> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Rapid7 InsightIDR

> Connect Rapid7 InsightIDR to Myrmex over the Insight platform API — create an API key and add the integration.

import { Note, Steps, Step, CardGroup, Card, Tip } from '@mintlify/components';

Connect your **Rapid7 InsightIDR** tenant so Myrmex can review investigations, run log searches, and enrich entities. Myrmex reaches the **InsightIDR API** (`api.insight.rapid7.com`) and **Log Search** (`rest.logs.insight.rapid7.com`) over HTTPS through a [Collector](/documentation/agent-endpoint-security/collector-mode) on your network. Every request runs **live, on demand** — Myrmex returns only what you ask for and copies or stores nothing from Rapid7 on its side. Credentials are resolved on your side and never pass through the model.

## What Myrmex Can Do

<CardGroup cols={2}>
  <Card title="Review investigations" icon="magnifying-glass">
    List and inspect InsightIDR investigations to see what has already been detected.
  </Card>

  <Card title="Run Log Search" icon="terminal">
    Query logs live with LEQL against the Log Search API and return only the matching results.
  </Card>

  <Card title="Read detections & alerts" icon="triangle-exclamation">
    Pull detections and [alerts](/documentation/detection-response/alerts) to support triage.
  </Card>

  <Card title="Enrich entities" icon="sitemap">
    Look up assets, users, and indicators on demand — nothing is retained on the Myrmex side.
  </Card>
</CardGroup>

## Before You Start

* A **Collector** with outbound HTTPS (port `443`) to your region's InsightIDR API and Log Search hosts. See [Collector mode](/documentation/agent-endpoint-security/collector-mode).
* A **Rapid7 platform API key** — you create this in Step 1.
* Your **data region** (us, eu, ca, au, ap), which sets the API hosts.

## Step 1 — Create the Credential in Rapid7

<Steps>
  <Step title="Open API Keys in the Insight platform">
    Sign in to the Rapid7 Insight platform and go to **Platform Administration → API Keys** (or your user menu → **Manage API Keys**).
  </Step>

  <Step title="Create an organization or user key">
    Create a new **API key**. An organization key tied to a least-privilege member works well for automated access. Copy the value once — it is shown only at creation.
  </Step>

  <Step title="Confirm your region">
    Note your data region. It sets both hosts, e.g. `us.api.insight.rapid7.com` and `us.rest.logs.insight.rapid7.com`.
  </Step>
</Steps>

<Tip>
  Scope the API key to the least privilege that still lets Myrmex read investigations and run the searches you need.
</Tip>

## Step 2 — Add the Integration in Myrmex

From the **Directory**, choose **Add Integration → Rapid7 InsightIDR**. Myrmex talks to two Rapid7 endpoints — the **Insight API** and **Log Search** — using the same platform API key for both.

| Field           | Description                                  |
| --------------- | -------------------------------------------- |
| **Name**        | A unique name for this InsightIDR tenant.    |
| **Description** | Optional note to identify the tenant.        |
| **Collector**   | Select collectors to gather InsightIDR data. |

**Insight API**

| Field                | Description                                                                |
| -------------------- | -------------------------------------------------------------------------- |
| **Protocol**         | `https`.                                                                   |
| **Insight API Host** | Region-specific InsightIDR API host (default `us.api.insight.rapid7.com`). |
| **API Port**         | Default `443`.                                                             |
| **API Key Header**   | Header used to send the key (default `X-Api-Key`).                         |
| **API Key**          | Rapid7 platform API key from Step 1.                                       |

**Log Search**

| Field              | Description                                                                  |
| ------------------ | ---------------------------------------------------------------------------- |
| **Protocol**       | `https`.                                                                     |
| **Logs API Host**  | Region-specific Log Search host (default `us.rest.logs.insight.rapid7.com`). |
| **Logs Port**      | Default `443`.                                                               |
| **API Key Header** | Header used to send the key (default `X-Api-Key`).                           |
| **API Key**        | Rapid7 platform API key from Step 1.                                         |

## Connect

Click **Connect** to validate both endpoints and finish. Rapid7 InsightIDR then appears under **Environment → Integrations**, and you can ask about it in the Workspace or through the [Integration Specialist agent](/documentation/multi-agent-system/integration-specialist-agent).

<Note>
  Both hosts must match your data region. If searches work but investigations do not (or vice versa), re-check the region on the host that fails.
</Note>