Rapid7 SIEM Tables 1

Tables

Rapid7SIEMAccounts

Stores user account records observed in InsightIDR authentication logs, including domain, disabled status, and linked user entity RRNs.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
RRN	string	Rapid7 Resource Name (RRN) uniquely identifying the account across the Rapid7 platform.
Name	string	Display name of the account, typically the username or account identifier.
Domain	string	Domain the account belongs to, used to group accounts by directory or authentication source.
Disabled	boolean	Indicates whether the account is disabled and unable to authenticate.
UserRRN	string	RRN of the InsightIDR user entity associated with this account.
UserName	string	Username of the account as observed in authentication logs.
AuthenticationService	string	Authentication service used by the account (e.g., `Active Directory`, `LDAP`, `SAML`, `Local`).

Rapid7SIEMAlerts

Contains InsightIDR alert records generated by detection rules and threat intelligence, including alert type, timing, source, and association to investigations and detection rules.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
ID	string	Unique Rapid7-generated identifier for the alert.
Title	string	Human-readable title of the alert describing the detected threat or anomaly.
AlertType	string	Type classification of the alert (e.g., `MANUAL`, `AUTOMATED`, `THREAT_INTELLIGENCE`).
AlertTypeDescription	string	Human-readable description of the alert type.
CreatedTime	datetime	Timestamp when the alert was created in InsightIDR.
FirstEventTime	datetime	Timestamp of the earliest event that contributed to triggering the alert.
LatestEventTime	datetime	Timestamp of the most recent event associated with the alert.
AlertSource	string	Source that generated the alert (e.g., `DETECTION_RULE`, `THREAT_INTELLIGENCE`, `USER_BEHAVIOR_ANALYTICS`).
DetectionRuleRRN	string	Full RRN of the detection rule that triggered this alert.
DetectionRuleName	string	Display name of the detection rule that triggered this alert.

Rapid7SIEMAssessmentReports

Records detection rule and rule set assessment report results, capturing scoring, detection counts, throttle counts, and coverage metrics over a reporting period.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
EntityID	string	Identifier of the entity (detection rule or rule set) being assessed.
EntityType	string	Type of the entity being assessed (e.g., `RULE`, `RULE_SET`).
EntityName	string	Display name of the entity being assessed.
EntityAction	string	Action configured on the entity being assessed (e.g., `ALERT`, `INVESTIGATE`).
EntityPriority	string	Priority level of the entity being assessed (e.g., `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`).
AssessmentID	string	Unique identifier of the assessment run.
AssessmentStatus	string	Status of the assessment (e.g., `COMPLETE`, `IN_PROGRESS`, `FAILED`).
AssessmentType	string	Type of assessment performed (e.g., `COVERAGE`, `QUALITY`).
AssessmentSchema	integer	Schema version number of the assessment report format.
ReportStart	datetime	Timestamp marking the start of the assessment reporting period.

Rapid7SIEMAssetBootstrap

Stores Insight Agent bootstrap component health records for assets, including agent status, component version, IP addresses, and last beacon times.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
Identity	uniqueidentifier	Unique identifier (GUID) for the asset bootstrap record.
AgentID	string	Unique identifier of the Insight Agent installed on the asset.
AgentStatus	string	Current operational status of the Insight Agent (e.g., `active`, `inactive`, `stale`, `uninstalled`).
ComponentName	string	Name of the Insight Agent component reporting bootstrap status (e.g., `bootstrap`).
ComponentState	string	Operational state of the agent component (e.g., `RUNNING`, `STOPPED`, `ERROR`).
ComponentVersion	string	Version of the Insight Agent component currently installed on the asset.
LastStartTime	datetime	Timestamp when the Insight Agent component was last started.
HostName	string	Hostname of the asset as reported by the Insight Agent.
PrimaryIP	string	Primary internal IP address of the asset.
PublicIP	string	Public-facing IP address of the asset, if applicable.
BeaconTime	datetime	Timestamp of the most recent beacon (check-in) received from the Insight Agent on this asset.
AgentLastUpdateTime	datetime	Timestamp when the Insight Agent was last updated on the asset.

