{ "name": "rapid7_insightvm", "title": "Rapid7 InsightVM", "version": "2.8.0", "release": "ga", "source": { "license": "Elastic-2.0" }, "description": "Collect logs from Rapid7 InsightVM with Elastic Agent.", "type": "integration", "download": "/epr/rapid7_insightvm/rapid7_insightvm-2.8.0.zip", "path": "/package/rapid7_insightvm/2.8.0", "icons": [ { "src": "/img/rapid7-insightvm-logo.svg", "path": "/package/rapid7_insightvm/2.8.0/img/rapid7-insightvm-logo.svg", "title": "Rapid7 InsightVM", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.4 || ^9.1.4" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "vulnerability_management", "vulnerability_workflow", "cloudsecurity_cdr" ], "signature_path": "/epr/rapid7_insightvm/rapid7_insightvm-2.8.0.zip.sig", "format_version": "3.4.0", "readme": "/package/rapid7_insightvm/2.8.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/rapid7-insightvm-vulnerability-dashboard.png", "path": "/package/rapid7_insightvm/2.8.0/img/rapid7-insightvm-vulnerability-dashboard.png", "title": "Rapid7 InsightVM Vulnerability Dashboard Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/rapid7-insightvm-asset-dashboard.png", "path": "/package/rapid7_insightvm/2.8.0/img/rapid7-insightvm-asset-dashboard.png", "title": "Rapid7 InsightVM Asset Dashboard Screenshot", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/rapid7_insightvm/2.8.0/LICENSE.txt", "/package/rapid7_insightvm/2.8.0/changelog.yml", "/package/rapid7_insightvm/2.8.0/manifest.yml", "/package/rapid7_insightvm/2.8.0/validation.yml", "/package/rapid7_insightvm/2.8.0/docs/README.md", "/package/rapid7_insightvm/2.8.0/img/rapid7-insightvm-asset-dashboard.png", "/package/rapid7_insightvm/2.8.0/img/rapid7-insightvm-logo.svg", "/package/rapid7_insightvm/2.8.0/img/rapid7-insightvm-vulnerability-dashboard.png", "/package/rapid7_insightvm/2.8.0/kibana/tags.yml", "/package/rapid7_insightvm/2.8.0/data_stream/asset/manifest.yml", "/package/rapid7_insightvm/2.8.0/data_stream/asset/sample_event.json", "/package/rapid7_insightvm/2.8.0/data_stream/asset_vulnerability/manifest.yml", "/package/rapid7_insightvm/2.8.0/data_stream/asset_vulnerability/sample_event.json", "/package/rapid7_insightvm/2.8.0/data_stream/vulnerability/manifest.yml", "/package/rapid7_insightvm/2.8.0/data_stream/vulnerability/sample_event.json", "/package/rapid7_insightvm/2.8.0/kibana/dashboard/rapid7_insightvm-a1345db0-b725-11ed-9179-55e576c8acae.json", "/package/rapid7_insightvm/2.8.0/kibana/dashboard/rapid7_insightvm-ae7bd8c0-b71d-11ed-9179-55e576c8acae.json", "/package/rapid7_insightvm/2.8.0/kibana/search/rapid7_insightvm-0f8409c0-b733-11ed-9179-55e576c8acae.json", "/package/rapid7_insightvm/2.8.0/kibana/search/rapid7_insightvm-1ae3add0-b732-11ed-9179-55e576c8acae.json", "/package/rapid7_insightvm/2.8.0/data_stream/asset/fields/base-fields.yml", "/package/rapid7_insightvm/2.8.0/data_stream/asset/fields/beats.yml", "/package/rapid7_insightvm/2.8.0/data_stream/asset/fields/fields.yml", "/package/rapid7_insightvm/2.8.0/data_stream/asset_vulnerability/fields/base-fields.yml", "/package/rapid7_insightvm/2.8.0/data_stream/asset_vulnerability/fields/beats.yml", "/package/rapid7_insightvm/2.8.0/data_stream/asset_vulnerability/fields/ecs.yml", "/package/rapid7_insightvm/2.8.0/data_stream/asset_vulnerability/fields/fields.yml", "/package/rapid7_insightvm/2.8.0/data_stream/asset_vulnerability/fields/package.yml", "/package/rapid7_insightvm/2.8.0/data_stream/asset_vulnerability/fields/resource.yml", "/package/rapid7_insightvm/2.8.0/data_stream/asset_vulnerability/fields/vulnerability.yml", "/package/rapid7_insightvm/2.8.0/data_stream/vulnerability/fields/base-fields.yml", "/package/rapid7_insightvm/2.8.0/data_stream/vulnerability/fields/beats.yml", "/package/rapid7_insightvm/2.8.0/data_stream/vulnerability/fields/fields.yml", "/package/rapid7_insightvm/2.8.0/elasticsearch/transform/latest_cdr_vulnerabilities/transform.yml", "/package/rapid7_insightvm/2.8.0/data_stream/asset/agent/stream/httpjson.yml.hbs", "/package/rapid7_insightvm/2.8.0/data_stream/asset/elasticsearch/ingest_pipeline/default.yml", "/package/rapid7_insightvm/2.8.0/data_stream/asset_vulnerability/agent/stream/cel.yml.hbs", "/package/rapid7_insightvm/2.8.0/data_stream/asset_vulnerability/elasticsearch/ingest_pipeline/default.yml", "/package/rapid7_insightvm/2.8.0/data_stream/vulnerability/agent/stream/httpjson.yml.hbs", "/package/rapid7_insightvm/2.8.0/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml", "/package/rapid7_insightvm/2.8.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/base-fields.yml", "/package/rapid7_insightvm/2.8.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/beats.yml", "/package/rapid7_insightvm/2.8.