Follow Use the Log Search API. Send a LEQL query for a log and a time window to https://<region>.rest.logs.insight.rapid7.com/query/logs/<log-key> with your API key in the X-Api-Key header. The API returns events in pages and gives you a link to the next one. Log Search in the UI can export results too.
InsightIDR collects endpoint, network and cloud logs for Rapid7 customers, and its Log Search is where investigations usually start. Prime Core has 23,965 detection rules for InsightIDR, mapped to 676 MITRE ATT&CK techniques. Below is how to get logs out, sanitize them, and investigate them for free in LogTotal.
Before you start
An API key. Create one in the Insight Platform settings (an organization key or a user key) with access to InsightIDR.
Your region. The host depends on where your data lives: us, us2, us3, eu, ca, au, ap.
Log keys. Each log has a key, and queries run against one or more of them. List them with the API, as shown below.
Retention. How far back Log Search goes depends on your subscription.
Export with the Log Search API
REGION=us
BASE="https://$REGION.rest.logs.insight.rapid7.com"
FROM=$(date -d '2026-10-19T00:00:00Z' +%s000)
TO=$(date -d '2026-10-20T00:00:00Z' +%s000)
Q=$(printf '%s' 'where(hostname=web-03)' | jq -sRr @uri)
# list logs and their keys
curl -sS -H "X-Api-Key: $R7_KEY" "$BASE/management/logs" | jq -r '.logs[] | "\(.id) \(.name)"'
# query one log, following the pages
URL="$BASE/query/logs/<log-key>?query=$Q&from=$FROM&to=$TO&per_page=500"
while [ -n "$URL" ]; do
RESP=$(curl -sS -H "X-Api-Key: $R7_KEY" "$URL")
echo "$RESP" | jq -c '.events[]?'
URL=$(echo "$RESP" | jq -r '.links[]? | select(.rel == "Next") | .href' | head -1)
done > r7_web03_1019.jsonl
Long-running queries may first answer with a link to poll instead of results. Each event’s message field holds the log entry. Extract it with jq -r ‘.message’ when the source was text.
Upload, sanitize and review in LogTotal
- Upload. Open logtotal.com and drop in the file.
- Sanitize. Look it over before you continue.
- Review.
What this looks like on real data.
When it goes wrong
| Symptom | Likely cause | Fix |
|---|---|---|
| 401 or 403 | Wrong key, or the key lacks InsightIDR access | Check the key’s product access |
| Connection errors | Wrong region in the hostname | Use your data region |
| Query syntax error | LEQL not URL-encoded | Encode it, as with @uri above |
| Only the first page | Next link not followed | Loop until there’s no Next link |
| Nothing older than a certain date | Subscription retention | Check your plan’s retention |
FAQ
Can I query several logs at once?
Yes. The API also accepts queries across multiple log keys or a log set.
What about investigations and alerts?
Those have their own APIs. For LogTotal, export the log events behind them.
