Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

Rapid7 InsightVM is a vulnerability management solution that provides three main features: fully scan the network; prioritize risks and step-by-step directions for remediation; track and communicate the progress using dashboards. This action gets the most recent list of sites that are defined in the Rapid7 InsightVM Security Console. For each site it submits the data collection containing assets to the Rapid7 InsightVM provider. The provider starts a scan for each site on the hosts that are in the list of summited assets and returns a report for each site.

The integration provides the following action:

• Rapid7 insightVM - Scan Sites - scans all accessible sites on a Rapid7 insightVM instance using a threat collection of assets.

The action is compatible with the Asset object type and returns enriched Report system objects.

This action is intended for use with ThreatQ TDR Orchestrator (TQO). An active TQO license is required for this feature.

Prerequisites

• A Rapid7 InsightVM Security Console username and password.
• An active ThreatQ TDR Orchestrator (TQO) license.
• A ThreatQ data collection containing at least one Asset that has the attribute IP Address.

  It is recommended to build the collection using the output of Rapid7 insightVM - Sites feed from the Rapid7 InsightVM CDF.

Installation

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.
 

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Actions option from the Category dropdown (optional).
3. Click on the action entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   The configurations set on this page will be used as the default settings when inserting this action into a new workflow. Updating the configurations on this page will not update any instances of this action that have already been deployed to a workflow. In that scenario, you must update the action’s configurations within the workflow itself.

   Parameter	Description
   Host/IP: Port	Your Rapid7 insightVM instance you wish to connect.
   Rapid7 InsightVM Username	Your Rapid7 InsightVM Username.
   Rapid7 InsightVM Password	Your Rapid7 InsightVM Password.
   Verify SSL Certificate	If checked, specifies that this connector should verify SSL connections with the Rapid7 InsightVM server
   Scan Template	Select the configuration/type of scan to perform.
   Scan Engine	Select the scan engine to be used.

   
   
5. Review any additional settings, make any changes if needed, and click on Save.

Actions

The following action is available:

{
  "resources": [
    {
      "assets": 2,
      "id": 2,
      "importance": "high",
      "lastScanTime": "2023-04-18T07:40:43.082Z",
      "links": [
        {
          "href": "https://10.13.0.65:3780/api/3/sites/2",
          "rel": "self"
        },
        {
          "href": "https://10.13.0.65:3780/api/3/sites/2/alerts",
          "rel": "Alerts"
        },
        {
          "href": "https://10.13.0.65:3780/api/3/sites/2/scan_engine",
          "rel": "Scan Engine"
        }
      ],
      "name": "ThreatQ Instance (ESXi)",
      "riskScore": 18116.0,
      "scanEngine": 3,
      "scanTemplate": "full-audit-without-web-spider",
      "type": "static",
      "vulnerabilities": {
        "critical": 0,
        "moderate": 10,
        "severe": 43,
        "total": 53
      }
    }
  ]
}

{
  "hosts": [
    "10.12.0.101",
    "10.13.0.12"
  ],
  "templateId": "exhaustive-audit"
}

{
  "links": [
    {
      "href": "https://10.13.0.65:3780/api/3/sites/2/scans?overrideBlackout=false",
      "rel": "self"
    },
    {
      "href": "https://10.13.0.65:3780/api/3/scans/230",
      "rel": "Scan"
    }
  ],
  "id": 230
}

Enriched Data

Object counts and action runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and action runtime may vary based on system resources and load.

Change Log

• Version 1.0.0
  • Initial release