InsightVM Cloud Integrations API - search by asset tag?

InsightVM API
1

How can I search by asset tag in the v4 asset search API? As a reference, this is part of my list of assets (with lots of field removed for brevity):

$ curl -X POST -H "X-Api-Key: XXX" -H "Content-Type: application/json" https://us2.api.insight.rapid7.com/vm/v4/integration/assets

{
  "data" : [ {
    "assessed_for_policies" : false,
    "tags" : [ {
      "name" : "other vms",
      "type" : "SITE"
    } ],
    "total_vulnerabilities" : 230,
    "new" : [ ],
    "remediated" : [ ]
  } ]
}

I’ve confirmed that searching based on various fields (e.g., ip, os_family, etc.) works, but I can’t search on tags:

$ curl -X POST -H "X-Api-Key: XXX" -H "Content-Type: application/json" -d "{\"asset\": \"tags IN ['other vms']\"}" https://us2.api.insight.rapid7.com/vm/v4/integration/assets
{
  "data" : [ ],
  "metadata" : {
    "number" : 0,
    "size" : 10,
    "totalResources" : 0,
    "totalPages" : 0,
    "cursor" : null
  },
  "links" : [ {
    "href" : "https://us2.api.insight.rapid7.com:443/vm/v4/integration/assets?page=0&size=10&sort=id,asc",
    "rel" : "self"
  } ]
}

OK, this doesn’t work, but surely the inverse will, right?

$ curl -X POST -H "X-Api-Key: XXX" -H "Content-Type: application/json" -d "{\"asset\": \"tags NOT IN ['other vms']\"}" https://us2.api.insight.rapid7.com/vm/v4/integration/assets
{
  "data" : [ ],
  "metadata" : {
    "number" : 0,
    "size" : 10,
    "totalResources" : 0,
    "totalPages" : 0,
    "cursor" : null
  },
  "links" : [ {
    "href" : "https://us2.api.insight.rapid7.com:443/vm/v4/integration/assets?page=0&size=10&sort=id,asc",
    "rel" : "self"
  } ]
}

What about CONTAINS?

$ curl -X POST -H "X-Api-Key: XXX" -H "Content-Type: application/json" -d "{\"asset\": \"tags CONTAINS 'other vms'\"}" https://us2.api.insight.rapid7.com/vm/v4/integration/assets
{
  "data" : [ ],
  "metadata" : {
    "number" : 0,
    "size" : 10,
    "totalResources" : 0,
    "totalPages" : 0,
    "cursor" : null
  },
  "links" : [ {
    "href" : "https://us2.api.insight.rapid7.com:443/vm/v4/integration/assets?page=0&size=10&sort=id,asc",
    "rel" : "self"
  } ]
}

Maybe =?

$ curl -X POST -H "X-Api-Key: XXX" -H "Content-Type: application/json" -d "{\"asset\": \"tags = 'other vms'\"}" https://us2.api.insight.rapid7.com/vm/v4/integration/assets
{
  "_type" : "com.rapid7.spring.rest.error.resource.ErrorResource",
  "status" : 400,
  "localized_message" : null,
  "message" : "Your query string format is not valid. It has 1 error: The operator '=' cannot be used with the data type 'STRINGS'",
  "throwable" : null
}

So I know for sure that tags is a) indexed and b) is string array, which is interesting since it’s an object to begin with. Is there a special syntax for the string value that I’m not aware of or some other insight someone can give me on how to search against this field? Thanks.

2

what about getting all the assets of a tag, them looping through those calling the assets?

/api/3/tags/{id}/assets

3

That’s the on-prem InsightVM API, isn’t it? We can only use the cloud-based one.

4

Sorry, want to revive this topic. I am wondering if anyone found the way to restrict the Cloud based api for assets by Site tag value. We too are unable to use the console based api.

5

This filter in the body of the Post seems to work for restricting to assets in a site

{“asset”: “sites IN [‘sitename’]”}

6

@llannamal thanks for the suggestion, this works!