mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-30 16:06:52 +03:00
Initial commit - 611 cybersecurity skills across all subdomains
This commit is contained in:
mukul975
@@ -0,0 +1,339 @@
|
||||
---
|
||||
name: implementing-rapid7-insightvm-for-scanning
|
||||
description: Deploy and configure Rapid7 InsightVM Security Console and Scan Engines for authenticated and unauthenticated vulnerability scanning across enterprise environments.
|
||||
domain: cybersecurity
|
||||
subdomain: vulnerability-management
|
||||
tags: [rapid7, insightvm, vulnerability-scanning, nexpose, scan-engine, asset-discovery, authenticated-scanning]
|
||||
version: "1.0"
|
||||
author: mahipal
|
||||
license: MIT
|
||||
---
|
||||
# Implementing Rapid7 InsightVM for Scanning
|
||||
|
||||
## Overview
|
||||
Rapid7 InsightVM (formerly Nexpose) is an enterprise vulnerability management platform that combines on-premises scanning via Security Console and Scan Engines with cloud-based analytics through the Insight Platform. InsightVM leverages Rapid7's vulnerability research library, Metasploit exploit knowledge, global attacker behavior data, internet-wide scanning telemetry, and real-time reporting to provide comprehensive vulnerability visibility. This skill covers deploying the Security Console, configuring Scan Engines, setting up scan templates, credentialed scanning, and integrating with the Insight Agent for continuous assessment.
|
||||
|
||||
## Prerequisites
|
||||
- Server meeting minimum requirements: 16 GB RAM, 4 CPU cores, 500 GB disk (Security Console)
|
||||
- Scan Engine: 8 GB RAM, 4 CPU cores, 100 GB disk
|
||||
- Network access to target subnets (ports vary by scan type)
|
||||
- Administrative credentials for authenticated scanning (SSH, WMI, SNMP)
|
||||
- Rapid7 InsightVM license and Insight Platform account
|
||||
- PostgreSQL database (bundled with Security Console)
|
||||
|
||||
## Core Concepts
|
||||
|
||||
### InsightVM Architecture Components
|
||||
|
||||
#### Security Console
|
||||
The central management server that:
|
||||
- Hosts the web-based management interface (default port 3780)
|
||||
- Stores scan results in an embedded PostgreSQL database
|
||||
- Manages Scan Engine deployments and scan schedules
|
||||
- Generates reports and dashboards
|
||||
- Connects to Rapid7 Insight Platform for cloud analytics
|
||||
|
||||
Note: Security Console is NOT supported in containerized environments.
|
||||
|
||||
#### Scan Engines
|
||||
Distributed scanning components that:
|
||||
- Perform active network scanning against target assets
|
||||
- Can be deployed across network segments for segmented environments
|
||||
- Available as container images on Docker Hub for flexible deployment
|
||||
- Report results back to the Security Console
|
||||
|
||||
#### Insight Agent
|
||||
Lightweight endpoint agent providing:
|
||||
- Continuous vulnerability assessment without network scans
|
||||
- Assessment of remote/roaming endpoints
|
||||
- Complement to engine-based scanning for comprehensive coverage
|
||||
- Real-time asset inventory updates
|
||||
|
||||
### Scan Template Types
|
||||
|
||||
| Template | Use Case | Depth |
|
||||
|----------|----------|-------|
|
||||
| Discovery Scan | Asset inventory, host enumeration | Low |
|
||||
| Full Audit without Web Spider | Standard vulnerability assessment | Medium |
|
||||
| Full Audit Enhanced Logging | Deep assessment with verbose logging | High |
|
||||
| HIPAA Compliance | Healthcare regulatory compliance | High |
|
||||
| PCI ASV Audit | PCI DSS external scanning requirement | High |
|
||||
| CIS Policy Compliance | Configuration benchmarking | Medium |
|
||||
| Web Spider | Web application discovery and assessment | Medium |
|
||||
|
||||
## Implementation Steps
|
||||
|
||||
### Step 1: Install Security Console
|
||||
|
||||
```bash
|
||||
# Download InsightVM installer (Linux)
|
||||
chmod +x Rapid7Setup-Linux64.bin
|
||||
./Rapid7Setup-Linux64.bin -c
|
||||
|
||||
# Verify service is running
|
||||
systemctl status nexposeconsole.service
|
||||
|
||||
# Access web interface
|
||||
# https://<console-ip>:3780
|
||||
```
|
||||
|
||||
Initial configuration:
|
||||
1. Navigate to https://localhost:3780
|
||||
2. Complete the setup wizard with license key
|
||||
3. Configure database settings (embedded PostgreSQL recommended)
|
||||
4. Set administrator credentials
|
||||
5. Activate Insight Platform connection for cloud analytics
|
||||
|
||||
### Step 2: Deploy Distributed Scan Engines
|
||||
|
||||
```bash
|
