Rapid7 InsightVM

Reveal module — This feature requires the Reveal add-on module.

Overview

Rapid7 InsightVM is a vulnerability management platform that discovers assets, assesses them for vulnerabilities and prioritizes remediation. This asset connector pulls the vulnerability findings of the assets assessed by InsightVM, so Sekoia.io can enrich device assets with their active vulnerability exposure.

Info

Assets without a valid host name in InsightVM are skipped, along with their vulnerability findings. The IP address is never used as a host name.
By default, the connector collects the vulnerability findings once a day.

Vendor: Rapid7
Product: InsightVM
Supported environment: SaaS (Insight Platform)

Note

This asset connector is currently in beta. Enable the reveal-beta-connectors feature flag to display it.

Configure

How to create an API key

To connect Rapid7 InsightVM to Sekoia.io, you need an Insight Platform API key with access to InsightVM. You can use an Organization key or a User key belonging to a user with an InsightVM role. Follow these steps:

Sign in to the Insight Platform.
Open Administration (gear icon) and select API Key Management.
Select the Organization Key or the User Key tab, then click New Organization Key or New User Key.
Select your organization, give the key a descriptive name, and click Generate.
Copy the key to a safe place and use it in Sekoia.io.

Warning

The API key is displayed only once at creation. Save it securely; if you lose it, you must generate a new one.
Only Platform Administrators can create Organization keys.
The key must give access to InsightVM: both POST /vm/v4/integration/assets and POST /vm/v4/integration/vulnerabilities must be reachable, otherwise validation fails.

Identify your region

The region is the data storage region of your Insight Platform organization. It is the prefix of the API URL https://<region>.api.insight.rapid7.com. Supported values are us, us2, us3, eu, ca, au, ap, aps2 and me1.

Tip

An API key only works in the region of its organization. If the connector test returns a 401 error with a valid key, check the selected region.

Create your asset

To start getting your Rapid7 InsightVM vulnerabilities into Sekoia.io, you need to create an asset connector on the Assets page. To do so, follow these steps:

Click the Asset connectors button to create a new connector.
Click the + New connector button.
Choose Rapid7 InsightVM Vulnerabilities, give it a name, and fill the required fields:
- region: the region of your Insight Platform organization (see Identify your region).
- api_key: the API key generated in the previous section.
Test the connection by clicking the Test connector button.
Click the Create asset connector button.

OCSF Mapping for Rapid7 InsightVM Vulnerabilities

OCSF Class: Vulnerability Finding

Class UID: 2002

OCSF Version: 1.6.0

Information Collected

The Rapid7 InsightVM Vulnerabilities fetches comprehensive information and transforms it into the OCSF (Open Cybersecurity Schema Framework) format for standardized security monitoring and asset management.

API Response Examples

Rapid7 InsightVM Asset Sample

Single asset from POST /assets with a comparisonTime (delta query): one new finding.

{
  "assessed_for_policies": false,
  "assessed_for_vulnerabilities": true,
  "credential_assessments": [{"port": 22, "protocol": "TCP", "status": "NO_CREDS_SUPPLIED"}],
  "critical_vulnerabilities": 1,
  "exploits": 0,
  "host_name": "host-01.example.com",
  "id": "00000000-0000-0000-0000-000000000000-default-asset-1",
  "ip": "192.0.2.10",
  "mac": "00:00:5E:00:53:01",
  "last_assessed_for_vulnerabilities": "2026-10-13T15:04:28.719Z",
  "last_scan_end": "2026-10-13T15:04:28.719Z",
  "last_scan_start": "2026-10-13T14:58:27.429Z",
  "malware_kits": 0,
  "moderate_vulnerabilities": 0,
  "os_architecture": "x86_64",
  "os_description": "Ubuntu Linux 24.04",
  "os_family": "Linux",
  "os_name": "Linux",
  "os_system_name": "Ubuntu Linux",
  "os_type": "",
  "os_vendor": "Ubuntu",
  "os_version": "24.04",
  "risk_score": 1707.0,
  "severe_vulnerabilities": 0,
  "tags": [{"name": "Example-Site", "type": "SITE"}],
  "total_vulnerabilities": 1,
  "type": "guest",
  "unique_identifiers": [{"id": "00000000-0000-0000-0000-000000000001", "source": "dmidecode"}],
  "new": [
    {
      "check_id": null,
      "first_found": "2026-09-22T15:35:48Z",
      "key": "",
      "last_found": "2026-10-13T15:04:28.719Z",
      "nic": null,
      "port": 22,
      "proof": "<p><ul><li>Running SSH service</li><li>Product OpenSSH exists -- OpenBSD OpenSSH 9.6p1</li></ul></p>",
      "protocol": "TCP",
      "reintroduced": null,
      "solution_fix": "<p>Upgrade OpenSSH to the latest version.</p>",
      "solution_id": "openssh-upgrade-latest",
      "solution_summary": "Upgrade to the latest version of OpenSSH",
      "solution_type": "rollup",
      "status": "VULNERABLE_VERS",
      "vulnerability_id": "openssh-cve-2024-6387"
    }
  ],
  "remediated": []
}

Rapid7 InsightVM Vulnerability Sample

Single vulnerability definition from POST /vulnerabilities.

