Anthropic-Cybersecurity-Skills/skills/implementing-rapid7-insightvm-for-scanning/references/workflows.md

Workflows - Rapid7 InsightVM Deployment

Workflow 1: InsightVM Deployment Pipeline

┌──────────────────┐     ┌──────────────────┐     ┌──────────────────┐
│ Install Security │────>│ Deploy Scan      │────>│ Pair Engines     │
│ Console          │     │ Engines          │     │ with Console     │
└──────────────────┘     └──────────────────┘     └──────────────────┘
                                                          │
        ┌────────────────────────────────────────────────┘
        v
┌──────────────────┐     ┌──────────────────┐     ┌──────────────────┐
│ Configure Scan   │────>│ Set Up Credential│────>│ Create Sites &   │
│ Templates        │     │ Store            │     │ Asset Groups     │
└──────────────────┘     └──────────────────┘     └──────────────────┘
        │
        v
┌──────────────────┐     ┌──────────────────┐     ┌──────────────────┐
│ Schedule Scans   │────>│ Deploy Insight   │────>│ Configure        │
│                  │     │ Agents           │     │ Reports & Alerts │
└──────────────────┘     └──────────────────┘     └──────────────────┘

Workflow 2: Scan Execution Cycle

For each scheduled scan:
    1. Console dispatches scan job to assigned Scan Engine
    2. Engine performs host discovery (ARP, ICMP, TCP SYN)
    3. Engine fingerprints OS and services on discovered hosts
    4. Engine selects vulnerability checks based on fingerprint
    5. If credentials configured: authenticate and perform local checks
    6. Engine reports findings back to Console database
    7. Console correlates with previous scan data (new/fixed/unchanged)
    8. Console updates risk scores and remediation projects
    9. Notifications sent for new critical/high findings
   10. Dashboard and reports refreshed automatically

Workflow 3: Hybrid Scanning Strategy

┌─────────────────────────────────────────────────────┐
│                 Enterprise Network                    │
├─────────────────────────────────────────────────────┤
│                                                       │
│  ┌──────────────┐  Engine Scan   ┌────────────────┐ │
│  │ Data Center  │ <───────────── │ DC Scan Engine │ │
│  │ Servers      │                └────────────────┘ │
│  └──────────────┘                                    │
│                                                       │
│  ┌──────────────┐  Engine Scan   ┌────────────────┐ │
│  │ DMZ Servers  │ <───────────── │ DMZ Scan Engine│ │
│  └──────────────┘                └────────────────┘ │
│                                                       │
│  ┌──────────────┐  Agent-Based   ┌────────────────┐ │
│  │ Laptops /    │ <───────────── │ Insight Agent  │ │
│  │ Remote Users │                │ (on endpoint)  │ │
│  └──────────────┘                └────────────────┘ │
│                                                       │
│  ┌──────────────┐  Agent-Based   ┌────────────────┐ │
│  │ Cloud VMs    │ <───────────── │ Insight Agent  │ │
│  │ (AWS/Azure)  │                │ (on instance)  │ │
│  └──────────────┘                └────────────────┘ │
│                                                       │
│           All results ──> Security Console            │
│                        ──> Insight Platform (Cloud)   │
└─────────────────────────────────────────────────────┘

Workflow 4: Remediation Tracking

Phase	Action	Owner	Timeline
Discovery	Scan identifies vulnerability	InsightVM	Automated
Triage	Severity confirmed, assigned to team	Security Ops	24 hours
Remediation	Patch/config change applied	IT Operations	Per SLA
Validation	Re-scan confirms fix	InsightVM	Next scan cycle
Closure	Remediation project updated	Security Ops	Automated