||||
# Install Scan Engine on remote server
|
||||
./Rapid7Setup-Linux64.bin -c
|
||||
|
||||
# During installation, select "Scan Engine only"
|
||||
# Pair with Security Console using shared secret
|
||||
|
||||
# Docker-based Scan Engine deployment
|
||||
docker pull rapid7/insightvm-scan-engine
|
||||
docker run -d \
|
||||
--name scan-engine \
|
||||
-p 40814:40814 \
|
||||
-e CONSOLE_HOST=<console-ip> \
|
||||
-e CONSOLE_PORT=3780 \
|
||||
-e ENGINE_NAME=DMZ-Scanner \
|
||||
-e SHARED_SECRET=<pairing-secret> \
|
||||
rapid7/insightvm-scan-engine
|
||||
```
|
||||
|
||||
Pair engines in Security Console:
|
||||
1. Administration > Scan Engines > New Scan Engine
|
||||
2. Enter engine hostname/IP and port (default 40814)
|
||||
3. Use shared secret for authentication
|
||||
4. Verify connectivity status shows "Active"
|
||||
|
||||
### Step 3: Configure Asset Discovery Sites
|
||||
|
||||
```
|
||||
Site Configuration:
|
||||
Name: Production-Network
|
||||
Scan Engine: Primary-Engine-01
|
||||
Scan Template: Full Audit without Web Spider
|
||||
|
||||
Included Assets:
|
||||
- 10.0.0.0/8 (Internal network)
|
||||
- 172.16.0.0/12 (DMZ network)
|
||||
|
||||
Excluded Assets:
|
||||
- 10.0.0.1 (Core router - fragile)
|
||||
- 10.0.100.0/24 (ICS/SCADA segment)
|
||||
|
||||
Schedule:
|
||||
Frequency: Weekly
|
||||
Day: Sunday
|
||||
Time: 02:00 AM
|
||||
Max Duration: 8 hours
|
||||
```
|
||||
|
||||
### Step 4: Configure Authenticated Scanning
|
||||
|
||||
#### Windows Credentials (WMI)
|
||||
```
|
||||
Credential Type: Microsoft Windows/Samba (SMB/CIFS)
|
||||
Domain: CORP.EXAMPLE.COM
|
||||
Username: svc_insightvm_scan
|
||||
Password: <service-account-password>
|
||||
Authentication: NTLM
|
||||
|
||||
Privilege Elevation:
|
||||
Type: None (use domain admin or local admin)
|
||||
```
|
||||
|
||||
#### Linux/Unix Credentials (SSH)
|
||||
```
|
||||
Credential Type: Secure Shell (SSH)
|
||||
Username: insightvm_scan
|
||||
Authentication: SSH Key (preferred) or Password
|
||||
SSH Private Key: /opt/rapid7/.ssh/scan_key
|
||||
Port: 22
|
||||
|
||||
Privilege Elevation:
|
||||
Type: sudo
|
||||
sudo User: root
|
||||
sudo Password: <sudo-password>
|
||||
```
|
||||
|
||||
#### Database Credentials
|
||||
```
|
||||
Credential Type: Microsoft SQL Server
|
||||
Instance: MSSQLSERVER
|
||||
Domain: CORP
|
||||
Username: insightvm_db_scan
|
||||
Authentication: Windows Authentication
|
||||
|
||||
Credential Type: Oracle
|
||||
Port: 1521
|
||||
SID: ORCL
|
||||
Username: insightvm_scan
|
||||
```
|
||||
|
||||
### Step 5: Configure Scan Templates
|
||||
|
||||
Custom scan template for balanced scanning:
|
||||
```
|
||||
Template Name: Enterprise-Standard-Scan
|
||||
|
||||
Service Discovery:
|
||||
TCP Ports: Well-known (1-1024) + common services
|
||||
UDP Ports: DNS(53), SNMP(161), NTP(123), TFTP(69)
|
||||
Method: SYN scan (stealth)
|
||||
|
||||
Vulnerability Checks:
|
||||
Safe checks only: Enabled
|
||||
Skip potential: Disabled
|
||||
Web spidering: Disabled (separate template)
|
||||
Policy checks: Enabled (CIS benchmarks)
|
||||
|
||||
Performance:
|
||||
Max parallel assets: 10
|
||||
Max requests per second: 100
|
||||
Timeout per asset: 30 minutes
|
||||
Retries: 2
|
||||
```
|
||||
|
||||
### Step 6: Set Up Insight Agent Deployment
|
||||
|
||||
```powershell
|
||||
# Windows Agent Installation (via GPO or SCCM)
|
||||
msiexec /i agentInstaller-x86_64.msi /quiet /norestart `
|
||||
CUSTOMTOKEN=<platform-token> `
|
||||
CUSTOMCONFIG=<agent-config>
|
||||
|
||||
# Linux Agent Installation
|
||||
chmod +x agent_installer.sh
|
||||
./agent_installer.sh install_start \
|
||||
--token <platform-token>
|
||||
|
||||
# Verify agent connectivity
|
||||
# Check InsightVM console: Assets > Agent Management
|
||||
```
|
||||
|
||||
### Step 7: Configure Remediation Workflows
|
||||
|
||||
```
|
||||
Remediation Project:
|
||||
Name: Q1-2025-Critical-Remediation
|
||||
|
||||
Scope:
|
||||
Severity: Critical + High
|
||||
CVSS Score: >= 7.0
|
||||
Assets: Production-Network site
|
||||
|
||||
Assignment:
|
||||
Team: Infrastructure-Ops
|
||||
Due Date: 2025-03-31
|
||||
|
||||
Tracking:
|
||||
Auto-verify: Enabled (re-scan on next scheduled scan)
|
||||
Notification: Email on overdue items
|
||||
Escalation: Manager notification at 75% SLA
|
||||
```
|
||||
|
||||
### Step 8: API Integration for Automation
|
||||
|
||||
```python
|
||||
import requests
|
||||
import json
|
||||
|
||||
class InsightVMClient:
|
||||
"""Rapid7 InsightVM API v3 client for automation."""