{
  "added": "2024-07-01T00:00:00Z",
  "categories": "Network,OpenSSH,Remote Execution",
  "cves": "CVE-2024-6387",
  "cvss_v2_access_complexity": "medium",
  "cvss_v2_access_vector": "network",
  "cvss_v2_authentication": "none",
  "cvss_v2_availability_impact": "complete",
  "cvss_v2_confidentiality_impact": "complete",
  "cvss_v2_exploit_score": 8.588799953460693,
  "cvss_v2_impact_score": 10.000845454680942,
  "cvss_v2_integrity_impact": "complete",
  "cvss_v2_score": 9.3,
  "cvss_v2_vector": "(AV:N/AC:M/Au:N/C:C/I:C/A:C)",
  "cvss_v3_attack_complexity": "high",
  "cvss_v3_attack_vector": "network",
  "cvss_v3_availability_impact": "high",
  "cvss_v3_confidentiality_impact": "high",
  "cvss_v3_exploit_score": 2.2211673,
  "cvss_v3_impact_score": 5.873118720000001,
  "cvss_v3_integrity_impact": "high",
  "cvss_v3_privileges_required": "none",
  "cvss_v3_scope": "unchanged",
  "cvss_v3_score": 8.1,
  "cvss_v3_user_interaction": "none",
  "cvss_v3_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "denial_of_service": false,
  "description": "<p>A signal handler race condition was found in OpenSSH\\u2019s server (sshd), where a client does not authenticate within LoginGraceTime seconds.</p>",
  "exploits": [],
  "id": "openssh-cve-2024-6387",
  "links": [
    {"href": "http://nvd.nist.gov/vuln/detail/CVE-2024-6387", "id": "CVE-2024-6387", "source": "cve"},
    {"href": null, "id": "EUVD-2024-0001", "source": "euvd"},
    {"href": "https://www.openssh.com/txt/release-9.8", "id": "https://www.openssh.com/txt/release-9.8", "source": "url"},
    {"href": "http://cwe.mitre.org/data/definitions/364.html", "id": "364", "source": "cwe"}
  ],
  "malware_kits": [],
  "modified": "2026-05-05T00:00:00Z",
  "pci_cvss_score": 9.3,
  "pci_fail": true,
  "pci_severity_score": 5,
  "pci_special_notes": "",
  "pci_status": "fail",
  "published": "2024-07-01T00:00:00Z",
  "references": "cve:CVE-2024-6387,cwe:364,euvd:EUVD-2024-0001,url:https://www.openssh.com/txt/release-9.8",
  "risk_score": 845.0,
  "severity": "critical",
  "severity_score": 9,
  "title": "OpenSSH: CVE-2024-6387: Signal handler race condition (regreSSHion)"
}

Data Mapping Table

The following table shows how source data is mapped to OCSF model fields:

Source Field	OCSF Field Path	Description	Data Type	Logic
`finding.status`	`activity_id / activity_name / type_uid / type_name / confidence / confidence_id`	Activity of the finding and confidence of the detection	`integer / string`	Activity from the v4 delta: a vulnerability that becomes open -> 1 Create (2 Update if reintroduced or after a reset), stops being open (fixed or under an exception) or goes from inconclusive to closed -> 3 Close, changes status or affected ports while open -> 2 Update; skipped or failed checks emit nothing; type_uid = 200200 + activity_id; confidence = best of VULNERABLE_EXPL High/3, VULNERABLE_VERS Medium/2, VULNERABLE_POTENTIAL Low/1
`finding.reintroduced`	`activity_id / activity_name / type_uid / type_name`	Vulnerability found again after a remediation	`integer / string`	An open item in new with a reintroduced date -> 2 Update
`static: Findings`	`category_name`	OCSF category name	`string`	Always 'Findings'
`static: 2`	`category_uid`	OCSF category id	`integer`	Always 2
`static: Vulnerability Finding`	`class_name`	OCSF class name	`string`	Always 'Vulnerability Finding'
`static: 2002`	`class_uid`	OCSF class id	`integer`	Always 2002
`vulnerability.severity`	`severity / severity_id / risk_level / risk_level_id / vulnerabilities.severity`	Severity and risk level of the vulnerability	`string / integer`	critical -> Critical/5, severe -> High/4, moderate -> Medium/3, low -> Low/2, informational -> Informational/1, otherwise Unknown/0. Risk level: critical -> Critical/4, severe -> High/3, moderate -> Medium/2, low -> Low/1, informational or none -> Info/0, otherwise absent
`vulnerability.risk_score`	`risk_score`	InsightVM risk score of the vulnerability	`integer`	Rounded to the nearest integer
`finding.proof`	`risk_details`	Evidence of the vulnerability	`string`	Proof of each merged item stripped of its HTML, prefixed with '/: ' when the port is known, deduplicated, joined with '
`finding.port`	`risk_details`	Port where the vulnerability was found	`string`	Port prefix of the proof
`finding.protocol`	`risk_details`	Protocol where the vulnerability was found	`string`	Protocol prefix of the proof, lowercased
`finding.remediation_date`	`time`	OCSF event timestamp of a remediation	`timestamp`	Close events only: latest remediation date of the merged items, as integer Unix epoch seconds
`asset.last_assessed_for_vulnerabilities`	`time / finding_info.last_seen_time`	Last assessment of the asset	`timestamp`	Integer Unix epoch seconds. time: used when there is no remediation date; finding_info.last_seen_time: fallback of finding.last_found
`static: end of the collection window`	`time`	OCSF event timestamp fallback	`timestamp`	currentTime of the window (now minus 1 hour) when the asset has no assessment date
`static: InsightVM`	`metadata.product.name`	Source product name	`string`	Always 'InsightVM'
`static: Rapid7`	`metadata.product.vendor_name`	Vendor name	`string`	Always 'Rapid7'
`static: 1.6.0`	`metadata.version`	OCSF schema version	`string`	Fixed OCSF schema version
`finding.vulnerability_id`	`finding_info.uid`	Finding unique identifier	`string`	':', stable across cycles (accepts a string or {"id": ...})
`vulnerability.title`	`finding_info.title / vulnerabilities.title`	Vulnerability title	`string`	Direct mapping; finding_info.title falls back to the vulnerability id when the definition is not found. Repeated on each vulnerabilities entry, unless the repeated title, description and references exceed 500 000 bytes (JSON): then only on the first entry
`vulnerability.description`	`finding_info.desc / vulnerabilities.desc`	Vulnerability description	`string`	Literal \uXXXX sequences decoded, HTML stripped, truncated to 1024 characters ending with ' [...] see more on the Rapid7 InsightVM product'. On vulnerabilities, same repetition rule as the title
`vulnerability.categories`	`finding_info.types`	Vulnerability categories	`array`	Comma-separated string split into a list; omitted when empty
`finding.first_found`	`finding_info.first_seen_time`	First time the vulnerability was found on the asset	`timestamp`	Earliest first_found of the merged items, as a Unix epoch integer
`finding.last_found`	`finding_info.last_seen_time`	Last time the vulnerability was found on the asset	`timestamp`	Latest last_found of the merged items, as a Unix epoch integer
`vulnerability.id`	`finding_info.src_url`	Link to the vulnerability description	`string`	'https://www.rapid7.com/db/vulnerabilities//' (Rapid7 vulnerability database)
`static: InsightVM / Rapid7`	`finding_info.product.name / finding_info.product.vendor_name`	Product that produced the finding	`object`	Always
`vulnerability.cves`	`vulnerabilities.cve.uid`	CVE identifier	`string`	Comma-separated string split into a list, deduplicated; one vulnerabilities entry per CVE (at most 1000, a warning is logged above), a single entry without cve when there is none
`static: CVE`	`vulnerabilities.cve.type`	Type of the identifier	`string`	Always 'CVE'
`vulnerability.cvss_v2_score`	`vulnerabilities.cve.cvss.base_score`	CVSS v2 base score	`float`	CVSS entry with version '2.0' when the score is present
`vulnerability.cvss_v3_score`	`vulnerabilities.cve.cvss.base_score`	CVSS v3 base score	`float`	CVSS entry when the score is present; a score of 0.0 without vector means no CVSS v3 and is skipped
`vulnerability.cvss_v3_vector`	`vulnerabilities.cve.cvss.version`	CVSS v3 version	`string`	Version read from the 'CVSS:3.x/' prefix of the vector, '3.0' by default
`vulnerability.links.href`	`vulnerabilities.references`	Vulnerability references	`array`	Non-null href of the links, deduplicated; at most 20 references of at most 512 characters. Same repetition rule as the title
`static: Rapid7`	`vulnerabilities.vendor_name`	Vendor of the vulnerability definition	`string`	Always 'Rapid7'
`asset.id`	`device.uid / finding_info.uid`	InsightVM asset identifier	`string`	Direct mapping; prefix of finding_info.uid
`asset.host_name`	`device.hostname / device.domain`	Asset host name. Limitation: when an asset skipped for lack of a usable host name gets one later, its later changes are sent, but its unchanged findings only at the next checkpoint reset (the delta API only returns changes)	`string`	Lowercased; a fully qualified name (with a public suffix) is split on its first label: hostname = the short name, domain = the rest. A name that is not a valid host name (an IP address, digits only, spaces...) or absent: the asset and its findings are skipped and counted, with a warning. The IP address or the asset id is never used as hostname
`asset.ip`	`device.ip`	Asset IP address	`string`	Direct mapping
`asset.type`	`device.type / device.type_id`	Device type	`string / integer`	guest -> Virtual/6, hypervisor -> Server/1, mobile -> Mobile/5; physical, unknown or absent -> Unknown/0

