Rapid7 Nexpose On-Premises Connector

August 22, 2024 19:37

Note: This article applies only to the Rapid7 Nexpose On-Premises connector (a file-based connector) that requires access to your IT environment. For more information about the Rapid7 InsightVM Cloud connector, see the Rapid7 InsightVM Cloud Connector.

Cisco Vulnerability Management supports the Rapid7 Nexpose On-Premises scanner so you can scan your IT environments for vulnerabilities, identify active services, open ports, and applications to reduce risk in your IT environment. It requires an XML 2.0 export file from the Nexpose On-Premises scanner to ingest its data. You can use this connector to perform the following tasks:

Run a manual report to get an XML 2.0 file from the Rapid7 Nexpose On-Premises scanner, and then import it into Cisco Vulnerability Management.
Use the API to run the XML 2.0 file, and then export it into Cisco Vulnerability Management.

User Prerequisites for the Rapid7 Nexpose Connector Setup

Nexpose is an on-premises scanner, so ensure you are using the Virtual Tunnel, or you have setup the Agent deployed in the same network as your Rapid7 scanner to allow Cisco Vulnerability Management to connect with it.
Create a user account in Nexpose. For more information, see Managing and creating user accounts.
Create an XML 2.0 report, and then schedule the report to run on a regular basis.

Report Prerequisites

All XML 2.0 reports are imported that display under the Rapid7 user that is configured in Cisco Vulnerability Management (including old reports that are no longer being generated).
Ensure that the Rapid7 user has access only to required reports and nothing else.
If the report is “started” but has not finished generating when the Cisco Vulnerability Management connector starts, it retries multiple times over the next 30 minutes. If the report has a status of anything other than 'Generated' after the 30 minutes, the connector run fails.

Configuring your Rapid7 Nexpose On-Premises Connector

Note: To configure this connector, you must be a Cisco Vulnerability Management administrator.

1. In Cisco Vulnerability Management, go to the Connectors tab, and click RAPID7 Nexpose.

2. On the Nexpose Enterprise window, enter the following information:

Name: Enter a name for the connector, or leave it as Nexpose Enterprise.
Username and Password: Enter credentials for a non-administrator account.
Host: Enter information for your scanner. Note: Just type the host IP and port without the: https://.
Schedule: Select the frequency when you want to run your Rapid7 Connector, such as Daily, Weekly, or Monthly. Note: Cisco recommends that you run the connector on the same schedule as you run your Scans.
If required, type the Silo ID.
Asset Inactivity Limit (days): Enter a time in days for the connector level asset inactivity limit. Tip: You can set a Connector-level asset inactivity limit now, and you can change the value at any time.

3. Click Save And Verify.

Data Mapping

The following table shows how the Rapid7 fields map to fields in Cisco Vulnerability Management.

Rapid7 Field	Cisco Vulnerability Management Field	Notes
Title	Name
vuln.id	Identifier (Vulnerability)
Vuln > description	Description
	Details / Synopsis
Vuln > Solution	Solution/Fix
Fix > fix_url	URL (Fix)
Fix > fix_reference_links	Reference Links
Fix > fix_published_by_source_datetime	Fix Published Date
Vuln > Severity	scanner_score	1-10
`vulnerable-`	Vulnerability Status	It maps only open/closed vulnerabilities. It auto-closes any vulnerability not found on the next Connector import (by the same connector)
cve_identifiers	CVE
endpoint data > port	Ports
last_found_on	Last Seen
vulnerable-since_date	Found On
N/A	Created	Date the vulnerability is first imported into Cisco Vulnerability Management. It is not mapped to a scanner field.
os_vendor	OS	{os_vendor + os_family + os_product + os_version}
device_id	external_id
names	hostname	The Host name is extracted from the names array. This value is used for asset deduplication.
names	FQDN	The FQDN is extracted from the names array. This value is used for asset deduplication.
addr	ip_address
hardware-address	MAC_address
Tags Asset Groups Site Names Device ID	Tags	All these items are converted to tags in Cisco Vulnerability Management.

Rapid7 items Converted into Cisco Vulnerability Management Tags

Metadata from Rapid7 scans convert into the following Cisco Vulnerability Management tags:

Existing Nexpose Tags
Asset Groups
Site Names

Note: Tags are used in search queries or to create Risk Meter groups.

Vulnerability Date Information

You can display the following dates on the Vulnerabilities tab:

Found: The date when the scanner first found the vulnerability.
Last Seen: The date when the Rapid7 scanner found the vulnerability.
Created: The date when the vulnerability was first imported into Cisco Vulnerability Management.

Optional Settings

You can enable the following settings to run on the backend for Rapid7 connectors. To have these settings enabled, or for more information, contact Cisco Technical Support.

Asset Group Tags
- When enabled, the scanner will pull asset group tags from Rapid7.

Exclude Informationals
- When this option is enabled, Cisco Vulnerability Management will only import vulnerabilities that include a CVE.
Ignore Scanner Last Seen Time
- If you do not want the asset last seen time in Cisco Vulnerability Management to be the scanner reported last seen time.
Skip Tags
- This setting will allow you to not create any Tags in Cisco Vulnerability Management based on the Rapid7 metadata.
Tag Reset
- This setting will assist in keeping your Rapid7 metadata synchronized with Cisco Vulnerability Management. Each time the connector is run, all tags in Cisco Vulnerability Management will be removed and the Rapid7 tag metadata will be re-created.
- If you have created any manual tags or any tags were created based on metadata from other connectors, that tag information will be removed and will be refreshed once those other connectors are rerun.

Additional Assistance

For assistance with this connector, contact Support.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R)