> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pinkfish.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# rapid7-siem
> Rapid7 SIEM
**Server path:** `/rapid7-siem` | **Type:** Application | **PCID required:** Yes
## Tools
| Tool | Description |
| --------------------------------------------------------------------------------------- | ----------------------------------------- |
| [`rapid7_siem_add_collector`](#rapid7_siem_add_collector) | Add Collector |
| [`rapid7_siem_add_indicators`](#rapid7_siem_add_indicators) | Add indicators to a Community Threat |
| [`rapid7_siem_assign_user_to_investigation`](#rapid7_siem_assign_user_to_investigation) | Assign user to investigation |
| [`rapid7_siem_bulk_close_investigations`](#rapid7_siem_bulk_close_investigations) | Close investigations in bulk |
| [`rapid7_siem_create_comment`](#rapid7_siem_create_comment) | Create comment |
| [`rapid7_siem_create_community_threat`](#rapid7_siem_create_community_threat) | Create a Community Threat |
| [`rapid7_siem_delete_attachment`](#rapid7_siem_delete_attachment) | Delete an attachment |
| [`rapid7_siem_delete_comment`](#rapid7_siem_delete_comment) | Delete a comment |
| [`rapid7_siem_delete_community_threat`](#rapid7_siem_delete_community_threat) | Delete a Community Threat |
| [`rapid7_siem_download_attachment`](#rapid7_siem_download_attachment) | Download attachment |
| [`rapid7_siem_find_account_by_rrn`](#rapid7_siem_find_account_by_rrn) | Get account by RRN |
| [`rapid7_siem_find_asset_by_rrn`](#rapid7_siem_find_asset_by_rrn) | Get asset by RRN |
| [`rapid7_siem_get_attachment`](#rapid7_siem_get_attachment) | Get attachment information |
| [`rapid7_siem_get_comment`](#rapid7_siem_get_comment) | Get comment by rrn |
| [`rapid7_siem_get_local_account_by_rrn`](#rapid7_siem_get_local_account_by_rrn) | Get local account by RRN |
| [`rapid7_siem_get_metrics`](#rapid7_siem_get_metrics) | Retrieve health metrics by org |
| [`rapid7_siem_get_user_by_rrn`](#rapid7_siem_get_user_by_rrn) | Get user by RRN |
| [`rapid7_siem_list_attachments`](#rapid7_siem_list_attachments) | List attachments |
| [`rapid7_siem_list_comments`](#rapid7_siem_list_comments) | List comments |
| [`rapid7_siem_list_investigations`](#rapid7_siem_list_investigations) | List investigations |
| [`rapid7_siem_replace_indicators`](#rapid7_siem_replace_indicators) | Replace indicators for a Community Threat |
| [`rapid7_siem_search_accounts`](#rapid7_siem_search_accounts) | Search accounts |
| [`rapid7_siem_search_assets`](#rapid7_siem_search_assets) | Search assets |
| [`rapid7_siem_search_local_accounts`](#rapid7_siem_search_local_accounts) | Search local accounts |
| [`rapid7_siem_search_users`](#rapid7_siem_search_users) | Search users |
| [`rapid7_siem_set_status`](#rapid7_siem_set_status) | Set the status of an investigation |
| [`rapid7_siem_update_comment`](#rapid7_siem_update_comment) | Update comment visibility |
| [`rapid7_siem_upload_attachment`](#rapid7_siem_upload_attachment) | Upload attachment |
***
## rapid7\_siem\_add\_collector
Add Collector
**Parameters:**
| Parameter | Type | Required | Default | Description |
| ----------------- | ------ | -------- | ------- | ------------------------------------------------------------------------- |
| `deployment_type` | string | No | — | Optional indication of how the collector is deployed. |
| `key` | string | Yes | — | The registration key for the collector. Must be unique, and a valid UUID. |
| `name` | string | Yes | — | The name for the new collector. Must be unique. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"deployment_type": {
"type": "string",
"description": "Optional indication of how the collector is deployed."
},
"key": {
"type": "string",
"description": "The registration key for the collector. Must be unique, and a valid UUID."
},
"name": {
"type": "string",
"description": "The name for the new collector. Must be unique."
}
},
"required": [
"PCID",
"key",
"name"
]
}
```
***
## rapid7\_siem\_add\_indicators
Add indicators to a Community Threat
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------- | ------ | -------- | ------- | -------------------------------------------------------------------------------------------------------------------------- |
| `key` | string | Yes | — | The key of a Community Threat for which the indicators are going to be added. |
| `format` | string | Yes | — | The input format. |
| `body` | string | Yes | — | The request body format should be one of JSON, STIX XML, CSV, or multi-part file data. The maximum payload size is 50 MB. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"key": {
"type": "string",
"description": "The key of a Community Threat for which the indicators are going to be added."
