Rapid7 Search API
A global Search API is exposed to facilitate the execution of user-defined queries that can perform a Search across the supported resource types exposed via the API. Each Search Request must specify both the resource type and the query to be executed. Below details the specific catalog of properties for each resource type that can be used as atoms of the Search query, and the operators that can be used with them.Search CatalogResource TypePropertiesAPPapp.idapp.nameapp.descriptionSCAN_CONFIGscanconfig.idscanconfig.namescanconfig.descriptionscanconfig.app.idscanconfig.attack_template.idSCANscan.idscan.statusscan.failure_reasonscan.submit_timescan.completion_timescan.app.idscan.scan_config.idscan.submitter.idscan.submitter.typeVULNERABILITYvulnerability.idvulnerability.severityvulnerability.statusvulnerability.scans.idvulnerability.app.idvulnerability.root_cause.urlvulnerability.root_cause.parametervulnerability.root_cause.methodvulnerability.discoveries.discoveredvulnerability.first_discoveredvulnerability.last_discoveredvulnerability.newly_discoveredATTACK_TEMPLATEattacktemplate.idattacktemplate.nameattacktemplate.descriptionattacktemplate.system_definedTARGETtarget.idtarget.domaintarget.enabledENGINEengine.idengine.nameengine.statusengine.engine_group.idengine.engine_group.nameENGINE_GROUPenginegroup.idenginegroup.nameenginegroup.descriptionSCHEDULEschedule.idschedule.nameschedule.enabledschedule.app.idschedule.scan_config.idBLACKOUTblackout.idblackout.nameblackout.enabledblackout.app.idblackout.scopeFILEfile.idfile.namefile.descriptionfile.typefile.lockedfile.apps.idfile.owner.idTAGtag.idtag.nametag.creator.idtag.createdREPORTreport.idreport.namereport.typereport.formatreport.owner.idreport.generatedDatereport.app.idSearch OperatorsOperatorDescription=Equal To. Returns all records that equal the specified value.!=Not Equal To. Returns all records that are not equal to the specified value.>Greater Than. Returns all records that are greater than the specified value.>=Greater Than or Equal To. Returns all records that are greater than or equal to the specified value.<Less Than. Returns all records that are less than the specified value.<=Less Than or Equal To. Returns all records that are less than or equal to the specified value.CONTAINSReturns all records that contain the specified string.STARTS WITHReturns all records that start with the specified string.ENDS WITHReturns all records that end with the specified string.LIKEWorks as a normal regular expression as opposed to SQL regular expression.IS NULLReturns all records whose specified value is NULL (contains the NULL value).IS NOT NULLReturns all records whose specified value is not NULL (does not contain the NULL value).&&The 'logical AND' operator returns values when both conditions are true.||The 'logical OR' operator returns values when one of the conditions is true.BETWEENAn operator to allow range checking for date types.Useful ExamplesQueryDescriptionapp.name CONTAINS 'production' && app.description LIKE '.*(South|North) America.*'Find all Apps where the name contains the text 'production' and the description contains the text 'South America' or 'North America'scanconfig.name = 'Weekly Scan' && scanconfig.app.id = '12345678-1234-1234-1234-123456789012'Find all Scan Configs where the name is exactly the text 'Weekly Scan' and the App that owns it has a ID of value '12345678-1234-1234-1234-123456789012'scan.status = 'COMPLETE' || scan.status = 'FAILED' && scan.completion_time BETWEEN '2018-11-01T00:00:00' AND '2018-12-1T00:00:00'Find all Scans that ran to a terminal state in November 2018vulnerability.severity = 'HIGH' && vulnerability.app.id = '12345678-1234-1234-1234-123456789012'Find all Vulnerabilities where the severity is HIGH and the App that owns it has a ID of value '12345678-1234-1234-1234-123456789012'attacktemplate.system_defined = 'true' && attacktemplate.name = 'Crawl Only'Find the system-defined Crawl-Only Attack Templatetarget.enabled = 'false'Find all disabled TargetsNotesPlease note that the search DSL is case-sensitive and as such all resource properties and search operators should be checked for correct casing in the result of a query validation error response.