|
||||
|
||||
def __init__(self, console_url, api_key):
|
||||
self.base_url = f"{console_url}/api/3"
|
||||
self.session = requests.Session()
|
||||
self.session.headers.update({
|
||||
"Content-Type": "application/json",
|
||||
"Authorization": f"Bearer {api_key}"
|
||||
})
|
||||
self.session.verify = False # Self-signed cert on console
|
||||
|
||||
def get_sites(self):
|
||||
"""List all configured scan sites."""
|
||||
response = self.session.get(f"{self.base_url}/sites")
|
||||
response.raise_for_status()
|
||||
return response.json().get("resources", [])
|
||||
|
||||
def start_scan(self, site_id, engine_id=None, template_id=None):
|
||||
"""Trigger an ad-hoc scan for a site."""
|
||||
payload = {}
|
||||
if engine_id:
|
||||
payload["engineId"] = engine_id
|
||||
if template_id:
|
||||
payload["templateId"] = template_id
|
||||
|
||||
response = self.session.post(
|
||||
f"{self.base_url}/sites/{site_id}/scans",
|
||||
json=payload
|
||||
)
|
||||
response.raise_for_status()
|
||||
return response.json()
|
||||
|
||||
def get_asset_vulnerabilities(self, asset_id):
|
||||
"""Retrieve vulnerabilities for a specific asset."""
|
||||
response = self.session.get(
|
||||
f"{self.base_url}/assets/{asset_id}/vulnerabilities"
|
||||
)
|
||||
response.raise_for_status()
|
||||
return response.json().get("resources", [])
|
||||
|
||||
def get_scan_status(self, scan_id):
|
||||
"""Check the status of a running scan."""
|
||||
response = self.session.get(f"{self.base_url}/scans/{scan_id}")
|
||||
response.raise_for_status()
|
||||
return response.json()
|
||||
|
||||
def create_remediation_project(self, name, description, assets, vulns):
|
||||
"""Create a remediation tracking project."""
|
||||
payload = {
|
||||
"name": name,
|
||||
"description": description,
|
||||
"assets": {"includedTargets": {"addresses": assets}},
|
||||
"vulnerabilities": {"includedVulnerabilities": vulns}
|
||||
}
|
||||
response = self.session.post(
|
||||
f"{self.base_url}/remediations",
|
||||
json=payload
|
||||
)
|
||||
response.raise_for_status()
|
||||
return response.json()
|
||||
|
||||
|
||||
# Usage
|
||||
client = InsightVMClient("https://insightvm-console:3780", "api-key-here")
|
||||
sites = client.get_sites()
|
||||
for site in sites:
|
||||
print(f"Site: {site['name']} - Assets: {site.get('assets', 0)}")
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
1. Deploy Scan Engines close to target networks to minimize scan traffic traversing firewalls
|
||||
2. Use Insight Agents for roaming laptops and remote workers that are not always reachable by network scans
|
||||
3. Combine agent-based and engine-based scanning for the most accurate vulnerability view
|
||||
4. Configure scan blackout windows during business-critical hours to avoid operational impact
|
||||
5. Use credential testing before full scans to validate authentication works
|
||||
6. Enable safe checks to prevent accidental denial of service on production systems
|
||||
7. Separate scan sites by network segment, business unit, or compliance scope
|
||||
8. Leverage tag-based asset groups for dynamic reporting and remediation tracking
|
||||
|
||||
## Common Pitfalls
|
||||
- Running full scans during business hours causing network congestion or service degradation
|
||||
- Using unauthenticated scans only, missing 60-80% of local vulnerabilities
|
||||
- Not excluding fragile devices (printers, ICS/SCADA, medical devices) from aggressive scan templates
|
||||
- Failing to distribute Scan Engines across network segments, causing firewall bottlenecks
|
||||
- Ignoring scan engine resource utilization leading to incomplete scans
|
||||
- Not configuring scan duration limits, allowing runaway scans to consume resources indefinitely
|
||||
|
||||
## Related Skills
|
||||
- performing-agentless-vulnerability-scanning
|
||||
- building-vulnerability-data-pipeline-with-api
|
||||
- implementing-wazuh-for-vulnerability-detection
|
||||
- performing-remediation-validation-scanning
|
||||
@@ -0,0 +1,45 @@
|
||||
# InsightVM Deployment and Scan Report Template
|
||||
|
||||
## Deployment Summary
|
||||
| Field | Value |
|
||||
|-------|-------|
|
||||
| Console Version | [Version] |
|
||||
| Console Hostname | [hostname:3780] |
|
||||
| Total Scan Engines | [N] |
|
||||
| Total Insight Agents | [N] |
|
||||
| Total Sites Configured | [N] |
|
||||
| Deployment Date | [YYYY-MM-DD] |
|
||||
|
||||
## Scan Engine Inventory
|
||||
| Engine Name | Location | IP Address | Status | Assets Covered |
|
||||
|-------------|----------|------------|--------|----------------|
|
||||
| [Engine-1] | [DC-1] | [IP] | Active | [N] |
|
||||
| [Engine-2] | [DMZ] | [IP] | Active | [N] |
|
||||
|
||||
## Site Configuration Summary
|
||||
| Site Name | Engine | Template | Schedule | Assets | Auth Scan |
|
||||
|-----------|--------|----------|----------|--------|-----------|
|
||||
| [Site-1] | [Engine] | [Template] | [Weekly] | [N] | [Yes/No] |
|
||||
|
||||
## Scan Results Summary
|
||||
| Metric | Value |
|
||||
|--------|-------|
|
||||
| Total Assets Scanned | [N] |
|
||||
| Total Vulnerabilities | [N] |
|
||||
| Critical | [N] |
|
||||
| High | [N] |
|
||||
| Medium | [N] |
|
||||
| Low | [N] |
|
||||
| Informational | [N] |
|
||||
|
||||
## Top 10 Critical Vulnerabilities
|
||||
| Rank | CVE | Title | CVSS | Affected Assets | Exploitable |
|
||||
|------|-----|-------|------|-----------------|-------------|
|
||||
| 1 | [CVE-ID] | [Title] | [N.N] | [N] | [Yes/No] |
|
||||
|
||||
## Remediation Progress
|
||||
| Priority | Total | Remediated | In Progress | Overdue |
|
||||
|----------|-------|------------|-------------|---------|
|
||||
| Critical | [N] | [N] | [N] | [N] |
|
||||
| High | [N] | [N] | [N] | [N] |
|
||||
| Medium | [N] | [N] | [N] | [N] |
|
||||
@@ -0,0 +1,29 @@
|
||||
# Standards and References - Rapid7 InsightVM
|
||||
|
||||
## Official Documentation
|
||||
- InsightVM Product Page: https://www.rapid7.com/products/insightvm/
|
||||
- InsightVM Quick Start Guide: https://docs.rapid7.com/insightvm/insightvm-quick-start-guide/
|
||||
- InsightVM System Requirements: https://docs.rapid7.com/insightvm/system-requirements/
|
||||
- InsightVM API v3 Documentation: https://help.rapid7.com/insightvm/en-us/api/index.html
|
||||
- Insight Agent Documentation: https://docs.rapid7.com/insightvm/using-the-insight-agent-with-insightvm/
|
||||
|
||||
## Scan Configuration References
|
||||
- Scan Templates: https://docs.rapid7.com/insightvm/selecting-vulnerability-checks/
|
||||
- Credential Configuration: https://docs.rapid7.com/insightvm/configuring-scan-credentials/
|
||||
- Scan Scheduling: https://docs.rapid7.com/insightvm/configuring-scan-schedules/
|
||||
|
||||
## Industry Standards
|
||||
- **NIST SP 800-115**: Technical Guide to Information Security Testing and Assessment
|
||||
- **NIST SP 800-40 Rev 4**: Guide to Enterprise Patch Management Planning
|
||||
- **PCI DSS v4.0 Req 11.3**: External and internal vulnerability scanning
|
||||
- **CIS Controls v8.1 Control 7**: Continuous Vulnerability Management
|
||||
- **ISO 27001:2022 A.8.8**: Management of technical vulnerabilities
|
||||
|
||||
## Compliance Scan Templates
|
||||
| Standard | InsightVM Template | Frequency |
|
||||
|----------|-------------------|-----------|
|
||||
| PCI DSS | PCI ASV External Audit | Quarterly |
|
||||
| HIPAA | HIPAA Compliance | Quarterly |
|
||||
| CIS Benchmarks | CIS Policy Compliance | Monthly |
|
||||
| DISA STIG | DISA STIG Compliance | Monthly |
|
||||
