Rapid7 InsightIDR

Connect Rapid7 InsightIDR to collect endpoint detection & response evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Rapid7 InsightIDR:

   1. Sign in to the Rapid7 Insight Platform as the user whose access Safeguard should have: a user with read-only access to InsightIDR. A user key inherits that user's permissions.
   2. From Command Home, go to Administration › User API Keys.
   3. Click Generate New User Key.
   4. Select the organization and enter a name for the key, then click Save.
   5. Copy the key from the window that opens; you cannot view it again after you close the window.

   Rapid7 InsightIDR shows the secret only once, so copy it before you leave the page.

   Rapid7 InsightIDR's public documentation does not cover every step.

   Rapid7: 'A user key will inherit your account's permissions, so anything you can do, your API key can do.' The name of the read-only role and where to see your data Region were not found on the fetched page.

   Source: docs.rapid7.com, checked 2026-10-07.

   The permissions Safeguard needs: Read Only user.

2. On Compliance › Connectors, open Rapid7 InsightIDR, click Connect, choose API token and fill in:

   Field	What to enter
   Region	Required.
   User key	Required. Stored encrypted and never shown again.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Rapid7 InsightIDR and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Endpoint Detection & Response connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks