Rapid7 SIEM Tables 2

Tables

Rapid7SIEMHealthMetrics

Contains health metric records for InsightIDR platform components (collectors, event sources, agents), including online/offline counts, CPU, memory, storage, and drop rate.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
RRN	string	Full Rapid7 Resource Name (RRN) uniquely identifying the investigation.
RRNPartition	string	Partition component of the investigation's RRN.
RRNService	string	Service component of the investigation's RRN (e.g., `rrn:investigation`).
RRNRegionCode	string	Region code component of the investigation's RRN.
RRNOrganizationID	string	Organization ID component of the investigation's RRN.
RRNResourceTypesSerialized	string	Serialized list of resource type segments from the investigation's RRN.
RRNResource	string	Resource identifier component of the investigation's RRN.
OrganizationID	string	Identifier of the Rapid7 organization this investigation belongs to.
Title	string	Human-readable title of the investigation.
Status	string	Current status of the investigation (e.g., `OPEN`, `INVESTIGATING`, `CLOSED`).

Rapid7SIEMIntegrations

Integration summary table listing all Rapid7 InsightIDR integration configurations with region, base URL, and creation meta data.

Name	Type	Description
ID	integer	Auto-incremented primary key for the Rapid7 InsightIDR integration configuration record.
IntegrationID	integer	Numeric identifier linking this record to the associated Rapid7 integration instance.
Name	string	Display name of the Rapid7 InsightIDR integration configuration.
IsEnabled	boolean	Indicates whether the integration configuration is currently active and enabled.
Region	string	Rapid7 platform region used for API requests in this integration configuration (e.g., `us`, `eu`, `ap`).
BaseURL	string	Base API URL of the Rapid7 InsightIDR instance used for this integration.
CreatedDate	datetime	Timestamp indicating when the integration configuration was created.
ModifiedDate	datetime	Timestamp indicating when the integration configuration was last modified.
CreatedBy	string	Username or identifier of the user who created the integration configuration.
ModifiedBy	string	Username or identifier of the user who last modified the integration configuration.

Rapid7SIEMInvestigations

Primary table of InsightIDR investigation records, capturing title, status, disposition, priority, assignee, source, tags, and associated alert time ranges.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
RRN	string	Full Rapid7 Resource Name (RRN) uniquely identifying the investigation.
RRNPartition	string	Partition component of the investigation's RRN.
RRNService	string	Service component of the investigation's RRN (e.g., `rrn:investigation`).
RRNRegionCode	string	Region code component of the investigation's RRN.
RRNOrganizationID	string	Organization ID component of the investigation's RRN.
RRNResourceTypesSerialized	string	Serialized list of resource type segments from the investigation's RRN.
RRNResource	string	Resource identifier component of the investigation's RRN.
OrganizationID	string	Identifier of the Rapid7 organization this investigation belongs to.
Title	string	Human-readable title of the investigation.
Status	string	Current status of the investigation (e.g., `OPEN`, `INVESTIGATING`, `CLOSED`).

Rapid7SIEMLEQLVariables

Stores LEQL (Log Entry Query Language) variable definitions used as reusable substitutions in log search queries.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
ID	string	Unique identifier of the LEQL variable.
Name	string	Display name of the LEQL variable used to reference it in queries.
Description	string	Description of the LEQL variable and its intended use in log queries.
Value	string	Value assigned to the LEQL variable, used as a substitution in LEQL query statements.
UserId	string	Identifier of the user who created or owns the LEQL variable.
Created	datetime	Timestamp when the LEQL variable was created.
Updated	datetime	Timestamp when the LEQL variable was last updated.
Reserved	boolean	Indicates whether the LEQL variable is a system-reserved variable and cannot be deleted or renamed.

Rapid7SIEMLabels

Contains label definitions used to classify and organize InsightIDR detection rules, including display name, color, and reserved status.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
ID	string	Unique identifier of the label.
Sn	integer	Serial number used to order labels in the InsightIDR UI.
Name	string	Display name of the label used to classify detection rules.
Color	string	Hex color code or color name assigned to the label for visual identification in the UI.
Reserved	boolean	Indicates whether the label is a system-reserved label that cannot be deleted or renamed.

Rapid7SIEMLocalAccounts

Records local user accounts discovered on assets by InsightIDR, linking each account to its host asset and associated user entity.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
RRN	string	Rapid7 Resource Name (RRN) uniquely identifying the local account.
Name	string	Username of the local account as observed on the asset.
AssetRRN	string	RRN of the asset on which this local account exists.
AssetName	string	Display name or hostname of the asset on which this local account exists.
Rapid7SIEMUserRRN	string	Foreign key referencing the RRN of the associated InsightIDR user record.
Rapid7SIEMUserConfigID	integer	Configuration identifier of the associated InsightIDR user record.
Rapid7SIEMAssetRRN	string	Foreign key referencing the RRN of the associated InsightIDR asset record.
Rapid7SIEMAssetConfigID	integer	Configuration identifier of the associated InsightIDR asset record.