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/ecs-overridden.yml", "/package/rapid7_insightvm/2.8.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/fields.yml", "/package/rapid7_insightvm/2.8.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/package.yml", "/package/rapid7_insightvm/2.8.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/resource.yml", "/package/rapid7_insightvm/2.8.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/vulnerability.yml" ], "policy_templates": [ { "name": "rapid7_insightvm", "title": "Rapid7 InsightVM logs", "description": "Collect Rapid7 InsightVM logs.", "inputs": [ { "type": "httpjson", "vars": [ { "name": "hostname", "type": "text", "title": "URL", "description": "URL for the Rapid7 InsightVM API (Add https:// before the hostname). Add a region of the Insight Platform to the URL.", "multi": false, "required": true, "show_user": true, "default": "https://.api.insight.rapid7.com" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "api_key", "type": "password", "title": "API Key", "description": "API Key to access Insight platform.", "multi": false, "required": true, "show_user": true }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Rapid7 InsightVM logs via HTTPJSON", "description": "Collecting Rapid7 InsightVM via HTTPJSON." }, { "type": "cel", "vars": [ { "name": "url", "type": "url", "title": "URL", "description": "URL for the Rapid7 InsightVM API (Add https:// before the hostname). Add a region of the Insight Platform to the URL.", "multi": false, "required": true, "show_user": true, "default": "https://.api.insight.rapid7.com" }, { "name": "api_key", "type": "password", "title": "API Key", "description": "API Key to access Insight platform.", "multi": false, "required": true, "show_user": true }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Rapid7 InsightVM logs via CEL", "description": "Collecting Rapid7 InsightVM logs via CEL." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true } } } ], "data_streams": [ { "type": "logs", "dataset": "rapid7_insightvm.asset", "title": "Collect Asset logs from Rapid7 InsightVM (Deprecated)", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Rapid7 InsightVM API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Rapid7 InsightVM API. The recommended batch size is 50, and the maximum supported batch size value is 500.", "multi": false, "required": true, "show_user": false, "default": 50 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "rapid7_insightvm-asset" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve rapid7_insightvm.asset fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Asset logs (Deprecated)", "description": "Collect Asset logs via API.", "enabled": false, "ingestion_method": "API" } ], "package": "rapid7_insightvm", "path": "asset" }, { "type": "logs", "dataset": "rapid7_insightvm.asset_vulnerability", "title": "Asset Vulnerability Event", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the events from Rapid7 InsightVM API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2160h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Rapid7 InsightVM API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Rapid7 InsightVM API. The maximum supported batch size value is 500.", "multi": false, "required": true, "show_user": false, "default": 500 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Supported time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "120s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "rapid7_insightvm-asset_vulnerability" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve rapid7_insightvm.asset_vulnerability fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Asset Vulnerability Event", "description": "Collect enriched asset vulnerability events via API.", "enabled": false, "ingestion_method": "API" } ], "package": "rapid7_insightvm", "path": "asset_vulnerability" }, { "type": "logs", "dataset": "rapid7_insightvm.vulnerability", "title": "Collect Vulnerability logs from Rapid7 InsightVM", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Vulnerability logs from Rapid7 InsightVM. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Rapid7 InsightVM API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Rapid7 InsightVM API. The maximum supported batch size value is 500.", "multi": false, "required": true, "show_user": false, "default": 500 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "rapid7_insightvm-vulnerability" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve rapid7_insightvm.vulnerability fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Vulnerability logs", "description": "Collect Vulnerability logs via API.", "enabled": true, "ingestion_method": "API" } ], "package": "rapid7_insightvm", "path": "vulnerability" } ] }