| NIST 800-53 | Full Audit Enhanced | Quarterly |
|
||||
@@ -0,0 +1,80 @@
|
||||
# Workflows - Rapid7 InsightVM Deployment
|
||||
|
||||
## Workflow 1: InsightVM Deployment Pipeline
|
||||
|
||||
```
|
||||
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
|
||||
│ Install Security │────>│ Deploy Scan │────>│ Pair Engines │
|
||||
│ Console │ │ Engines │ │ with Console │
|
||||
└──────────────────┘ └──────────────────┘ └──────────────────┘
|
||||
│
|
||||
┌────────────────────────────────────────────────┘
|
||||
v
|
||||
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
|
||||
│ Configure Scan │────>│ Set Up Credential│────>│ Create Sites & │
|
||||
│ Templates │ │ Store │ │ Asset Groups │
|
||||
└──────────────────┘ └──────────────────┘ └──────────────────┘
|
||||
│
|
||||
v
|
||||
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
|
||||
│ Schedule Scans │────>│ Deploy Insight │────>│ Configure │
|
||||
│ │ │ Agents │ │ Reports & Alerts │
|
||||
└──────────────────┘ └──────────────────┘ └──────────────────┘
|
||||
```
|
||||
|
||||
## Workflow 2: Scan Execution Cycle
|
||||
|
||||
```
|
||||
For each scheduled scan:
|
||||
1. Console dispatches scan job to assigned Scan Engine
|
||||
2. Engine performs host discovery (ARP, ICMP, TCP SYN)
|
||||
3. Engine fingerprints OS and services on discovered hosts
|
||||
4. Engine selects vulnerability checks based on fingerprint
|
||||
5. If credentials configured: authenticate and perform local checks
|
||||
6. Engine reports findings back to Console database
|
||||
7. Console correlates with previous scan data (new/fixed/unchanged)
|
||||
8. Console updates risk scores and remediation projects
|
||||
9. Notifications sent for new critical/high findings
|
||||
10. Dashboard and reports refreshed automatically
|
||||
```
|
||||
|
||||
## Workflow 3: Hybrid Scanning Strategy
|
||||
|
||||
```
|
||||
┌─────────────────────────────────────────────────────┐
|
||||
│ Enterprise Network │
|
||||
├─────────────────────────────────────────────────────┤
|
||||
│ │
|
||||
│ ┌──────────────┐ Engine Scan ┌────────────────┐ │
|
||||
│ │ Data Center │ <───────────── │ DC Scan Engine │ │
|
||||
│ │ Servers │ └────────────────┘ │
|
||||
│ └──────────────┘ │
|
||||
│ │
|
||||
│ ┌──────────────┐ Engine Scan ┌────────────────┐ │
|
||||
│ │ DMZ Servers │ <───────────── │ DMZ Scan Engine│ │
|
||||
│ └──────────────┘ └────────────────┘ │
|
||||
│ │
|
||||
│ ┌──────────────┐ Agent-Based ┌────────────────┐ │
|
||||
│ │ Laptops / │ <───────────── │ Insight Agent │ │
|
||||
│ │ Remote Users │ │ (on endpoint) │ │
|
||||
│ └──────────────┘ └────────────────┘ │
|
||||
│ │
|
||||
│ ┌──────────────┐ Agent-Based ┌────────────────┐ │
|
||||
│ │ Cloud VMs │ <───────────── │ Insight Agent │ │
|
||||
│ │ (AWS/Azure) │ │ (on instance) │ │
|
||||
│ └──────────────┘ └────────────────┘ │
|
||||
│ │
|
||||
│ All results ──> Security Console │
|
||||
│ ──> Insight Platform (Cloud) │
|
||||
└─────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
## Workflow 4: Remediation Tracking
|
||||
|
||||
| Phase | Action | Owner | Timeline |
|
||||
|-------|--------|-------|----------|
|
||||
| Discovery | Scan identifies vulnerability | InsightVM | Automated |
|
||||
| Triage | Severity confirmed, assigned to team | Security Ops | 24 hours |
|
||||
| Remediation | Patch/config change applied | IT Operations | Per SLA |
|
||||
| Validation | Re-scan confirms fix | InsightVM | Next scan cycle |
|
||||
| Closure | Remediation project updated | Security Ops | Automated |
|
||||
@@ -0,0 +1,326 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Rapid7 InsightVM Scan Automation and Reporting Tool
|
||||
|
||||
Automates scan operations, asset queries, and vulnerability reporting
|
||||
via the InsightVM API v3.
