Alright, look. I've been wrangling with Rapid7 InsightCloudSec for months now, and while the platform's breadth is decent, their API and daily workflow for engineers is... let's call it "optimistically complex." I don't need another dashboard to stare at. I need actionable, immediate data in my terminal, where I actually *do* work.
Specifically, I got tired of manually fishing for high-severity findings every morning just to triage what my team needed to look at. Their UI is fine for managers, but for someone who has to actually *fix* things, it's a context-switching nightmare. So I built a crusty, effective CLI tool to pull high and critical severity findings on a daily cadence. It dumps a clean summary to stdout and can optionally slap the details into a JSON file for our internal logging. It uses the `/v2/resources/insights/search` endpoint with a baked-in filter for severity.
Here's the core of it. You'll need a valid API key with appropriate permissions, obviously.
```python
#!/usr/bin/env python3
import requests
import json
from datetime import datetime, timedelta
INSIGHT_CLOUDSEC_BASE_URL = "https://us.api.insight.rapid7.com"
API_KEY = "${YOUR_API_KEY}"
headers = {
"X-Api-Key": API_KEY,
"Content-Type": "application/json"
}
# This query finds HIGH and CRITICAL severity findings from the last 24h
search_payload = {
"filters": [
{"field": "severity", "operator": "IN", "values": ["HIGH", "CRITICAL"]},
{"field": "first_seen", "operator": "BETWEEN", "values": [
(datetime.utcnow() - timedelta(days=1)).isoformat() + "Z",
datetime.utcnow().isoformat() + "Z"
]}
],
"limit": 100 # tune as needed
}
response = requests.post(
f"{INSIGHT_CLOUDSEC_BASE_URL}/v2/resources/insights/search",
headers=headers,
json=search_payload
)
if response.status_code == 200:
data = response.json()
print(f"--- High/Critical Findings: {len(data.get('data', []))} ---")
for finding in data.get('data', []):
print(f"ID: {finding.get('id')}")
print(f"Resource: {finding.get('resource', {}).get('name')}")
print(f"Severity: {finding.get('severity')}")
print(f"Type: {finding.get('insight_definition', {}).get('name')}")
print("-" * 40)
# Optionally write to file
with open(f"findings_{datetime.now().date().isoformat()}.json", "w") as f:
json.dump(data, f, indent=2)
else:
print(f"API Error: {response.status_code} - {response.text}")
```
I run this as a cron job at 8 AM and have the output waiting in our team's ops channel. Saves about 15 minutes of pointless clicking and filtering every single day. The main pain points I worked around were their pagination logic (not shown here, but you'll need it for large result sets) and the sometimes-ambiguous field names in the API schema. Their documentation is, in typical enterprise fashion, comprehensive but organized for the people who wrote it, not the people using it.
If you're using this, you'll probably want to add:
* Proper error handling and retries.
* Pagination to get all results.
* Maybe filter by specific cloud accounts or resource types.
* Output formatting as Markdown for your wiki.
It's not pretty, but it gets the pipe flowing. Now I can integrate these findings directly into our ticketing system without the manual bottleneck. The goal is to automate the triage so we can spend time on actual remediation, not data gathering.
fix the pipe
Speed up your build