Rapid7 InsightAppSec

Application Security

Overview

The Rapid7 InsightAppSec connector integrates with the Rapid7 InsightAppSec dynamic application security testing (DAST) platform through its Insight Platform REST API. It synchronizes the scanned applications and their sites, the dynamic code findings (vulnerabilities) discovered during scans, and the finding definitions that describe each vulnerability type. The data is mapped into the Brinqa Unified Data Model (UDM) as Applications, Sites, Dynamic Code Findings, and Dynamic Code Finding Definitions.

Data retrieved from Rapid7 InsightAppSec

Connector Object	Required	Maps to Data Model
Application	Yes	Application
Site	Yes	Site
Dynamic Code Finding	Yes	Dynamic Code Finding
Dynamic Code Finding Definition	Yes	Dynamic Code Finding Definition

Model relationships

note

For detailed steps on how to view the data retrieved from Rapid7 InsightAppSec in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Rapid7 InsightAppSec from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Server URL	Yes	https://<region>.api.insight.rapid7.com	Rapid7 InsightAppSec server url
API key	Yes	—	Rapid7 InsightAppSec API key
Page size	No	500	The maximum number of records to get per API request
Request timeout (secs)	No	120	The maximum seconds allotted before a request will time out. Enter zero (0) to disable timeouts (not recommended).
Parallel requests	No	min(8, available processors)	The maximum number of parallel API requests
Maximum retries	No	5	The maximum number of retry attempts before giving up a request

Authentication

The connector authenticates to the Rapid7 Insight Platform using an API Key. The configured key is sent on every request in the X-Api-Key header. No token-exchange step is performed; the same key is reused for every subsequent API call.

Endpoint

Method	URL
GET	https://<region>.api.insight.rapid7.com/ias/v1/apps

Request Headers

Header	Value
X-Api-Key	<API key>
Accept	application/json
Content-Type	application/json (on POST search requests)

Sample Response

{
  "data": [
    {
      "id": "11112222-3333-4444-5555-666677778888",
      "name": "Corporate Web App",
      "description": "Customer-facing web application"
    }
  ],
  "metadata": { "index": 0, "size": 50, "total_data": 1, "total_pages": 1 }
}

Usage

A 200 OK response confirms the key is valid. The same X-Api-Key value is reused on every model sync request.

Sync Behavior

The connector performs a mix of full and incremental (delta) syncs depending on the model. Models that support delta filter by the sync token (see each model's Sync Duration Parameter below); the rest perform a full sync every run.

---

How to obtain Rapid7 InsightAppSec credentials

Generate a Rapid7 InsightAppSec API key

For the Rapid7 InsightAppSec connector to access the InsightAppSec API, you must provide an API key. To do so, follow these steps:

1. Log in to your organization's Rapid7 InsightAppSec server as an administrator.

2. Click Settings > API Keys. You have two options:

   • Organization Key: The organization key is tied to an organization as a whole. An organization key can be used to authenticate API requests and also provides access to all data within the organization. Only administrators can create organization API keys.

   • User Key: The user key is tied to a specific user account and can be used to authenticate API requests made by that user. The user key inherits the permissions of the user who creates the API key.

     While both keys can be used to authenticate API requests, Brinqa recommends that you generate a User Key. This is because User Keys can provide more controlled access.

3. Click New User Key.

4. Select an organization and provide a name for the key.

5. Click Generate.

   Your new API key displays. You cannot view the key after this, so copy the key and save it to a secure location.

6. Click Done.

Note: If you do not have the permissions to create an API key, contact your Rapid7 administrator. For additional information, see Rapid7 InsightAppSec documentation.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Application

Source Field Name	SDM Attribute
app.description	DESCRIPTION
app.id	UID
app.name	NAME
generated (application)	CATEGORIES
tag.name (from ias/v1/apps/{id}/tags)	TAGS

Site

Source Field Name	SDM Attribute
generated (web application)	CATEGORIES
host of vulnerability.root_cause.url	UID
host of vulnerability.root_cause.url	URL
host of vulnerability.root_cause.url	NAME

Dynamic Code Finding

Source Field Name	SDM Attribute
attack.classification	CLASSIFICATION
attack.id	ATTACK_ID
attackExchange.request	ATTACK_REQUEST
attackExchange.response	ATTACK_RESPONSE
MD5 of app.id + vulnerability.id + module.id + attack.id + root_cause.url + root_cause.parameter + attackExchange.request + attackExchange.response (generated)	UID
module.id	MODULE_ID
variance.attack_value	ATTACK_VALUE
variance.message	MESSAGE
variance.original_exchange.request	REQUEST
variance.original_exchange.response	RESPONSE
variance.original_value	ORIGINAL_VALUE
vulnerability.app.id, host of vulnerability.root_cause.url	TARGETS
vulnerability.first_discovered	FIRST_FOUND
vulnerability.id	TYPE
vulnerability.last_discovered	LAST_FOUND
vulnerability.newly_discovered	NEWLY_DISCOVERED
vulnerability.root_cause.method	PARAMETER
vulnerability.root_cause.parameter	METHOD
vulnerability.status	SOURCE_STATUS
vulnerability.status	PROVIDER_STATUS
vulnerability.status (normalized)	STATUS
vulnerability.status (normalized)	STATUS_CATEGORY

Dynamic Code Finding Definition

Source Field Name	SDM Attribute
attack.type	CATEGORIES
documentation.recommendation	RECOMMENDATION
documentation.references keys not prefixed CWE-	REFERENCES
documentation.references keys prefixed CWE-	CWE_IDS
documentation.references keys prefixed CWE-	WEAKNESSES
module.description	DESCRIPTION
module.name	NAME
vulnerability.id	UID
vulnerability.severity	SOURCE_SEVERITY
vulnerability.severity (normalized to score)	SEVERITY_SCORE
vulnerability.severity (normalized)	SEVERITY

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Application

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Application on every run and applies no incremental date filter.