Rapid7SIEMLogLines

Stores individual log line records ingested from InsightIDR log sources, including the log set, log name, ingestion time, and serialized raw entry content.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
Identity	bigint	Unique numeric identifier for the log line record.
LogSetName	string	Display name of the log set the log entry belongs to.
LogName	string	Display name of the specific log within the log set.
LogID	string	Unique identifier of the log source that generated this log line.
IngestionTime	datetime	Timestamp when the log line was ingested and stored by InsightIDR.
Source	string	Source identifier indicating the collector or event source that delivered this log line.
LogEntrySerialized	string	Serialized raw or parsed log entry content as stored in InsightIDR.

Rapid7SIEMLogSets

Contains log set definitions that group related logs in InsightIDR, including name, description, and user-defined meta data.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
ID	string	Unique identifier of the log set.
Name	string	Display name of the log set.
Description	string	Description of the log set's purpose and the types of logs it contains.
User dataSerialized	string	Serialized user-defined meta data and custom attributes associated with the log set.
RRN	string	Rapid7 Resource Name (RRN) uniquely identifying the log set.

Rapid7SIEMLogStorage

Records daily log storage usage per organization, capturing ingestion volume for each day and cumulative period totals.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
Day	date	Calendar date for which the log storage usage is reported.
Usage	decimal	Log data ingested on this day, typically in gigabytes.
OrganizationName	string	Name of the organization this storage usage record belongs to.
PeriodUsage	decimal	Cumulative log data ingested for the current billing or reporting period up to and including this day.

Rapid7SIEMLogs

Stores individual log definitions configured in InsightIDR, including source type, parsing structures, tokens, and user-defined meta data.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
ID	string	Unique identifier of the log.
Name	string	Display name of the log.
StructuresSerialized	string	Serialized list of parsing structures (field extraction rules) applied to this log.
TokensSerialized	string	Serialized list of authentication tokens associated with this log for ingestion.
SourceType	string	Source type of the log indicating how log data is sent to InsightIDR (e.g., `token`, `agent`, `syslog`).
TokenSeed	string	Seed value used to generate authentication tokens for this log.
User dataSerialized	string	Serialized user-defined meta data and custom attributes associated with the log.
RRN	string	Rapid7 Resource Name (RRN) uniquely identifying the log.
LinksSerialized	string	Serialized list of API links associated with the log resource.

Rapid7SIEMNotifications

Contains notification configuration records for InsightIDR alerts, defining match thresholds, reporting frequency limits, and delivery channel type.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
ID	string	Unique identifier of the notification configuration.
MinMatchesCount	integer	Minimum number of query matches required to trigger this notification.
MaxMatchesCount	integer	Maximum number of query matches after which the notification is suppressed.
MinReportCount	integer	Minimum number of times the notification must have fired before an alert is sent.
MaxReportCount	integer	Maximum number of times this notification will send an alert before it is suppressed.
MinMatchesPeriod	string	Time period during which the minimum match count must be reached to trigger the notification.
MinReportPeriod	string	Time period during which the minimum report count must be reached before an alert is sent.
Enabled	boolean	Indicates whether the notification is currently enabled and active.
Type	string	Type of notification delivery channel (e.g., `EMAIL`, `SLACK`, `WEBHOOK`, `PAGERDUTY`).

Rapid7SIEMOrganizationSettings

Stores organization-level configuration settings for the Rapid7 platform, including log retention periods, cold storage duration, and monthly ingestion limits.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
AccountID	string	Rapid7 account identifier for the organization.
Name	string	Display name of the organization in the Rapid7 platform.
PlatformOrganizationID	string	Platform-level organization identifier used across all Rapid7 products.
MaxRetentionPeriodDays	bigint	Maximum number of days log data can be retained under the organization's license.
RetentionPeriodDays	bigint	Currently configured number of days log data is retained for the organization.
ColdRetentionDays	bigint	Number of days log data is retained in cold (archival) storage before expiry.
MonthlyLimit	bigint	Monthly log ingestion limit in bytes (or gigabytes) configured for the organization.

Rapid7SIEMPreComputedQueries

Contains pre-computed query definitions that run LEQL statements on a schedule and cache results for faster dashboard and reporting performance.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
ID	string	Unique identifier of the pre-computed query.
Name	string	Display name of the pre-computed query.
Description	string	Description of the pre-computed query's purpose and what it measures.
Enabled	boolean	Indicates whether the pre-computed query is currently enabled and running.
LeqlStatement	string	LEQL (Log Entry Query Language) statement that defines the query logic.
LeqlFunction	string	Aggregation function applied to the LEQL query results (e.g., `COUNT`, `SUM`, `AVG`).
ResolutionSeconds	integer	Granularity of pre-computed results in seconds, defining the time bucket size.
RetentionSeconds	integer	Duration in seconds that pre-computed query results are retained before expiry.
EnabledSinceEpochMs	bigint	Unix epoch timestamp in milliseconds when the pre-computed query was last enabled.
CreatedEpochMs	bigint	Unix epoch timestamp in milliseconds when the pre-computed query was created.