},
"format": {
"type": "string",
"description": "The input format.",
"enum": [
"json",
"csv",
"stix_xml"
]
},
"body": {
"type": "string",
"description": "The request body format should be one of JSON, STIX XML, CSV, or multi-part file data. The maximum payload size is 50 MB."
}
},
"required": [
"PCID",
"key",
"format",
"body"
]
}
```
***
## rapid7\_siem\_assign\_user\_to\_investigation
Assign user to investigation
**Parameters:**
| Parameter | Type | Required | Default | Description |
| -------------------- | ------ | -------- | ------- | ----------------------------------------------------------------------------------------------------- |
| `id` | string | Yes | — | The ID or RRN of the investigation to assign the user to. |
| `user_email_address` | string | Yes | — | The email address of the user to assign to this investigation, used to log into the Insight Platform. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"id": {
"type": "string",
"description": "The ID or RRN of the investigation to assign the user to."
},
"user_email_address": {
"type": "string",
"description": "The email address of the user to assign to this investigation, used to log into the Insight Platform."
}
},
"required": [
"PCID",
"id",
"user_email_address"
]
}
```
***
## rapid7\_siem\_bulk\_close\_investigations
Close investigations in bulk
**Parameters:**
| Parameter | Type | Required | Default | Description |
| ----------------------------- | ------- | -------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `alert_type` | string | No | — | The category of alerts that should be closed. This parameter is required if the source is ALERT and ignored for other sources. This value must exactly match the alert type returned by the List Investigations response. |
| `detection_rule_rrn` | string | No | — | The RRN of the detection rule. Investigations will only be closed that are associated with this detection rule. If a detection rule RRN is given, the alert\_type is required to be 'Attacker Behavior Detected'. |
| `from` | string | Yes | — | An ISO formatted timestamp. Only investigations whose createTime is after this date will be closed. |
| `max_investigations_to_close` | integer | No | — | An optional, maximum number of alerts to close with this request. If this parameter is not specified, then there is no maximum. If this limit is exceeded, then a 400 error response is returned. The minimum value is 0. |
| `source` | string | Yes | — | The name of an investigation source. Only investigations from this source will be closed. If the source is ALERT, an alert type must be specified as well. |
| `to` | string | Yes | — | An ISO formatted timestamp. Only investigations whose createTime is before this date will be closed. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"alert_type": {
"type": "string",
"description": "The category of alerts that should be closed. This parameter is required if the source is ALERT and ignored for other sources. This value must exactly match the alert type returned by the List Investigations response."
},
"detection_rule_rrn": {
"type": "string",
"description": "The RRN of the detection rule. Investigations will only be closed that are associated with this detection rule. If a detection rule RRN is given, the alert_type is required to be 'Attacker Behavior Detected'."
},
"from": {
"type": "string",
"description": "An ISO formatted timestamp. Only investigations whose createTime is after this date will be closed."
},
"max_investigations_to_close": {
"type": "integer",
"description": "An optional, maximum number of alerts to close with this request. If this parameter is not specified, then there is no maximum. If this limit is exceeded, then a 400 error response is returned. The minimum value is 0."
},
"source": {
"type": "string",
"description": "The name of an investigation source. Only investigations from this source will be closed. If the source is ALERT, an alert type must be specified as well.",
"enum": [
"ALERT,MANUAL,HUNT"
]
},
"to": {
"type": "string",
"description": "An ISO formatted timestamp. Only investigations whose createTime is before this date will be closed."
}
},
"required": [
"PCID",
"from",
"source",
"to"
]
}
```
***
## rapid7\_siem\_create\_comment
Create comment
**Parameters:**
| Parameter | Type | Required | Default | Description |
| ------------- | --------- | -------- | ------- | ----------------------------------------------------------------------------------- |
| `attachments` | string\[] | No | — | An array of attachment RRNs to associate with the comment. |
| `body` | string | No | — | The body of the comment. |
| `target` | string | Yes | — | The target of the comment, which determines where it will appear within InsightIDR. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"attachments": {
"type": "array",
"items": {
"type": "string"
},
"description": "An array of attachment RRNs to associate with the comment."
},
"body": {
"type": "string",
"description": "The body of the comment."
