Rapid7 ASM Locations, Mitigations, Networks, Organizations, Repositories, Saved Queries, Security, and Software Tables

Tables

Rapid7SurfaceCommandLocations

Represents physical or logical locations managed or monitored within Rapid7 Surface Command, capturing geographic, organizational, and ownership details along with metadata from various data sources.

Name	Type	Description
ConfigID	integer	Identifier linking the location record to its configuration or environmental context.
ID	string	Unique identifier for the location within Rapid7 Surface Command.
AddressSerialized	string	Serialized representation of the location’s full address.
City	string	The city where the location is situated.
Country	string	The country associated with the physical location.
Description	string	Additional details or notes describing the location.
Latitude	decimal	Geographic latitude coordinate for the location.
Longitude	decimal	Geographic longitude coordinate for the location.
Name	string	Human-readable name assigned to the location.
Organization	string	The organization or business unit responsible for or associated with the location.
OwnersSerialized	string	Serialized list of owners or business stakeholders for the location.
IsPartOfRef	string	Indicates whether this location is part of a reference or grouped dataset.

Rapid7SurfaceCommandMitigations

Contains defined mitigation actions or recommendations within Rapid7 Surface Command, providing descriptive details and associated metadata to guide remediation efforts.

Name	Type	Description
ConfigID	integer	Identifier tying the mitigation record to its configuration or environment context.
ID	string	Unique identifier for the mitigation entry within Rapid7 Surface Command.
Description	string	Explanation of the mitigation action, purpose, or recommended steps.
Name	string	Human-readable name or label assigned to the mitigation.
BatchDate	datetime	Timestamp indicating when the mitigation record was last refreshed or imported.
SourcesSerialized	string	Serialized list of data sources contributing information about the mitigation.

Rapid7SurfaceCommandNetworks

Offers structured details about networks discovered and monitored by Surface Command, capturing cloud associations, ownership metadata, operational state, and CIDR-based network boundaries for visibility and analysis.

Name	Type	Description
ConfigID	integer	Identifier linking the network record to its configuration or environment context.
ID	string	Unique identifier for the network within Rapid7 Surface Command.
Active	boolean	Indicates whether the network is currently active and being monitored.
ASN	string	Autonomous System Number associated with the network.
AssetClass	string	Classification of the network asset (e.g., `Internal Network`, `Public Network`).
AssetTag	string	Unique tag or label assigned to categorize the network asset.
AssetType	string	Type of network asset (e.g., `VPC`, `Subnet`, `Network Segment`).
CIDRSerialized	string	Serialized list of CIDR blocks defining the network ranges.
Cloud	boolean	Cloud provider associated with the network (e.g., `AWS`, `Azure`, `GCP`).
CloudAccount	string	Name or identifier of the cloud account containing the network.
Description	string	Additional notes or contextual details describing the network.
Environment	string	Environment classification such as `Production`, `Staging`, or `Development`.

Rapid7SurfaceCommandNetworkServices

Provides detailed visibility into network services detected across cloud and on-prem environments, including ports, protocols, encryption details, ownership, and operational status, helping identify exposed or sensitive service endpoints.

Name	Type	Description
ConfigID	integer	Identifier linking the network service record to its configuration or environment context.
ID	string	Unique identifier for the network service within Rapid7 Surface Command.
Active	boolean	Indicates whether the service is currently active and monitored.
CertificateSerialized	string	Serialized details of the certificate associated with the service.
Cloud	boolean	Cloud provider hosting the service (e.g., `AWS`, `Azure`, `GCP`).
CloudAccount	string	The cloud account name or identifier tied to the service.
Description	string	Text providing additional context or explanation of the service.
Environment	string	Environment type such as `Production`, `Staging`, or `Development`.
FirstSeen	datetime	Timestamp when the service was first observed.
Hostname	string	Hostname associated with the service endpoint.
IP	string	IP address on which the service was detected.
IsEncrypted	boolean	Indicates whether the service uses encryption (e.g., `HTTPS`, `TLS`).

Rapid7SurfaceCommandOrganizations

Represents organizations discovered or managed within Surface Command, capturing ownership, hierarchy, configuration context, and metadata from various integrated data sources.

Name	Type	Description
ConfigID	integer	Identifier linking the organization record to its configuration or environment context.
ID	string	Unique identifier for the organization entry within Rapid7 Surface Command.
Description	string	Additional information describing the organization or its purpose.
Name	string	Human-readable name of the organization.
Organization	string	Name of the broader business entity or parent organization associated with this record.
OwnersSerialized	string	Serialized list of business owners responsible for the organization.
TechnicalOwnersSerialized	string	Serialized list of technical stakeholders or administrators tied to the organization.
UsersSerialized	string	Serialized list of users associated with or operating within the organization.
Rapid7SurfaceCommandOrganizationID	string	Internal identifier linking the record to a parent or related organization object.
Rapid7SurfaceCommandOrganizationConfigID	integer	Configuration context associated with the linked organization entry.
BatchDate	datetime	Timestamp showing when the record was last collected, synced, or updated.
SourcesSerialized	string	Serialized list of external or internal data sources contributing information about the organization.

