Managing Rapid7 Scanner Imports

Anomali Security Analytics supports asset report imports from Rapid7 InsightVM Platform.

About Rapid7 Scanner Imports

When you configure an integration with the scanner from Security Analytics, you must specify scanner connection information, including the Rapid7 region and the API key for your Rapid7 InsightVM Platform account.

The Security Analytics queries to Rapid7 return the following fields which populate Security Analytics asset datastore records:

  • IP address

  • MAC address

  • Hostname

  • Operating system

  • Vulnerabilties (CVEs)

  • Asset date

Create a New Scanner Configuration

To import assets from a Rapid7 scanner:

  1. Click the Settings icon in the left navigation panel and select Security Analytics.

  2. Click Assets.

  3. Click the Scanner tab.

  4. Click Create New Scanner.

  5. Complete the configuration as described in the following table.

    Setting Description
    Scanner Select Rapid7 InsightVM Platform.
    Name A meaningful configuration name.
    Region Select your Rapid7 region. Refer to the Rapid7 topic, "Check your data region," for a pointer on how to look up the region provisioned for your organization.
    API Key Paste the API key that has authorization to the desired assets. It does not matter if the API key is a platform, organization, or user API key. Refer to the Rapid7 topic, "Managing Platform API Keys," for details on how to look up the API key.

  6. Click Next.

  7. Specify the schedule and the type of search as described in the following table.

    Setting Description
    Sync Data

    Specify the schedule for the sync job:

    • Interval: Select every 1 day, 2 days, 7 days, 14 days, or 28 days.

    • Start time: Type the hour (0-23) and minute (0-59).

      • Note: The time you specify for asset scanner sync jobs is UTC time with no time zone offset. For example, if you specify the start time for the sync job to be 12:00, it runs at 12:00 UTC, which is 05:00 in Los Angeles and 13:00 in Belfast.
    Scan events for the last

    Specify the time range for returning asset information from the scans in the following format:

    n days
  8. Click Save.
Notes:

  • When the scanner configuration is initially activated, Anomali Security Analytics queries Rapid7 to scan for the period specified by the Scan events for the last setting. Subsequently, at the time specified by the Each Sync data interval, Security Analytics queries Rapid7 for the delta (the difference) resulting from changes during the interval period.

  • If you change the Scan events for the last setting, or if you toggle activation off and on again, Security Analytics again queries Rapid7 for the full period specified by the Scan events for the last setting.

Toggle Activation for a Scanner Configuration

In the Active column, click the checkbox to make the scanner configuration active or inactive.

Modify a Scanner Configuration

In the Actions column, click the Edit icon to modify a scanner configuration.

Note: You are prompted to enter the API key to save changes to the scanner configuration.

Clone a Scanner Configuration

In the Actions column, click the Clone icon to create an editable copy of a configuration.

Note: You are prompted to enter the API key to save a cloned copy of the scanner configuration.

Delete a Scanner Configuration

In the Actions column, click the Delete icon to delete a scanner configuration.

Preview a Scanner Configuration

In the Actions column, click the Preview icon to view the scanner configuration details and to see a detailed history of updates from the scanner. The history is a chronology of successful jobs and jobs that may have terminated due to an error.