},
"target": {
"type": "string",
"description": "The target of the comment, which determines where it will appear within InsightIDR."
}
},
"required": [
"PCID",
"target"
]
}
```
***
## rapid7\_siem\_create\_community\_threat
Create a Community Threat
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------- | ------ | -------- | ------- | ---------------------------------------------------------------------------- |
| `body` | string | Yes | — | The request body format must be in JSON. The maximum payload size is 50 MB. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"body": {
"type": "string",
"description": "The request body format must be in JSON. The maximum payload size is 50 MB."
}
},
"required": [
"PCID",
"body"
]
}
```
***
## rapid7\_siem\_delete\_attachment
Delete an attachment
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------- | ------ | -------- | ------- | -------------------------- |
| `rrn` | string | Yes | — | The RRN of the attachment. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"rrn": {
"type": "string",
"description": "The RRN of the attachment."
}
},
"required": [
"PCID",
"rrn"
]
}
```
***
## rapid7\_siem\_delete\_comment
Delete a comment
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------- | ------ | -------- | ------- | ----------------------- |
| `rrn` | string | Yes | — | The RRN of the comment. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"rrn": {
"type": "string",
"description": "The RRN of the comment."
}
},
"required": [
"PCID",
"rrn"
]
}
```
***
## rapid7\_siem\_delete\_community\_threat
Delete a Community Threat
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------- | ------ | -------- | ------- | ---------------- |
| `key` | string | Yes | — | The key value |
| `reason` | string | No | — | The reason value |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"key": {
"type": "string",
"description": "The key value"
},
"reason": {
"type": "string",
"description": "The reason value"
}
},
"required": [
"PCID",
"key"
]
}
```
***
## rapid7\_siem\_download\_attachment
Download attachment
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------- | ------ | -------- | ------- | -------------------------- |
| `rrn` | string | Yes | — | The RRN of the attachment. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"rrn": {
"type": "string",
"description": "The RRN of the attachment."
}
},
"required": [
"PCID",
"rrn"
]
}
```
***
## rapid7\_siem\_find\_account\_by\_rrn
Get account by RRN
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------- | ------ | -------- | ------- | ----------------------- |
| `rrn` | string | Yes | — | The RRN of the account. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"rrn": {
"type": "string",
"description": "The RRN of the account."
}
},
"required": [
"PCID",
"rrn"
]
}
```
***
## rapid7\_siem\_find\_asset\_by\_rrn
Get asset by RRN
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------- | ------ | -------- | ------- | --------------------- |
| `rrn` | string | Yes | — | The RRN of the asset. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"rrn": {
"type": "string",
"description": "The RRN of the asset."
}
},
"required": [
"PCID",
"rrn"
]
}
```
***
## rapid7\_siem\_get\_attachment
Get attachment information
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------- | ------ | -------- | ------- | -------------------------- |
| `rrn` | string | Yes | — | The RRN of the attachment. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"rrn": {
"type": "string",
"description": "The RRN of the attachment."
}
},
"required": [
"PCID",
"rrn"
]
}
```
***
## rapid7\_siem\_get\_comment
Get comment by rrn
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------- | ------ | -------- | ------- | ------------------------------- |
| `rrn` | string | Yes | — | Return a comment with this rrn. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"rrn": {
"type": "string",
"description": "Return a comment with this rrn."
}
},
"required": [
"PCID",
"rrn"
]
}
```
***
## rapid7\_siem\_get\_local\_account\_by\_rrn
Get local account by RRN
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------- | ------ | -------- | ------- | ----------------------------- |
| `rrn` | string | Yes | — | The RRN of the local account. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"rrn": {
"type": "string",
"description": "The RRN of the local account."
}
},
"required": [
"PCID",
"rrn"
]
}
```
***
## rapid7\_siem\_get\_metrics
Retrieve health metrics by org
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------------- | ------- | -------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `index` | integer | No | — | The optional, 0 based index of the page to retrieve. Must be an integer greater than or equal to 0. |
| `size` | integer | No | — | The optional size of the page to retrieve. Must be an integer greater than 0 or less than or equal to 100. |
| `resourceTypes` | string | No | — | An optional, comma-separated set of resource types. Only resources whose type matches one of the entries in the list are returned. If this parameter is omitted, health metrics with any resource type may be returned. |
| `orgId` | string | No | — | Optional organization ID to get metrics for. If not specified, metrics for the user's current organization will be returned. User must have access to the specified organization. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"index": {
"type": "integer",
"description": "The optional, 0 based index of the page to retrieve. Must be an integer greater than or equal to 0."