Rapid7SIEMAssetNGAV

Contains Next-Generation Antivirus (NGAV) status records for assets enrolled in Rapid7's endpoint protection, including agent mode, health status, and group policy assignment.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
AgentID	string	Unique identifier of the Insight Agent installed on the asset.
AgentStatus	string	Current operational status of the Insight Agent on the asset (e.g., `active`, `inactive`, `stale`).
AgentMode	string	Operating mode of the NGAV agent (e.g., `prevention`, `detection`, `monitor`).
BeaconTime	datetime	Timestamp of the most recent beacon received from the Insight Agent on this asset.
NGAVHealth	string	Health status of the Next-Generation Antivirus (NGAV) component (e.g., `healthy`, `degraded`, `offline`).
NGAVGroupID	string	Identifier of the NGAV group policy assigned to this asset.
NGAVGroupName	string	Display name of the NGAV group policy assigned to this asset.
HostName	string	Hostname of the asset as reported by the Insight Agent.
HostVendor	string	Operating system vendor of the asset (e.g., `Microsoft`, `Apple`, `Red Hat`).
HostVersion	string	Operating system version running on the asset.
HostType	string	Type classification of the asset host (e.g., `workstation`, `server`, `laptop`).
PrimaryIP	string	Primary internal IP address of the asset.
PublicIP	string	Public-facing IP address of the asset, if applicable.
SysArch	integer	Numeric system architecture identifier of the asset (e.g., 32 or 64 for 32-bit or 64-bit).

Rapid7SIEMAssetQuarantines

Stores quarantine state records for assets managed by InsightIDR, including current quarantine status, beacon times, and network identifiers.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
AgentID	string	Unique identifier of the Insight Agent installed on the quarantined asset.
AgentStatus	string	Current operational status of the Insight Agent (e.g., `active`, `inactive`, `stale`).
QuarantineState	string	Current quarantine state of the asset (e.g., `quarantined`, `unquarantined`, `pending_quarantine`, `pending_unquarantine`).
BeaconTime	datetime	Timestamp of the most recent beacon received from the Insight Agent on this asset.
AgentLastUpdateTime	datetime	Timestamp when the Insight Agent was last updated on the quarantined asset.
HostName	string	Hostname of the quarantined asset as reported by the Insight Agent.
PrimaryIP	string	Primary internal IP address of the quarantined asset.
PrimaryMAC	string	Primary MAC address of the quarantined asset's network interface.

Rapid7SIEMAssets

Contains asset records tracked in InsightIDR, identified by RRN and display name.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
RRN	string	Rapid7 Resource Name (RRN) uniquely identifying the asset across the Rapid7 platform.
Name	string	Display name or hostname of the asset as identified in InsightIDR.

Rapid7SIEMAttachments

Stores file attachment records uploaded to InsightIDR investigations, including file meta data, MIME type, size, and malware scan status.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
RRN	string	Rapid7 Resource Name (RRN) uniquely identifying the attachment.
CreatorType	string	Type of entity that uploaded the attachment (e.g., `USER`, `SYSTEM`).
CreatorName	string	Display name or email of the user or system that uploaded the attachment.
CreatedTime	datetime	Timestamp when the attachment was uploaded to InsightIDR.
FileName	string	Original file name of the uploaded attachment.
MimeType	string	MIME content type of the attachment (e.g., `application/pdf`, `image/png`, `text/plain`).
Size	bigint	File size of the attachment in bytes.
ScanStatus	string	Malware scan status of the attachment (e.g., `CLEAN`, `MALICIOUS`, `NOT_SCANNED`, `PENDING`).

Rapid7SIEMComments

Contains comment records added to InsightIDR investigations and alerts, including body text, creator identity, visibility, and the target entity.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
RRN	string	Rapid7 Resource Name (RRN) uniquely identifying the comment.
CreatedTime	datetime	Timestamp when the comment was created.
Target	string	RRN of the investigation or alert this comment is attached to.
CreatorType	string	Type of entity that created the comment (e.g., `USER`, `SYSTEM`).
CreatorName	string	Display name or email of the user who created the comment.
Body	string	Text content of the comment.
Visibility	string	Visibility of the comment (e.g., `PUBLIC`, `PRIVATE`).