|
||||
|
||||
Requirements:
|
||||
pip install requests pandas tabulate
|
||||
|
||||
Usage:
|
||||
python process.py sites # List all sites
|
||||
python process.py scan --site-id 1 # Start scan for site
|
||||
python process.py status --scan-id 12345 # Check scan status
|
||||
python process.py vulns --asset-id 42 # Get asset vulnerabilities
|
||||
python process.py report --site-id 1 --output report.csv # Export report
|
||||
"""
|
||||
|
||||
import argparse
|
||||
import json
|
||||
import sys
|
||||
import time
|
||||
import urllib3
|
||||
from datetime import datetime
|
||||
|
||||
import pandas as pd
|
||||
import requests
|
||||
|
||||
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
|
||||
|
||||
|
||||
class InsightVMAPI:
|
||||
"""Rapid7 InsightVM API v3 client."""
|
||||
|
||||
def __init__(self, console_url, username=None, password=None, api_key=None):
|
||||
self.base_url = f"{console_url.rstrip('/')}/api/3"
|
||||
self.session = requests.Session()
|
||||
self.session.verify = False
|
||||
|
||||
if api_key:
|
||||
self.session.headers.update({
|
||||
"Authorization": f"Bearer {api_key}",
|
||||
"Content-Type": "application/json"
|
||||
})
|
||||
elif username and password:
|
||||
self.session.auth = (username, password)
|
||||
self.session.headers.update({"Content-Type": "application/json"})
|
||||
else:
|
||||
raise ValueError("Provide either api_key or username/password")
|
||||
|
||||
def _get_paginated(self, endpoint, params=None):
|
||||
"""Fetch all pages from a paginated endpoint."""
|
||||
all_resources = []
|
||||
page = 0
|
||||
while True:
|
||||
p = params.copy() if params else {}
|
||||
p["page"] = page
|
||||
p["size"] = 100
|
||||
response = self.session.get(
|
||||
f"{self.base_url}/{endpoint}", params=p, timeout=60
|
||||
)
|
||||
response.raise_for_status()
|
||||
data = response.json()
|
||||
resources = data.get("resources", [])
|
||||
all_resources.extend(resources)
|
||||
total_pages = data.get("page", {}).get("totalPages", 1)
|
||||
page += 1
|
||||
if page >= total_pages:
|
||||
break
|
||||
return all_resources
|
||||
|
||||
def list_sites(self):
|
||||
"""List all scan sites."""
|
||||
return self._get_paginated("sites")
|
||||
|
||||
def get_site(self, site_id):
|
||||
"""Get details for a specific site."""
|
||||
response = self.session.get(
|
||||
f"{self.base_url}/sites/{site_id}", timeout=30
|
||||
)
|
||||
response.raise_for_status()
|
||||
return response.json()
|
||||
|
||||
def start_scan(self, site_id, engine_id=None, template_id=None, hosts=None):
|
||||
"""Start a scan for a site."""
|
||||
payload = {}
|
||||
if engine_id:
|
||||
payload["engineId"] = engine_id
|
||||
if template_id:
|
||||
payload["templateId"] = template_id
|
||||
if hosts:
|
||||
payload["hosts"] = hosts
|
||||
|
||||
response = self.session.post(
|
||||
f"{self.base_url}/sites/{site_id}/scans",
|
||||
json=payload, timeout=30
|
||||
)
|
||||
response.raise_for_status()
|
||||
return response.json()
|
||||
|
||||
def get_scan_status(self, scan_id):
|
||||
"""Get the status of a scan."""
|
||||
response = self.session.get(
|
||||
f"{self.base_url}/scans/{scan_id}", timeout=30
|
||||
)
|
||||
response.raise_for_status()
|
||||
return response.json()
|
||||
|
||||
def wait_for_scan(self, scan_id, poll_interval=30, timeout=3600):
|
||||
"""Wait for a scan to complete."""
|
||||
start_time = time.time()
|
||||
while time.time() - start_time < timeout:
|
||||
status = self.get_scan_status(scan_id)
|
||||
state = status.get("status", "unknown")
|
||||
print(f" Scan {scan_id}: {state} "
|
||||
f"({status.get('assets', 0)} assets, "
|
||||
f"{status.get('vulnerabilities', {}).get('total', 0)} vulns)")
|
||||
if state in ("finished", "stopped", "error", "aborted"):
|
||||
return status
|
||||
time.sleep(poll_interval)
|
||||
print(f" [!] Scan timeout after {timeout}s")
|
||||
return None
|
||||
|
||||
def get_site_assets(self, site_id):
|
||||
"""Get all assets for a site."""
