indicates whether the group originates from an external identity source.
IsServiceAccount	boolean	Shows whether the group represents or contains service accounts.
LastSeen	datetime	Timestamp of the most recent detection or confirmation of the group.
Name	string	Human-readable name of the group.
StartDate	datetime	Timestamp indicating when the group was created or became active.
BatchDate	datetime	Date and time when the record was last collected or updated.
SourcesSerialized	string	Serialized list of sources or integrations that contributed group information.

Rapid7SurfaceCommandIdentities

Captures detailed identity records across the environment, including personal attributes, authentication details, activity timestamps, ownership metadata, and administrative characteristics.

Name	Type	Description
ConfigID	integer	Identifier linking the identity record to its configuration or environment context.
ID	string	Unique identifier for the identity within Rapid7 Surface Command.
Active	boolean	Indicates whether the identity is currently active.
AddressSerialized	string	Serialized address information associated with the identity.
City	string	City component of the identity’s physical address.
Company	string	The organization or employer associated with the identity.
Country	string	Country component of the identity’s address.
Department	string	Department or business unit the identity belongs to.
Description	string	Additional context or notes describing the identity.
Email	string	Email address assigned to the identity.
EmployeeID	string	Internal employee identifier.
EndDate	datetime	Timestamp marking when the identity became inactive or ended.

Rapid7SurfaceCommandIntegrations

Stores configuration and lifecycle details for third-party integrations connected to Rapid7 Surface Command, including creation metadata, status, and connection endpoints.

Name	Type	Description
ID	integer	Unique identifier for the integration record within Rapid7 Surface Command.
BaseURL	string	The base URL used by the integration to communicate with the external system or service.
CreatedDate	datetime	Timestamp indicating when the integration was initially created.
ModifiedDate	datetime	Timestamp showing the most recent update or modification to the integration.
CreatedBy	string	Identifier or username of the user who created the integration.
ModifiedBy	string	Identifier or username of the user who last modified the integration.
IntegrationID	integer	External or platform-specific identifier for the integration.
Name	string	Human-readable name given to the integration.
IsEnabled	boolean	Indicates whether the integration is currently enabled and active.

Rapid7SurfaceCommandIPAddresses

Stores metadata and classification details for IP addresses discovered by Rapid7 Surface Command, including cloud associations, ownership, lifecycle timestamps, and network relationships.

Name	Type	Description
ConfigID	integer	Identifier tying the IP address record to a specific configuration or environment context.
ID	string	Unique identifier for the IP address within Rapid7 Surface Command.
Active	boolean	Indicates whether the IP address is currently active in the environment.
Cloud	boolean	The cloud provider associated with the IP address, if applicable (e.g., AWS, Azure, GCP).
CloudAccount	string	The cloud account name or identifier linked to the IP address.
Description	string	Additional details describing the purpose or context of the IP address.
Environment	string	The environment classification (e.g., Production, Development, Testing).
FirstSeen	datetime	Timestamp marking when the IP address was first detected.
IsEncrypted	boolean	Indicates whether related data or traffic is encrypted.
IsExternal	boolean	Specifies whether the IP address is internet-exposed or externally accessible.
IsPartOfRef	string	Shows whether the IP address belongs to a reference grouping or collection.
LastSeen	datetime	Timestamp when the IP address was most recently observed.