Rapid7 InsightAppSec

Rapid7 InsightAppSec is a dynamic application security testing tool (DAST) that provides visibility into potential vulnerabilities found within your web applications. You can bring application, site, and dynamic code data from Rapid7 InsightAppSec into Brinqa. By combining InsightAppSec's application security capabilities with Brinqa's risk management and prioritization, you can achieve a unified view of your attack surface, thus strengthening your cybersecurity posture.

This document details the information you must provide for the connector to authenticate with Rapid7 InsightAppSec and how to obtain that information from Rapid7. See create a data integration for step-by-step instructions on setting up the integration.

Required connection settings

When setting up a data integration, select Rapid7 InsightAppSec from the Connector drop-down. If you cannot find the connector in the drop-down, make sure that you have installed it first. You must provide the following information to authenticate Rapid7 InsightAppSec with Brinqa:

• Server URL: The Rapid7 InsightAppSec server URL. The default format is https://<region>.api.insight.rapid7.com.

  info

  Replace <region> with the specific region your Rapid7 InsightAppSec server is located in. For example, if your server is in the United States, the API URL might be https://us.api.insight.rapid7.com/.

  You can find your region by checking the Insight platform Home page as described in Rapid7's documentation. For a list of supported regions and corresponding URLs, please refer to the Rapid7 Insight API documentation.

• API key: The access key associated with the Rapid7 InsightAppSec account, which must have permissions to log in to the API server and return data.

Generate a Rapid7 InsightAppSec API key

For the Rapid7 InsightAppSec connector to access the InsightAppSec API, you must provide an API key. To do so, follow these steps:

1. Log in to your organization's Rapid7 InsightAppSec server as an administrator.

2. Click Settings > API Keys. You have two options:

   • Organization Key: The organization key is tied to an organization as a whole. An organization key can be used to authenticate API requests and also provides access to all data within the organization. Only administrators can create organization API keys.

   • User Key: The user key is tied to a specific user account and can be used to authenticate API requests made by that user. The user key inherits the permissions of the user who creates the API key.

     While both keys can be used to authenticate API requests, Brinqa recommends that you generate a User Key. This is because User Keys can provide more controlled access.

3. Click New User Key.

4. Select an organization and provide a name for the key.

5. Click Generate.

   Your new API key displays. You cannot view the key after this, so copy the key and save it to a secure location.

6. Click Done.

note

If you do not have the permissions to create an API key, contact your Rapid7 administrator. For additional information, see Rapid7 InsightAppSec documentation.

Additional settings

The Rapid7 InsightAppSec connector contains additional options for specific configuration:

• Page size: The maximum number of records to get per API request. The default setting is 500. It is not recommended to go over 500.

• Parallel requests: The maximum number of parallel API requests. The default setting is 8.

• Maximum retries: The maximum number of times that the integration attempts to connect to the Rapid7 InsightAppSec API before giving up and reporting a failure. The default setting is 5.

Types of data to retrieve

The Rapid7 InsightAppSec connector can retrieve the following types of data from the InsightAppSec API:

Table 1: Data retrieved from Rapid7 InsightAppSec

Connector Object	Required	Maps to Data Model
Application	Yes	Application
Dynamic Code Finding	Yes	Dynamic Code Finding
Dynamic Code Finding Definition	Yes	Dynamic Code Finding Definition
Site	Yes	Site

info

For detailed steps on how to view the data retrieved from Rapid7 InsightAppSec in the Brinqa Platform, see How to view your data.

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes.

Application

Table 2: Application attribute mappings

Source Field Name	Maps to Attribute
app.description	description
app.id	uid
app.name	name
asset.category_application	categories

Dynamic Code Finding

Table 3: Dynamic Code Finding attribute mappings

Source Field Name	Maps to Attribute
uid	uid
vulnerability.app.id ,vulnerability.rootcause.url.host	targets
vulnerability.first_discovered	firstFound
vulnerability.id	type
vulnerability.last_discovered	lastFound
vulnerability.newly_discovered	Local variable
vulnerability.root_cause.method	Local variable
vulnerability.root_cause.parameter	Local variable
vulnerability.status	status, statusCategory
vulnerability.variance.attack.classification	Local variable
vulnerability.variance.attack_value	Local variable
vulnerability.variance.exchange.request	Local variable
vulnerability.variance.exchange.response	Local variable
vulnerability.variance.message	Local variable
vulnerability.variance.original_exchange.request	request
vulnerability.variance.original_exchange.response	Local variable
vulnerability.variance.original_value	Local variable
vulnerability.attack.id	Local variable
vulnerability.module.id	Local variable

Dynamic Code Finding Definition

Table 4: Dynamic Code Finding Definition attribute mappings

Source Field Name	Maps to Attribute
vulnerability.severity	severity, sourceSeverity, severityScore
vulnerability.variance.attack.type	categories
vulnerability.variance.doc.references	cweIds, weaknesses references
vulnerability.variance.doc.recommendation	recommendation
vulnerability.variance.module.description	description
vulnerability.variance.module.name	name
vulnerability.vuln.id	uid

Site

Table 5: Site attribute mappings

Source Field Name	Maps to Attribute
asset category web application	categories
vulnerability.root_cause.url.getHost	uid
vulnerability.root_cause.url.getHost	url, name

info

Local variable indicates that the field is processed within a specific context, such as a particular workflow or calculation. Unlike other attributes, local variables aren't mapped to the unified data models. They only exist on the source data model.