|
||||
return self._get_paginated(f"sites/{site_id}/assets")
|
||||
|
||||
def get_asset_vulnerabilities(self, asset_id):
|
||||
"""Get vulnerabilities for a specific asset."""
|
||||
return self._get_paginated(f"assets/{asset_id}/vulnerabilities")
|
||||
|
||||
def get_vulnerability_details(self, vuln_id):
|
||||
"""Get details for a specific vulnerability."""
|
||||
response = self.session.get(
|
||||
f"{self.base_url}/vulnerabilities/{vuln_id}", timeout=30
|
||||
)
|
||||
response.raise_for_status()
|
||||
return response.json()
|
||||
|
||||
def list_scan_engines(self):
|
||||
"""List all scan engines."""
|
||||
return self._get_paginated("scan_engines")
|
||||
|
||||
def list_scan_templates(self):
|
||||
"""List available scan templates."""
|
||||
return self._get_paginated("scan_templates")
|
||||
|
||||
|
||||
def cmd_list_sites(api):
|
||||
"""List all configured sites."""
|
||||
sites = api.list_sites()
|
||||
if not sites:
|
||||
print("No sites configured.")
|
||||
return
|
||||
|
||||
print(f"\n{'ID':<6} {'Name':<35} {'Assets':<10} {'Last Scan':<20}")
|
||||
print("-" * 75)
|
||||
for site in sites:
|
||||
last_scan = site.get("lastScanTime", "Never")
|
||||
if last_scan != "Never":
|
||||
last_scan = last_scan[:19]
|
||||
print(f"{site['id']:<6} {site['name'][:34]:<35} "
|
||||
f"{site.get('assets', 0):<10} {last_scan:<20}")
|
||||
|
||||
|
||||
def cmd_start_scan(api, site_id, engine_id=None, template_id=None, wait=False):
|
||||
"""Start a scan for a site."""
|
||||
print(f"[*] Starting scan for site {site_id}...")
|
||||
result = api.start_scan(site_id, engine_id, template_id)
|
||||
scan_id = result.get("id")
|
||||
print(f"[+] Scan started: ID={scan_id}")
|
||||
|
||||
if wait and scan_id:
|
||||
print("[*] Waiting for scan to complete...")
|
||||
final_status = api.wait_for_scan(scan_id)
|
||||
if final_status:
|
||||
print(f"\n[+] Scan completed: {final_status.get('status')}")
|
||||
vulns = final_status.get("vulnerabilities", {})
|
||||
print(f" Total vulnerabilities: {vulns.get('total', 0)}")
|
||||
print(f" Critical: {vulns.get('critical', 0)}")
|
||||
print(f" Severe: {vulns.get('severe', 0)}")
|
||||
print(f" Moderate: {vulns.get('moderate', 0)}")
|
||||
|
||||
|
||||
def cmd_scan_status(api, scan_id):
|
||||
"""Check scan status."""
|
||||
status = api.get_scan_status(scan_id)
|
||||
print(f"\nScan ID: {status.get('id')}")
|
||||
print(f"Status: {status.get('status')}")
|
||||
print(f"Start Time: {status.get('startTime', 'N/A')}")
|
||||
print(f"End Time: {status.get('endTime', 'N/A')}")
|
||||
print(f"Assets: {status.get('assets', 0)}")
|
||||
vulns = status.get("vulnerabilities", {})
|
||||
print(f"Vulns Total: {vulns.get('total', 0)}")
|
||||
print(f" Critical: {vulns.get('critical', 0)}")
|
||||
print(f" Severe: {vulns.get('severe', 0)}")
|
||||
print(f" Moderate: {vulns.get('moderate', 0)}")
|
||||
|
||||
|
||||
def cmd_asset_vulns(api, asset_id):
|
||||
"""List vulnerabilities for an asset."""
|
||||
vulns = api.get_asset_vulnerabilities(asset_id)
|
||||
if not vulns:
|
||||
print(f"No vulnerabilities found for asset {asset_id}.")
|
||||
return
|
||||
|
||||
print(f"\nVulnerabilities for asset {asset_id}: {len(vulns)} total\n")
|
||||
print(f"{'Vuln ID':<40} {'Severity':<10} {'CVSS':<8} {'Status':<12}")
|
||||
print("-" * 72)
|
||||
for v in sorted(vulns, key=lambda x: x.get("severity", ""), reverse=True):
|
||||
print(f"{v.get('id', 'N/A')[:39]:<40} "
|
||||
f"{v.get('severity', 'N/A'):<10} "
|
||||
f"{v.get('cvssV3Score', 'N/A'):<8} "
|
||||
f"{v.get('status', 'N/A'):<12}")
|
||||
|
||||
|
||||
def cmd_export_report(api, site_id, output_file):
|
||||
"""Export vulnerability report for a site to CSV."""