OCSF Model Structure

Vulnerability Finding: Create

The new finding of the asset sample mapped with the vulnerability sample

{
  "activity_id": 1,
  "activity_name": "Create",
  "category_name": "Findings",
  "category_uid": 2,
  "class_name": "Vulnerability Finding",
  "class_uid": 2002,
  "type_name": "Vulnerability Finding: Create",
  "type_uid": 200201,
  "severity": "Critical",
  "severity_id": 5,
  "time": 1791903868,
  "metadata": {
    "product": {
      "name": "InsightVM",
      "vendor_name": "Rapid7"
    },
    "version": "1.6.0"
  },
  "device": {
    "type_id": 6,
    "type": "Virtual",
    "uid": "00000000-0000-0000-0000-000000000000-default-asset-1",
    "hostname": "host-01",
    "domain": "example.com",
    "ip": "192.0.2.10"
  },
  "finding_info": {
    "uid": "00000000-0000-0000-0000-000000000000-default-asset-1:openssh-cve-2024-6387",
    "title": "OpenSSH: CVE-2024-6387: Signal handler race condition (regreSSHion)",
    "src_url": "https://www.rapid7.com/db/vulnerabilities/openssh-cve-2024-6387/",
    "desc": "A signal handler race condition was found in OpenSSH’s server (sshd), where a client does not authenticate within LoginGraceTime seconds.",
    "last_seen_time": 1791903868,
    "first_seen_time": 1790091348,
    "types": [
      "Network",
      "OpenSSH",
      "Remote Execution"
    ],
    "product": {
      "name": "InsightVM",
      "vendor_name": "Rapid7"
    }
  },
  "vulnerabilities": [
    {
      "title": "OpenSSH: CVE-2024-6387: Signal handler race condition (regreSSHion)",
      "desc": "A signal handler race condition was found in OpenSSH’s server (sshd), where a client does not authenticate within LoginGraceTime seconds.",
      "references": [
        "http://nvd.nist.gov/vuln/detail/CVE-2024-6387",
        "https://www.openssh.com/txt/release-9.8",
        "http://cwe.mitre.org/data/definitions/364.html"
      ],
      "cve": {
        "uid": "CVE-2024-6387",
        "type": "CVE",
        "cvss": [
          {
            "version": "2.0",
            "base_score": 9.3
          },
          {
            "version": "3.1",
            "base_score": 8.1
          }
        ]
      },
      "severity": "Critical",
      "vendor_name": "Rapid7"
    }
  ],
  "confidence": "Medium",
  "confidence_id": 2,
  "risk_score": 845,
  "risk_level": "Critical",
  "risk_level_id": 4,
  "risk_details": "tcp/22: Running SSH service Product OpenSSH exists -- OpenBSD OpenSSH 9.6p1"
}

Troubleshooting

Error returned by the connector test	Cause	Solution
`401` – Invalid API key, or API key from another region	The key is invalid, revoked, or belongs to another region	Check the API key and the selected region
`403` / `404` – The API key is valid but has no access to InsightVM	The key has no InsightVM access	Use an Organization key, or a User key with an InsightVM role
Unable to reach the Insight Platform	Wrong region or network issue	Check the selected region

Rapid7 – Managing Platform API keys: Learn how to generate, view and revoke Organization and User API keys, and which permissions each key type grants, thanks to Rapid7 dedicated article.
Rapid7 – Insight Platform API regions: Find the API endpoint matching the data storage region of your Insight Platform organization, thanks to Rapid7 dedicated article.
Rapid7 InsightVM Integration API v4: Browse the reference of the InsightVM Integration API used by the connector, including the assets and vulnerabilities endpoints, thanks to Rapid7 dedicated documentation.