Rapid7SurfaceCommandRepositories

Provides structured information about repositories discovered across cloud and development environments, detailing ownership, artifacts, operational states, provider associations, and hierarchical relationships for enhanced visibility and governance.

Name	Type	Description
ConfigID	integer	Identifier linking the repository record to its configuration or environment context.
ID	string	Unique identifier for the repository within Rapid7 Surface Command.
Active	boolean	Indicates whether the repository is currently active and monitored.
ArtifactsSerialized	string	Serialized list of artifacts (e.g., images, packages) stored within the repository.
Cloud	boolean	Cloud provider hosting the repository (e.g., AWS, Azure, GCP).
CloudAccount	string	Cloud account name or identifier associated with the repository.
Description	string	Additional descriptive information about the repository's purpose or usage.
Environment	string	Environment classification (e.g., Production, Development, Staging).
FirstSeen	datetime	Timestamp when the repository was initially detected by Surface Command.
IsEncrypted	boolean	Indicates whether the repository or its stored artifacts are encrypted.
IsExternal	boolean	Specifies if the repository is externally accessible or managed outside the organization.
IsPartOfRef	string	Indicates whether the repository is part of a reference or grouped dataset.

Rapid7SurfaceCommandSavedQueries

Contains user-defined and shared saved queries within Surface Command, capturing metadata, ownership, history, and the Cypher logic used to retrieve insights from the platform’s graph data model.

Name	Type	Description
ConfigID	integer	Identifier linking the saved query record to its configuration or environment context.
ID	integer	Unique identifier for the saved query entry within Rapid7 Surface Command.
QueryID	string	Identifier referencing the underlying query definition.
Name	string	Human-readable name given to the saved query.
Description	string	Text explaining the purpose, logic, or intent of the query.
CypherQuery	string	The actual Cypher query string executed against the graph database.
CreatedBy	string	User or system that originally created the saved query.
CreatedTime	datetime	Timestamp marking when the query was first created.
UpdatedTime	datetime	Timestamp indicating the most recent modification of the query.
LastRun	datetime	Timestamp of the last time the query was executed.
Favorite	boolean	Indicates whether the query has been marked as a favorite by the user.
Shared	boolean	Specifies whether the query is shared across users or teams.
Folder	string	Folder or category where the query is stored for organizational purposes.
Organization	string	Name of the organization or workspace where the query belongs.
RawQueryNodeJSON	string	Raw JSON representing the query’s graph structure, nodes, or metadata.
BatchDate	datetime	Timestamp showing when the query record was last ingested or updated.

Rapid7SurfaceCommandSecurityEvents

Captures notable security-related events detected across the environment, consolidating description, origin sources, and metadata used for investigation and analysis.

Name	Type	Description
ConfigID	integer	Identifier linking the security event record to its configuration or environment context.
ID	string	Unique identifier for the specific security event within Rapid7 Surface Command.
Description	string	Summary or details explaining the nature or context of the security event.
Name	string	Human-readable name or title assigned to the event.
BatchDate	datetime	Timestamp marking when the security event record was last collected or updated.
SourcesSerialized	string	Serialized list of data sources that reported or contributed information about the event.

Rapid7SurfaceCommandSoftware

Provides detailed inventory and metadata of software components detected across assets, cloud accounts, and environments, capturing vendor details, versioning, lifecycle state, ownership, and platform context for security and governance.

Name	Type	Description
ConfigID	integer	Identifier linking the software record to its configuration or environment context.
ID	string	Unique identifier for the software entry within Rapid7 Surface Command.
Active	boolean	Indicates whether the software is currently active or in use.
Cloud	boolean	Cloud provider associated with the software, if applicable (e.g., AWS, Azure, GCP).
CloudAccount	string	Cloud account name or identifier tied to the software component.
CPE	string	Common Platform Enumeration identifier representing the software in a standardized format.
Description	string	Additional details describing the software’s function, purpose, or usage.
Environment	string	Environment classification where the software is deployed (e.g., Production, Development).
FirstSeen	datetime	Timestamp indicating when the software was initially detected.
IsDiscontinued	boolean	Indicates whether the software is no longer supported or has reached end of life.
IsEncrypted	boolean	Shows whether the software’s data or communication is encrypted.
IsExternal	boolean	Specifies whether the software is externally accessible or managed outside the organization.

Rapid7SurfaceCommandSystems

Represents logical or composite systems discovered across environments, capturing operational state, ownership, classification, and component membership to help track critical services and their associated risks.