Rapid7SIEMDetectionRuleCounts

Stores aggregated counts of detection rules in the organization, broken down by priority, action, event type, MITRE tactic, and assessment status.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
Identity	bigint	Unique numeric identifier for the detection rule counts summary record.
Total	integer	Total number of detection rules across all categories in the organization.
DetectionRuleCount	integer	Number of Rapid7-managed detection rules active in the organization.
CustomDetectionRuleCount	integer	Number of custom detection rules created by the organization.
RulePriorityCountsSerialized	string	Serialized breakdown of detection rule counts grouped by priority level.
RuleActionCountsSerialized	string	Serialized breakdown of detection rule counts grouped by configured action.
EventTypeCountsSerialized	string	Serialized breakdown of detection rule counts grouped by monitored event type.
TacticCountsSerialized	string	Serialized breakdown of detection rule counts grouped by MITRE ATT&CK tactic.
AssessmentCountsSerialized	string	Serialized breakdown of detection rule assessment results by status category.

Rapid7SIEMDetectionRuleMITRE

Records MITRE ATT&CK tactic and technique mappings for InsightIDR detection rules, including serialized technique codes, tactic codes, and the full ATT&CK tree.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
RRN	string	Rapid7 Resource Name (RRN) uniquely identifying the detection rule.
Name	string	Display name of the detection rule.
TechniqueCodesSerialized	string	Serialized list of MITRE ATT&CK technique codes mapped to this detection rule (e.g., `T1078`, `T1059.001`).
TacticCodesSerialized	string	Serialized list of MITRE ATT&CK tactic codes mapped to this detection rule (e.g., `TA0001`, `TA0006`).
MITRETreeSerialized	string	Serialized hierarchical structure representing the full MITRE ATT&CK tactic-to-technique tree for this detection rule.

Rapid7SIEMDetectionRules

Primary table of InsightIDR detection rules, capturing rule configuration, state, condition logic, MITRE mappings, detection counts, throttle settings, and assessment scores.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
RRN	string	Rapid7 Resource Name (RRN) uniquely identifying the detection rule.
RRNRevision	string	Revision identifier within the detection rule's RRN, representing a specific version of the rule.
RuleSet	string	Name of the rule set the detection rule belongs to (e.g., `Attacker Behavior Analytics`, `Custom Rules`).
Obsolete	boolean	Indicates whether the detection rule is obsolete and has been superseded by a newer version.
Invalid	boolean	Indicates whether the detection rule is invalid and currently unable to generate detections.
CreateDate	datetime	Timestamp when the detection rule was originally created.
StateValue	string	Current enabled/disabled state of the detection rule (e.g., `ENABLED`, `DISABLED`).
StateReason	string	Reason provided for the current state of the detection rule, if it was manually disabled.
EventTypesSerialized	string	Serialized list of log event types this detection rule monitors.
EventSubtypesSerialized	string	Serialized list of log event subtypes this detection rule monitors.

Rapid7SIEMEventSources

Contains event source records registered in InsightIDR, including source type and the associated log identifier.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
RRN	string	Rapid7 Resource Name (RRN) uniquely identifying the event source.
Name	string	Display name of the event source.
Type	string	Type classification of the event source (e.g., `syslog`, `windows_event`, `cloud_service`, `api_endpoint`).
Rapid7SIEMLogID	string	Identifier of the InsightIDR log associated with this event source.

Rapid7SIEMExportJobs

Stores log data export job records, including format, completion percentage, status, expiry time, and download links.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
ID	string	Unique identifier of the log export job.
CreatedEpochMs	bigint	Unix epoch timestamp in milliseconds when the export job was created.
Format	string	Output format of the exported data (e.g., `JSON`, `CSV`).
Percentage	integer	Completion percentage of the export job, from 0 to 100.
Status	string	Current status of the export job (e.g., `RUNNING`, `COMPLETE`, `FAILED`, `STOPPED`).
ExpiresEpochMs	bigint	Unix epoch timestamp in milliseconds when the exported file will expire and be deleted.
LinksSerialized	string	Serialized list of download links for the exported file segments.