Operation options

The Rapid7 InsightAppSec connector supports the following operation options. See connector operation options for information about how to apply them.

Table 6: Rapid7 InsightAppSec connector operation options

Connector Object	Option	All Possible Values	Description	Example
Dynamic Code Finding	vulnerability.severity	SAFE, INFORMATIONAL, LOW, MEDIUM, HIGH	Retrieve vulnerabilities from dynamic code findings with the specified severity level.	Key: vulnerability.severity Value: HIGH. This key and value combination only retrieves vulnerabilities from dynamic code findings with a severity of HIGH.
	vulnerability.status	UNREVIEWED, FALSE_POSITIVE, VERIFIED, IGNORED, REMEDIATED, DUPLICATE	Retrieves vulnerabilities from dynamic code findings with the specified status category as determined by Rapid7 InsightAppSec.	Key: vulnerability.status Value: VERIFIED. This key and value combination only retrieves vulnerabilities from dynamic code findings with a VERIFIED status.
Dynamic Code Finding Definition	vulnerability.severity	SAFE, INFORMATIONAL, LOW, MEDIUM, HIGH	Retrieve vulnerabilities from dynamic code finding definitions with the specified severity level.	Key: vulnerability.severity Value: LOW. This key and value combination only retrieves vulnerabilities from dynamic code finding definition with a severity of LOW.
	vulnerability.status	UNREVIEWED, FALSE_POSITIVE, VERIFIED, IGNORED, REMEDIATED, DUPLICATE	Retrieves vulnerabilities from dynamic code finding definitions with the specified status category as determined by Rapid7 InsightAppSec.	Key: vulnerability.status Value: UNREVIEWED. This key and value combination only retrieves vulnerabilities from dynamic code finding definitions with a UNREVIEWED status.
Site	vulnerability.severity	SAFE, INFORMATIONAL, LOW, MEDIUM, HIGH	Retrieve vulnerabilities from sites with the specified severity level.	Key: vulnerability.severity Value: MEDIUM. This key and value combination only retrieves vulnerabilities from sites with a severity of MEDIUM.
	vulnerability.status	UNREVIEWED, FALSE_POSITIVE, VERIFIED, IGNORED, REMEDIATED, DUPLICATE	Retrieve vulnerabilities from sites with the specified status category as determined by Rapid7 InsightAppSec.	Key: vulnerability.status Value: DUPLICATE. This key and value combination only retrieves vulnerabilities from sites with a DUPLICATE status.

note

The option keys and values are case-sensitive as they are shown in this documentation.

APIs

The Rapid7 InsightAppSec connector uses the InsightAppSec API v1. Specifically, it uses the following endpoints:

Table 7: Rapid7 InsightAppSec API Endpoints

Connector Object	API Endpoint
Application	GET /ias/v1/apps
Dynamic Code Finding	GET /ias/v1/modules/{module-id}
	GET /ias/v1/modules/{module-id}/attacks/{attack-id}
	GET /ias/v1/modules/{module-id}/attacks/{attack-id}/documentation
	POST /ias/v1/search
Dynamic Code Finding Definition	GET /ias/v1/modules/{module-id}
	GET /ias/v1/modules/{module-id}/attacks/{attack-id}
	GET /ias/v1/modules/{module-id}/attacks/{attack-id}/documentation
	POST /ias/v1/search
Site	GET /ias/v1/modules/{module-id}
	GET /ias/v1/modules/{module-id}/attacks/{attack-id}
	GET /ias/v1/modules/{module-id}/attacks/{attack-id}/documentation
	POST /ias/v1/search

Changelog

The Rapid7 InsightAppSec connector has undergone the following changes:

Table 8: Rapid7 InsightAppSec connector changelog

Version	Description
3.4.7	No change.
3.4.6	No change.
3.4.5	No change.
3.4.4	No change.
3.4.3	No change.
3.4.2	Added the TAGS attribute to the Application object.
3.4.1	Added the PROVIDER_STATUS attribute to the Dynamic Code Finding object.
3.4.0	Added the SOURCE_STATUS attribute to the Dynamic Code Finding object.
3.3.3	No change.
3.2.5	Updated the paging logic.
3.1.1	Normalized the values for status.
3.1.0	Initial Integration+ release.