},
"size": {
"type": "integer",
"description": "The optional size of the page to retrieve. Must be an integer greater than 0 or less than or equal to 100."
},
"resourceTypes": {
"type": "string",
"description": "An optional, comma-separated set of resource types. Only resources whose type matches one of the entries in the list are returned. If this parameter is omitted, health metrics with any resource type may be returned."
},
"orgId": {
"type": "string",
"description": "Optional organization ID to get metrics for. If not specified, metrics for the user's current organization will be returned. User must have access to the specified organization."
}
},
"required": [
"PCID"
]
}
```
***
## rapid7\_siem\_get\_user\_by\_rrn
Get user by RRN
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------- | ------ | -------- | ------- | -------------------- |
| `rrn` | string | Yes | — | The RRN of the user. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"rrn": {
"type": "string",
"description": "The RRN of the user."
}
},
"required": [
"PCID",
"rrn"
]
}
```
***
## rapid7\_siem\_list\_attachments
List attachments
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------- | ------- | -------- | ------- | ---------------------------------------------------------------------------------------------------------- |
| `target` | string | Yes | — | Return attachments with this target. |
| `index` | integer | No | — | The optional, 0 based index of the page to retrieve. Must be an integer greater than or equal to 0. |
| `size` | integer | No | — | The optional size of the page to retrieve. Must be an integer greater than 0 or less than or equal to 100. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"target": {
"type": "string",
"description": "Return attachments with this target."
},
"index": {
"type": "integer",
"description": "The optional, 0 based index of the page to retrieve. Must be an integer greater than or equal to 0."
},
"size": {
"type": "integer",
"description": "The optional size of the page to retrieve. Must be an integer greater than 0 or less than or equal to 100."
}
},
"required": [
"PCID",
"target"
]
}
```
***
## rapid7\_siem\_list\_comments
List comments
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------- | ------- | -------- | ------- | ------------------------------------------------------------------------------------------------------ |
| `target` | string | Yes | — | Return comments with this target. |
| `index` | integer | No | — | The optional 0, based index of the page to retrieve. Must be an integer greater than or equal to 0. |
| `size` | integer | No | — | The optional size of the page to retrieve. Must be an integer greater than 0 or less or equal to 100. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"target": {
"type": "string",
"description": "Return comments with this target."
},
"index": {
"type": "integer",
"description": "The optional 0, based index of the page to retrieve. Must be an integer greater than or equal to 0."
},
"size": {
"type": "integer",
"description": "The optional size of the page to retrieve. Must be an integer greater than 0 or less or equal to 100."
}
},
"required": [
"PCID",
"target"
]
}
```
***
## rapid7\_siem\_list\_investigations
List investigations
**Parameters:**
| Parameter | Type | Required | Default | Description |
| ------------ | ------- | -------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `index` | integer | No | — | The optional, 0 based index of the page to retrieve. Must be an integer greater than or equal to 0. |
| `size` | integer | No | — | The optional size of the page to retrieve. Must be an integer greater than 0 or less then or equal to 1000. |
| `statuses` | string | No | — | An optional, comma-separated set of investigation statuses. Only investigations whose status matches one of the entries in the list will be returned. If this parameter, is omitted investigations with any status may be returned. |
| `start_time` | string | No | — | An optional, ISO-formatted timestamp. Only investigations whose createTime is after this date will be returned by the API. If this parameter is omitted, investigations with any create\_time may be returned. |
| `end_time` | string | No | — | An optional, ISO-formatted timestamp. Only investigations whose createTime is before this date will be returned by the API. If this parameter is omitted, investigations with any create\_time may be returned. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"index": {
"type": "integer",
"description": "The optional, 0 based index of the page to retrieve. Must be an integer greater than or equal to 0."
},
"size": {
"type": "integer",
"description": "The optional size of the page to retrieve. Must be an integer greater than 0 or less then or equal to 1000."
},
"statuses": {
"type": "string",
"description": "An optional, comma-separated set of investigation statuses. Only investigations whose status matches one of the entries in the list will be returned. If this parameter, is omitted investigations with any status may be returned."
},
"start_time": {
"type": "string",
"description": "An optional, ISO-formatted timestamp. Only investigations whose createTime is after this date will be returned by the API. If this parameter is omitted, investigations with any create_time may be returned."
},
"end_time": {
"type": "string",
"description": "An optional, ISO-formatted timestamp. Only investigations whose createTime is before this date will be returned by the API. If this parameter is omitted, investigations with any create_time may be returned."