API

• Type: REST endpoint · Endpoint: GET /ias/v1/apps

Site

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on vulnerability.last_discovered.

API

• Type: REST endpoint · Endpoint: POST /ias/v1/search

Dynamic Code Finding

Operation options

Option	Type	Default	Description
query	String	—	Additional InsightAppSec search filter, prepended to the generated query (e.g. vulnerability.status = 'VERIFIED')

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on vulnerability.last_discovered.

API

• Type: REST endpoint · Endpoint: POST /ias/v1/search

Dynamic Code Finding Definition

Operation options

Option	Type	Default	Description
query	String	—	Additional InsightAppSec search filter, prepended to the generated query

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on vulnerability.last_discovered.

API

• Type: REST endpoint · Endpoint: POST /ias/v1/search

Changelog

Changelog

The Rapid7 InsightAppSec connector has undergone the following changes:

Version	Description	Migration Steps
3.4.27	No changes in this release.	N/A
3.4.26	No changes in this release.	N/A
3.4.25	No changes in this release.	N/A
3.4.24	No changes in this release.	N/A
3.4.23	No changes in this release.	N/A
3.4.22	No changes in this release.	N/A
3.4.21	No changes in this release.	N/A
3.4.20	No changes in this release.	N/A
3.4.19	No changes in this release.	N/A
3.4.18	No changes in this release.	N/A
3.4.17	No changes in this release.	N/A
3.4.16	No changes in this release.	N/A
3.4.15	No changes in this release.	N/A
3.4.14	No changes in this release.	N/A
3.4.13	No changes in this release.	N/A
3.4.12	No changes in this release.	N/A
3.4.11	Dependency Upgrades - Updated bundled libraries, including the shared connector and HTTP client components.	N/A
3.4.10	Dependency Upgrades - Updated the shared data model library.	N/A
3.4.9	Dependency Upgrades - Updated the shared data model library and the CVSS scoring component.	N/A
3.4.8	No changes in this release.	N/A
3.4.7	No changes in this release.	N/A
3.4.6	No changes in this release.	N/A
3.4.5	No changes in this release.	N/A
3.4.4	Dependency Upgrades - Replaced the embedded local key-value storage engine to improve reliability of on-disk sync state.	N/A
3.4.3	Improvements - Standardized HTTP error reporting so failed API requests surface clearer, consistently formatted messages, including dedicated handling for "Bad Request" responses.	N/A
3.4.2	New Features - Application records now include the tags assigned to each application in Rapid7 InsightAppSec.	N/A
3.4.1	Improvements - Reworked how dynamic code finding statuses are recorded. The raw provider status is now captured separately from the normalized status, giving a consistent normalized status alongside the original value reported by Rapid7.	• DynamicCodeFinding: The status attributes were re-keyed so that the original provider value and the normalized value are stored under distinct attributes. Action: re-sync this connector so finding status values are repopulated.
3.4.0	Overview The Rapid7 InsightAppSec connector integrates with Rapid7 InsightAppSec to synchronize applications, dynamic application security testing findings, and the sites where those findings were discovered. Category: Application Security Models	N/A
3.3.3	Dependency Upgrades - Updated the shared data model and local storage libraries.	N/A
3.3.2	No changes in this release.	N/A
3.3.1	No changes in this release.	N/A
3.3.0	Dependency Upgrades - Updated the shared data model library.	N/A
3.2.8	No changes in this release.	N/A
3.2.7	No changes in this release.	N/A
3.2.6	New Features - Added a configurable Request Timeout setting, letting you control how long the connector waits for responses from the Rapid7 InsightAppSec API.	N/A
3.2.5	No changes in this release.	N/A
3.2.4	No changes in this release.	N/A
3.2.3	No changes in this release.	N/A
3.2.2	No changes in this release.	N/A
3.2.1	No changes in this release.	N/A
3.2.0	Improvements - Improved error reporting for failed API requests so that the underlying status code and message from Rapid7 InsightAppSec are surfaced together.	N/A
3.1.2	Dependency Upgrades - Updated bundled libraries, including the JSON processing, shared data model, HTTP client, and local storage components.	N/A
3.1.1	Dependency Upgrades - Updated the shared data model library.	N/A
3.1.0	Overview The Rapid7 InsightAppSec connector integrates with Rapid7 InsightAppSec to synchronize applications, dynamic application security testing findings, and the sites where those findings were discovered. Category: Application Security Models	N/A