Name	Type	Description
ConfigID	integer	Identifier linking the system record to its configuration or environment context.
ID	string	Unique identifier for the system within Rapid7 Surface Command.
Active	boolean	Indicates whether the system is currently active and observable.
Cloud	boolean	Cloud provider associated with the system.
Criticality	string	Assigned importance or impact rating of the system (e.g., low, medium, high, mission-critical).
Description	string	Additional context or details describing the system’s purpose or role.
FirstSeen	datetime	Timestamp marking when the system was first detected in the environment.
InformationTypeSerialized	string	Serialized representation of data classifications or information types handled by the system.
IsAutoscaling	boolean	Indicates whether the system is part of an autoscaling group or dynamic compute pool.
IsEncrypted	boolean	Specifies whether the system or its data is encrypted.
IsPartOfRef	string	Indicates whether this system belongs to a reference group or dataset.
LastSeen	datetime	Timestamp when the system was most recently observed.

Rapid7SurfaceCommandTemplates

Represents system or cloud templates discovered across environments, capturing metadata, ownership, deployment lineage, operational state, and hierarchical relationships to support visibility into standardized resource provisioning.

Name	Type	Description
ConfigID	integer	Identifier linking the template record to its configuration or environment context.
ID	string	Unique identifier for the template within Rapid7 Surface Command.
Active	boolean	Indicates whether the template is currently active or in use.
Cloud	boolean	Cloud provider associated with the template (e.g., AWS, Azure, GCP).
CloudAccount	string	Cloud account name or identifier connected to the template.
Description	string	Summary or additional context explaining the template’s purpose.
Environment	string	Environment classification such as Production, Development, or Staging.
FirstSeen	datetime	Timestamp marking when the template was first detected.
InstancesSerialized	string	Serialized list of instances deployed from or associated with the template.
IsEncrypted	boolean	Shows whether any associated data or components of the template are encrypted.
IsExternal	boolean	Indicates if the template originates from or is accessible outside the organization.
IsPartOfRef	string	Identifies whether the template belongs to a reference grouping or hierarchy.

Rapid7SurfaceCommandThreats

Captures threat intelligence items identified across the environment, including descriptions, targeted components, and source context to support risk analysis and correlation.

Name	Type	Description
ConfigID	integer	Identifier linking the threat record to its configuration or ingestion context.
ID	string	Unique identifier for the threat within Rapid7 Surface Command.
Description	string	Summary or explanation describing the nature or intent of the threat.
Name	string	Human-readable title or label assigned to the threat.
TargetsComponentRefsSerialized	string	Serialized list of component references targeted or affected by the threat.
BatchDate	datetime	Timestamp showing when the threat record was last ingested or refreshed.
SourcesSerialized	string	Serialized list of internal or external data sources reporting the threat.

Rapid7SurfaceCommandVulnerabilities

Maintains detailed vulnerability intelligence, combining severity, exploit status, metadata, and applicability to help assess exposure and prioritize remediation across the environment.

Name	Type	Description
ConfigID	integer	Identifier linking the vulnerability record to its configuration or ingestion context.
ID	string	Unique identifier for the vulnerability within Rapid7 Surface Command.
AttackVector	string	Describes how an attacker can exploit the vulnerability (e.g., `network`, `adjacent`, `local`).
CVSS	decimal	The CVSS score or vector representing the vulnerability’s standardized severity rating.
Description	string	Summary explaining the vulnerability’s behavior, impact, or technical details.
HasResolution	boolean	Indicates whether a known fix, workaround, or remediation guidance exists.
IsExploited	boolean	Specifies whether the vulnerability is known to be actively exploited in the wild.
LastModified	datetime	Timestamp showing when the vulnerability details were last updated.
Name	string	Human-readable name or short title identifying the vulnerability.
Published	datetime	Original public disclosure date of the vulnerability.
Severity	string	Severity classification (e.g., `Low`, `Medium`, `High`, `Critical`).
SourcesSerialized	string	Serialized list of intelligence or data sources reporting the vulnerability.
TagsSerialized	string	Serialized list of metadata or labels assigned to the vulnerability.
BatchDate	datetime	Timestamp indicating when this record was most recently ingested or refreshed.
AppliesTo	string	Defines the components, systems, or asset types impacted by the vulnerability.

Rapid7SurfaceCommandWebsites

Catalogs discovered websites across cloud and on-prem environments, capturing metadata, ownership, exposure details, and activity history to support attack surface monitoring and organizational visibility.

Name	Type	Description
ConfigID	integer	Identifier linking the website record to its configuration or ingestion context.
ID	string	Unique identifier for the website within Rapid7 Surface Command.
Active	boolean	Indicates whether the website is currently active and being monitored.
Cloud	boolean	Cloud provider associated with the website.
CloudAccount	string	Cloud account name or ID tied to the website resource.
Description	string	Additional contextual details describing the website’s purpose or characteristics.
Environment	string	Classification such as Production, Staging, or Development.
FirstSeen	datetime	Timestamp marking when the website was first detected.
IsEncrypted	boolean	Indicates whether the website uses encryption (e.g., HTTPS).
IsExternal	boolean	Specifies whether the website is accessible from the public internet.
IsPartOfRef	string	Indicates whether the website belongs to a reference grouping or dataset.
LastSeen	datetime	Timestamp showing when the website was most recently observed.