}
},
"required": [
"PCID"
]
}
```
***
## rapid7\_siem\_replace\_indicators
Replace indicators for a Community Threat
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------- | ------ | -------- | ------- | -------------------------------------------------------------------------------------------------------------------------- |
| `key` | string | Yes | — | The key of a Community Threat for which the indicators are going to be added. |
| `format` | string | Yes | — | The input format. |
| `body` | string | Yes | — | The request body format should be one of JSON, STIX XML, CSV, or multi-part file data. The maximum payload size is 50 MB. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"key": {
"type": "string",
"description": "The key of a Community Threat for which the indicators are going to be added."
},
"format": {
"type": "string",
"description": "The input format.",
"enum": [
"json",
"csv",
"stix_xml"
]
},
"body": {
"type": "string",
"description": "The request body format should be one of JSON, STIX XML, CSV, or multi-part file data. The maximum payload size is 50 MB."
}
},
"required": [
"PCID",
"key",
"format",
"body"
]
}
```
***
## rapid7\_siem\_search\_accounts
Search accounts
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------- | --------- | -------- | ------- | ----------------------------------------------------------------------------------------------------------- |
| `index` | integer | No | — | The optional, 0 based index of the page to retrieve. Must be an integer greater than or equal to 0. |
| `size` | integer | No | — | The optional size of the page to retrieve. Must be an integer greater than 0 or less than or equal to 1000. |
| `search` | object\[] | No | — | The criteria for which entities to return. |
| `sort` | object\[] | No | — | The sorting information. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"index": {
"type": "integer",
"description": "The optional, 0 based index of the page to retrieve. Must be an integer greater than or equal to 0."
},
"size": {
"type": "integer",
"description": "The optional size of the page to retrieve. Must be an integer greater than 0 or less than or equal to 1000."
},
"search": {
"type": "array",
"items": {
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "The field to search within."
},
"operator": {
"type": "string",
"enum": [
"EQUALS",
"CONTAINS",
"IN"
],
"description": "The search operation to perform. All operators are case-insensitive when operating on strings."
},
"value": {
"type": "object",
"description": "The value to search for."
}
}
},
"description": "The criteria for which entities to return."
},
"sort": {
"type": "array",
"items": {
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "The field to sort by."
},
"order": {
"type": "string",
"enum": [
"ASC",
"DESC",
"ASC,DESC"
],
"description": "The sorting direction. Sorting is case-insensitive when sorting strings."
}
}
},
"description": "The sorting information."
}
},
"required": [
"PCID"
]
}
```
***
## rapid7\_siem\_search\_assets
Search assets
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------- | --------- | -------- | ------- | ----------------------------------------------------------------------------------------------------------- |
| `index` | integer | No | — | The optional, 0 based index of the page to retrieve. Must be an integer greater than or equal to 0. |
| `size` | integer | No | — | The optional size of the page to retrieve. Must be an integer greater than 0 or less than or equal to 1000. |
| `search` | object\[] | No | — | The criteria for which entities to return. |
| `sort` | object\[] | No | — | The sorting information. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"index": {
"type": "integer",
"description": "The optional, 0 based index of the page to retrieve. Must be an integer greater than or equal to 0."
},
"size": {
"type": "integer",
"description": "The optional size of the page to retrieve. Must be an integer greater than 0 or less than or equal to 1000."
},
"search": {
"type": "array",
"items": {
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "The field to search within."
},
"operator": {
"type": "string",
"enum": [
"EQUALS",
"CONTAINS",
"IN"
],
"description": "The search operation to perform. All operators are case-insensitive when operating on strings."
},
"value": {
"type": "object",
"description": "The value to search for."
}
}
},
"description": "The criteria for which entities to return."
},
"sort": {
"type": "array",
"items": {
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "The field to sort by."
},
"order": {
"type": "string",
"enum": [
"ASC",
"DESC",
"ASC,DESC"
],
"description": "The sorting direction. Sorting is case-insensitive when sorting strings."
}
}
},
"description": "The sorting information."
}
},
"required": [
"PCID"
]
}
```
***
## rapid7\_siem\_search\_local\_accounts
Search local accounts
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------- | --------- | -------- | ------- | ----------------------------------------------------------------------------------------------------------- |
| `index` | integer | No | — | The optional, 0 based index of the page to retrieve. Must be an integer greater than or equal to 0. |
| `size` | integer | No | — | The optional size of the page to retrieve. Must be an integer greater than 0 or less than or equal to 1000. |
| `search` | object\[] | No | — | The criteria for which entities to return. |
| `sort` | object\[] | No | — | The sorting information. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"index": {
"type": "integer",
"description": "The optional, 0 based index of the page to retrieve. Must be an integer greater than or equal to 0."
