This guide walks you through creating a platform API key and gathering the configuration needed to create a Rapid7 Insight IDR integration.
Configure a new Rapid 7 Platform API key
1. Create a service user (Optional)
Adding a new user will allow you to narrow the scope of the API key. The creation of a new user is optional; however, it is strongly recommended so that you can limit the permissions of the API key.
Log in with an administrator account and click the small settings gear in the top right corner. Go to 'Users'.
User tokens have the same permissions as the user they are associated with. The minimum permissions needed are listed below. You may use an existing user for this purpose, however it is suggested you create a user specific to this integration that only has the necessary permissions. To do this, click the 'Create User' button.
Fill in a first and last name and email address. You need access to this email to activate the user once created, but it is not necessary that the user corresponds to an actual human.
Assign the user to the 'Insight IDR' product.
Assign the user to the following roles (or higher):
- Insight IDR Analyst
- Log Search View Only
Click Add User to confirm creation.
Log out of Rapid7
Open the email account associated with the user and find the link to activate the account in Rapid7.
2. Create the Platform API key
Log in with the user you would like to associate with your integration. If you created a new service user in step 1, log in with that user.
Once logged in, click the small settings gear in the top right corner and go to 'API Keys'.
Follow the Rapid7 documentation for creating a User Platform API key.
Once created, copy your API key to a safe location for use as your integration token. If you lose the key, you can not view it again. You will need to generate a new token.
Configure the Integration
Create your integration by supplying all configuration values.
URL Select the regional URL you would like to use for Rapid7's Insight IDR product. Supply the base URL for your configuration without any path components (e.g. https://us2.api.insight.rapid7.com)
Token This is the Platform API key gathered in step 2