Skip to main content
Close all the investigations that match the filtering criteria. Note: One of the following parameters is required - Alert Type, Detection Rule RRN.
External DocumentationTo learn more, visit the Rapid7 InsightIDR documentation.

​
Parameters

ParameterDescription
Alert TypeThe type of the alert that should be closed. For example - Attacker Behavior Detected.

Note: This parameter is required when closing ALERT investigations.
Detection Rule RRNThe RRN of the detection rule.

Note: Using this parameter requires Alert Type to be set to Attacker Behavior Detected.
DispositionA disposition to set the investigation to. Defaults to NOT_APPLICABLE.
FromA starting timeframe to close investigations created after it.
Max Investigations To CloseThe maximum number of investigations to close.

Note: If this limit is exceeded - status code 400 will be returned.
SourceThe source of an investigations to close.
ToAn ending timeframe to close investigations created after it.

​
Example Output

{
	"ids": [
		"581134c9-2510-4010-865c-7ae81761315b",
		"114c706d-e64a-4731-997b-9115beef3026"
	],
	"num_closed": 2
}

​
Workflow Library Example

Close Multiple Investigations with Rapid7 Insightidr and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop