Has anyone discovered a reliable way of discovering and reporting on how many investigations generated in Rapid7 are due to Claude, Claude Code or Github Copilot running something?
I’m sure we’re not unique in getting a number of benign tickets due to the way these AI tools operate, but would be interesting to see this reported on.
thousands of FP caused by Claude Code and Codex. Rapid7 might take a look.
One thing you can do is navigate to the Alerts page, and ensure you have Not Included in Investigation unchecked (to show all alerts) and then include all statuses (Closed/Open/Waiting/etc)
Then search for Claude in the search box, it will search across alerts for any matches in the alert names, or relevant payload fields.
You could then build out a data stacking view and export the results to CSV with your desired columns.
Your search would look something like this, you can span 6 months at a time for your search window.
Note if you are on the Alerts Table View you need to hit Data Stacking View to switch
Once on the Data Stacking View there is an Export to CSV icon to the right
You can set your chosen stacking columns using the Edit Table icon
David