Rapid7SIEMRuleExceptions

Stores detection rule exception records that suppress or modify alerts for specific conditions, including LEQL match expressions, match counts, and creator details.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
RRN	string	Rapid7 Resource Name (RRN) uniquely identifying the rule exception.
CreateDate	datetime	Timestamp when the rule exception was created.
StateValue	string	Current state of the rule exception (e.g., `ENABLED`, `DISABLED`).
StateReason	string	Reason provided for the current state of the rule exception.
EntityRRN	string	RRN of the detection rule this exception is applied to.
EntityName	string	Display name of the detection rule this exception is applied to.
EntityRuleAction	string	Action configured on the parent detection rule (e.g., `ALERT`, `INVESTIGATE`).
EntityPriorityLevel	string	Priority level of the parent detection rule (e.g., `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`).
EntityType	string	Type of the entity the exception is applied to (e.g., `RULE`, `RULE_SET`).
EntityResponsibility	string	Responsibility scope of the parent detection rule (e.g., `MDR`, `CUSTOMER`).

Rapid7SIEMRuleHistory

Records audit history events for changes made to InsightIDR detection rules and exceptions, capturing the field changed, old value, new value, and the user who made the change.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
RRN	string	Rapid7 Resource Name (RRN) uniquely identifying the health metric entity.
Type	string	Type of component being measured (e.g., `COLLECTOR`, `EVENT_SOURCE`, `AGENT`).
Offline	integer	Number of components of this type currently in an offline state.
Online	integer	Number of components of this type currently in an online state.
Stale	integer	Number of components of this type in a stale state (not recently reporting).
Total	integer	Total number of components of this type tracked in the health metrics.
Name	string	Display name of the component this health metric record pertains to.
State	string	Current health state of the specific component (e.g., `ONLINE`, `OFFLINE`, `STALE`, `ERROR`).
StorageUsed	bigint	Amount of storage currently used by the component, in bytes.
MaxStorage	bigint	Maximum storage capacity available to the component, in bytes.

Rapid7SIEMSavedQueries

Contains saved LEQL query definitions for reuse in InsightIDR log search, including the query statement and configured time range.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
ID	string	Unique identifier of the saved query.
Name	string	Display name of the saved query.
LeqlStatement	string	LEQL (Log Entry Query Language) statement defining the saved query logic.
LeqlDuringTimeRange	string	Named time range parameter for the query (e.g., `Last 24 Hours`, `Last 7 Days`).
LeqlDuringTo	string	End of the custom time range for the saved query, in ISO 8601 format.
LeqlDuringFrom	string	Start of the custom time range for the saved query, in ISO 8601 format.

Rapid7SIEMTags

Stores tag definitions used to classify and enrich events and log entries in InsightIDR, including LEQL conditions, priority, and associated log sources.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
ID	string	Unique identifier of the tag.
Type	string	Type classification of the tag (e.g., `THREAT`, `VULNERABILITY`, `COMPLIANCE`, `CUSTOM`).
Name	string	Display name of the tag.
Description	string	Description of the tag's purpose and how it is applied.
LeqlStatement	string	LEQL statement defining the log query condition that automatically applies this tag to matching events.
Priority	integer	Numeric priority value assigned to the tag for ordering and triage purposes.
User dataSerialized	string	Serialized user-defined meta data and custom attributes associated with the tag.
SourcesSerialized	string	Serialized list of log source identifiers that this tag is applied to.

Rapid7SIEMTargets

Contains notification target configurations defining where InsightIDR alert notifications are delivered, including channel type and delivery parameters.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
ID	string	Unique identifier of the notification target.
Name	string	Display name of the notification target.
Description	string	Description of the notification target and its intended use.
Type	string	Type of notification delivery channel for this target (e.g., `EMAIL`, `SLACK`, `WEBHOOK`, `PAGERDUTY`).
ParamsSetSerialized	string	Serialized set of configuration parameters required by the notification target (e.g., webhook URL, email address).
User dataSerialized	string	Serialized user-defined meta data and custom attributes associated with the notification target.
AlertContentSetSerialized	string	Serialized set of alert content fields included in notifications sent to this target.

Rapid7SIEMUsers

Stores InsightIDR user entity records observed across authentication and directory logs, identified by RRN, name, and domain.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Rapid7 InsightIDR integration configuration.
BatchDate	datetime	Timestamp indicating when the record was ingested or last refreshed by the integration.
RRN	string	Rapid7 Resource Name (RRN) uniquely identifying the user entity in InsightIDR.
FirstName	string	First name of the user as observed in authentication or directory logs.
LastName	string	Last name of the user as observed in authentication or directory logs.
Name	string	Full display name of the user.
Domain	string	Domain the user belongs to, used to group users by directory or authentication source.