Rapid7 InsightVM Connector User Guide

Summary: How to set up and use the Rapid7 InsightVM connector in Ivanti Neurons for RBVM.

Overview

The Ivanti Neurons for RBVM platform provides an API-based connector that integrates with Rapid7 InsightVM. This integration enables customers to bring to gain visibility of their overall network posture and achieve a simplified and efficient way to manage vulnerabilities. Ivanti Neurons for RBVM users can configure the connector to pull scan data from Rapid7 InsightVM on a periodic basis as well.

Data from Rapid7 InsightVM is ingested as hosts and host findings in Ivanti Neurons for RBVM. Refer to the data mapping section below for details.

Connector Configuration

Prerequisites

• Requires an active subscription to Ivanti Neurons for RBVM.
• Requires an active subscription to Rapid7 InsightVM.
• URL used to access the instance of Rapid7 InsightVM.

Rapid7 documentation for managing user permissions can be found here: Welcome to InsightVM | InsightVM Documentation

Connections

The following API calls are performed during a connector run to pull security vulnerabilities from Rapid7 InsightVM into Ivanti Neurons for RBVM.

API Type	Endpoint
Get All Assets	/api/3/assets
Get Vulnerability Details	/api/3/vulnerabilities

Platform Setup

When logged into the platform, navigate to the Automate > Integrations page.

Using the search bar in the upper-right corner of the Integrations page, type InsightVM to find the connector. Locate the Rapid7 InsightVM card under Network and click Configuration.

Complete the following required fields. These fields include:

• Connector Name: Connector name for the Ivanti Neurons platform.
• URL: Rapid7 InsightVM instance URL.
• User Name and Password: Rapid7 InsightVM user credentials.
• Network: Network name in Ivanti Neurons. Ingested assets and findings will be associated with this network.

Once the fields have been filled out, click Test Credentials to ensure the connector can connect to the Rapid7 InsightVM instance.

Additional connector configurations, such as Schedule and Optional Configurations can be set up here.

Optional Configurations

• Pull tag information from InsightVM: This will create asset tags based on the Rapid7 InsightVM labels. The default behavior is not to create tags.
• Create assets that do not have vulnerabilities: This will create assets that exist in the Rapid7 InsightVM platform when there are no vulnerabilities. The default behavior is to only create assets with vulnerabilities.

Once the connector configuration is complete, click the Save button.

When the connector is set up, a new entry for it appears at the top of the Integrations page. This connector runs once the initial setup is complete. Check the connector’s status by clicking the History button.

In the Upload Center (navigate to the Settings > Upload page), files pulled from Rapid7 InsightVM are parsed, aggregated, and filtered for display in Ivanti Neurons.

Editing a Connector Configuration

Connector configurations can be updated at any time after creation. Go to the Automate > Integrations page and select the specific connector you want to update.

Utilizing the Connector

The data from a Rapid7 InsightVM scan file is ingested into Ivanti Neurons for RBVM as hosts and host findings. The Scanner Name associated with these scans is InsightVM. Scanner Name can be used as a filter on the Hosts and Host Findings pages.

Assets

Asset data extracted from Rapid7 InsightVM scan files is shown on the Hosts page. Project and version details are also extracted from the scan file.

In the Hosts Detail pane under the Scanner Specific Information section, the scanner is listed as InsightVM.

Findings

All findings from the Rapid7 InsightVM scan file are shown on the Host Findings page.

Severity Mapping

Rapid7 InsightVM reports severity on the same 0.0-10.0 scale used by Ivanti Neurons for RBVM with no modification.

Connector Data Mapping

This table maps the high-level fields from Rapid7 InsightVM with that of the Ivanti Neurons for RBVM platform.

Note: Ivanti Neurons for RBVM for provides vulnerability counts per project rather than at the component level. Users can also filter findings based on each component and risk type.

Hosts	Platform field	InsightVM Field
	Hostname	host_name
	InsightVM Asset ID	id
	IP Address	ip
	Last Discovered On	last_assessed_for_vulnerabilities
	Mac Address	mac
	InsightVM OS Architecture	os_architecture
	Operating System	os_description
	InsightVM Risk Score	risk_score
	InsightVM Assessed for Policies	assessed_for_policies
	InsightVM Assesed for vulnerabilities	assessed_for_vulnerabilities
	Tags	tags.Type:name
Host Findings	InsightVM Check ID	assets.check_id
	Finding First Discovered On	assets.first_found
	InsightVM Key	assets.key
	Finding Last Discovered On	assets.last_found
	InsightVM NIC	assets.nic
	port	assets.port
	InsightVM Proof	assets.proof
	protocol	assets.protocol
	solution	assets.solution_fix
	InsightVM Solution ID	assets.solution_id
	InsightVM Solution Summary	assets.solution_summary
	InsightVM Solution Type	assets.solution_type
	InsightVM Check Status	assets.status
	Plugin ID - Unique finding identifier+port	assets.vulnerability_id
	Finding First Discovered On-Redundant	vulnerabilities.added
	InsightVM Categories	vulnerabilities.categories
	InsightVM CVES	vulnerabilities.cves
	InsightVM Denial of Sevice	vulnerabilities.denial_of_service
	Description	vulnerabilities.description
	InsightVM Exploits	vulnerabilities.exploits
	Plugin ID - Unique finding identifier+port - MATCH THIS	vulnerabilities.id
	InsightVM References	vulnerabilities.references
	InsightVM Malware Kits	vulnerabilities.malware_kits
	Finding Last Discovered On - Redundant	vulnerabilities.modified
	InsightVM PCI CVSS Score	vulnerabilities.pci_cvss_score
	InsightVM PCI Fail	vulnerabilities.pci_fail
	InsightVM PCI Severity Score	vulnerabilities.pci_severity_score
	InsightVM PCI Special Notes	vulnerabilities.pci_special_notes
	InsightVM PCI Status	vulnerabilities.pci_status
	InsightVM Published	vulnerabilities.published
	InsightVM Risk Score	vulnerabilities.risk_score
	Severity	vulnerabilities.severity
	Scanner Reported Severity	vulnerabilities.severity_score
	Title	vulnerabilities.title