|
||||
print(f"[*] Fetching assets for site {site_id}...")
|
||||
assets = api.get_site_assets(site_id)
|
||||
print(f"[+] Found {len(assets)} assets")
|
||||
|
||||
all_findings = []
|
||||
for asset in assets:
|
||||
asset_id = asset.get("id")
|
||||
hostname = asset.get("hostName", asset.get("ip", "unknown"))
|
||||
ip = asset.get("ip", "N/A")
|
||||
os_name = asset.get("os", {}).get("description", "Unknown")
|
||||
|
||||
vulns = api.get_asset_vulnerabilities(asset_id)
|
||||
for v in vulns:
|
||||
all_findings.append({
|
||||
"asset_id": asset_id,
|
||||
"hostname": hostname,
|
||||
"ip_address": ip,
|
||||
"os": os_name,
|
||||
"vulnerability_id": v.get("id", ""),
|
||||
"severity": v.get("severity", ""),
|
||||
"cvss_v3_score": v.get("cvssV3Score", ""),
|
||||
"status": v.get("status", ""),
|
||||
"first_found": v.get("since", ""),
|
||||
})
|
||||
|
||||
print(f" Processed {hostname}: {len(vulns)} vulnerabilities")
|
||||
|
||||
if all_findings:
|
||||
df = pd.DataFrame(all_findings)
|
||||
df = df.sort_values(["cvss_v3_score", "severity"], ascending=[False, False])
|
||||
df.to_csv(output_file, index=False)
|
||||
print(f"\n[+] Report exported to {output_file}")
|
||||
print(f" Total findings: {len(all_findings)}")
|
||||
print(f"\n Severity Distribution:")
|
||||
print(df["severity"].value_counts().to_string())
|
||||
else:
|
||||
print("[!] No findings to export.")
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(
|
||||
description="Rapid7 InsightVM Scan Automation Tool"
|
||||
)
|
||||
parser.add_argument("--console", default="https://localhost:3780",
|
||||
help="InsightVM console URL")
|
||||
parser.add_argument("--username", help="Console username")
|
||||
parser.add_argument("--password", help="Console password")
|
||||
parser.add_argument("--api-key", help="API key (alternative to user/pass)")
|
||||
|
||||
subparsers = parser.add_subparsers(dest="command")
|
||||
|
||||
subparsers.add_parser("sites", help="List all scan sites")
|
||||
|
||||
scan_p = subparsers.add_parser("scan", help="Start a scan")
|
||||
scan_p.add_argument("--site-id", type=int, required=True)
|
||||
scan_p.add_argument("--engine-id", type=int)
|
||||
scan_p.add_argument("--template-id", type=str)
|
||||
scan_p.add_argument("--wait", action="store_true")
|
||||
|
||||
status_p = subparsers.add_parser("status", help="Check scan status")
|
||||
status_p.add_argument("--scan-id", type=int, required=True)
|
||||
|
||||
vuln_p = subparsers.add_parser("vulns", help="List asset vulnerabilities")
|
||||
vuln_p.add_argument("--asset-id", type=int, required=True)
|
||||
|
||||
report_p = subparsers.add_parser("report", help="Export vulnerability report")
|
||||
report_p.add_argument("--site-id", type=int, required=True)
|
||||
report_p.add_argument("--output", default="insightvm_report.csv")
|
||||
|
||||
subparsers.add_parser("engines", help="List scan engines")
|
||||
subparsers.add_parser("templates", help="List scan templates")
|
||||
|
||||
args = parser.parse_args()
|
||||
|
||||
if not args.command:
|
||||
parser.print_help()
|
||||
sys.exit(1)
|
||||
|
||||
api = InsightVMAPI(
|
||||
args.console,
|
||||
username=args.username,
|
||||
password=args.password,
|
||||
api_key=args.api_key
|
||||
)
|
||||
|
||||
if args.command == "sites":
|
||||
cmd_list_sites(api)
|
||||
elif args.command == "scan":
|
||||
cmd_start_scan(api, args.site_id, args.engine_id,
|
||||
args.template_id, args.wait)
|
||||
elif args.command == "status":
|
||||
cmd_scan_status(api, args.scan_id)
|
||||
elif args.command == "vulns":
|
||||
cmd_asset_vulns(api, args.asset_id)
|
||||
elif args.command == "report":
|
||||
cmd_export_report(api, args.site_id, args.output)
|
||||
elif args.command == "engines":
|
||||
engines = api.list_scan_engines()
|
||||
for e in engines:
|
||||
print(f" Engine {e['id']}: {e['name']} - {e.get('address', 'N/A')}")
|
||||
elif args.command == "templates":
|
||||
templates = api.list_scan_templates()
|
||||
for t in templates:
|
||||
print(f" {t['id']}: {t['name']}")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Reference in New Issue
Block a user