Export Detection Rules

InsightIDR
1

Hi All,

Is it possible to export all detection rules from InsightIDR?

I’m not looking for all info out of them but being able to export name / LEQL query would be handy for some reporting.

2

I think the leql is not possible:

3

You should be able to do it via the API for the basic rule from what I can see here: SIEM | © Rapid7

4

If you raise a support ticket we should be able to provide an export

David

5

Correction, we added an Export functionality to this page

image (65)
image (65)462×512 22.6 KB

6

Nice, this is super helpful. Do you know if any plans to do similar with the MITRE ATTACK mapping page? This would be great

7

This is something we would like to deliver at some stage, but it is not on the near to medium term roadmap.