How to Export Rapid7 InsightIDR Logs for Investigation
Summary
A practical guide to exporting Rapid7 InsightIDR logs through the Log Search API or UI, then sanitizing and reviewing the events in LogTotal for investigations.
Key points
- The API workflow uses a LEQL query, time window, log key, regional endpoint, and an API key in the X-Api-Key header.
- List log keys through the management API, then follow the response’s Next link to retrieve all event pages; long-running queries may provide a polling link.
- The example writes events to a JSONL file and shows how to extract text from each event’s message field.
- Troubleshooting guidance covers access errors, incorrect regions, URL-encoding LEQL queries, pagination, and subscription-based retention limits.
- The article also notes that Log Search in the UI can export results and recommends sanitizing logs before reviewing them in LogTotal.
Article Details
- Defense Focus
- Export InsightIDR log events for investigation, then sanitize and review them in LogTotal.
- Detection Methods
- Query logs with LEQL for a selected time window, optionally filtering by hostname.
- Export search results through the InsightIDR Log Search UI.
- Follow pagination links and poll when a long-running query returns a polling link.
- Data Sources
- Endpoint logs
- Network logs
- Cloud logs
- InsightIDR log event message fields
- Rule Types
- LEQL queries
- Defensive Actions
- Use an API key with InsightIDR access and select the region where the data resides.
- List log keys and query the relevant log or log set over the required time window.
- Continue through all result pages rather than stopping after the first page.
- Check key permissions, region, URL encoding, pagination, and subscription retention when exports fail or return incomplete results.
- Sanitize exported logs before reviewing them in LogTotal.