},
"size": {
"type": "integer",
"description": "The optional size of the page to retrieve. Must be an integer greater than 0 or less than or equal to 1000."
},
"search": {
"type": "array",
"items": {
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "The field to search within."
},
"operator": {
"type": "string",
"enum": [
"EQUALS",
"CONTAINS",
"IN"
],
"description": "The search operation to perform. All operators are case-insensitive when operating on strings."
},
"value": {
"type": "object",
"description": "The value to search for."
}
}
},
"description": "The criteria for which entities to return."
},
"sort": {
"type": "array",
"items": {
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "The field to sort by."
},
"order": {
"type": "string",
"enum": [
"ASC",
"DESC",
"ASC,DESC"
],
"description": "The sorting direction. Sorting is case-insensitive when sorting strings."
}
}
},
"description": "The sorting information."
}
},
"required": [
"PCID"
]
}
```
***
## rapid7\_siem\_search\_users
Search users
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------- | --------- | -------- | ------- | ----------------------------------------------------------------------------------------------------------- |
| `index` | integer | No | — | The optional, 0 based index of the page to retrieve. Must be an integer greater than or equal to 0. |
| `size` | integer | No | — | The optional size of the page to retrieve. Must be an integer greater than 0 or less than or equal to 1000. |
| `search` | object\[] | No | — | The criteria for which entities to return. |
| `sort` | object\[] | No | — | The sorting information. |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"index": {
"type": "integer",
"description": "The optional, 0 based index of the page to retrieve. Must be an integer greater than or equal to 0."
},
"size": {
"type": "integer",
"description": "The optional size of the page to retrieve. Must be an integer greater than 0 or less than or equal to 1000."
},
"search": {
"type": "array",
"items": {
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "The field to search within."
},
"operator": {
"type": "string",
"enum": [
"EQUALS",
"CONTAINS",
"IN"
],
"description": "The search operation to perform. All operators are case-insensitive when operating on strings."
},
"value": {
"type": "object",
"description": "The value to search for."
}
}
},
"description": "The criteria for which entities to return."
},
"sort": {
"type": "array",
"items": {
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "The field to sort by."
},
"order": {
"type": "string",
"enum": [
"ASC",
"DESC",
"ASC,DESC"
],
"description": "The sorting direction. Sorting is case-insensitive when sorting strings."
}
}
},
"description": "The sorting information."
}
},
"required": [
"PCID"
]
}
```
***
## rapid7\_siem\_set\_status
Set the status of an investigation
**Parameters:**
| Parameter | Type | Required | Default | Description |
| --------- | ------ | -------- | ------- | ----------------------------------------------------------- |
| `id` | string | Yes | — | The ID or RRN of the investigation to change the status of. |
| `status` | string | Yes | — | The new status for the investigation (case-insensitive). |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"id": {
"type": "string",
"description": "The ID or RRN of the investigation to change the status of."
},
"status": {
"type": "string",
"description": "The new status for the investigation (case-insensitive).",
"enum": [
"OPEN",
"CLOSED",
"INVESTIGATING"
]
}
},
"required": [
"PCID",
"id",
"status"
]
}
```
***
## rapid7\_siem\_update\_comment
Update comment visibility
**Parameters:**
| Parameter | Type | Required | Default | Description |
| ------------ | ------ | -------- | ------- | ------------------------------------------------------ |
| `rrn` | string | Yes | — | The RRN of the comment. |
| `visibility` | string | Yes | — | The new visibility for the comment (case insensitive). |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"rrn": {
"type": "string",
"description": "The RRN of the comment."
},
"visibility": {
"type": "string",
"description": "The new visibility for the comment (case insensitive).",
"enum": [
"INTERNAL",
"PUBLIC"
]
}
},
"required": [
"PCID",
"rrn",
"visibility"
]
}
```
***
## rapid7\_siem\_upload\_attachment
Upload attachment
**Parameters:**
| Parameter | Type | Required | Default | Description |
| ---------- | --------- | -------- | ------- | ------------------ |
| `filedata` | string\[] | Yes | — | The filedata value |
```json theme={null}
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"filedata": {
"type": "array",
"items": {
"type": "string",
"format": "binary"
},
"description": "The filedata value"
}
},
"required": [
"PCID",
"filedata"
]
}
```