Rapid7 Nexpose
Vulnerability Management- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Rapid7 Nexpose connector integrates with a Rapid7 Nexpose / InsightVM Security Console (on-premises) through its REST API (version 3). It synchronizes hosts (assets) and the software packages installed on them, the vulnerabilities found on those hosts, vulnerability definitions, and policy compliance benchmarks and their per-asset results. The data is mapped into the Brinqa Unified Data Model (UDM) as Hosts, Packages, Installed Packages, Vulnerabilities, Vulnerability Definitions, and Violation Definitions.
Data retrieved from Rapid7 Nexpose
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Host | Yes | Host |
| Package | Yes | Package |
| Installed Package | Yes | Installed Package |
| Vulnerability | Yes | Vulnerability |
| Vulnerability Definition | Yes | Vulnerability Definition |
| Asset Policy | Yes | Violation Definition |
| Policy | Yes | Violation Definition |
Model relationships
For detailed steps on how to view the data retrieved from Rapid7 Nexpose in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Rapid7 Nexpose from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Server URL | Yes | https://<host>:<port>/ | Rapid7 Nexpose server url |
| Username | Yes | — | Rapid7 Nexpose user login |
| Password | Yes | — | Rapid7 Nexpose user password |
| SSL / TLS | No | false | Skip certificate verification |
| Cloud Properties | No | — | Comma delimited list of cloud properties to promote as attributes on the host. |
Authentication
The connector authenticates to the Nexpose Security Console using HTTP Basic authentication. The console username and password configured on the connector are sent on every request in the standard Authorization: Basic header. No token-exchange step is performed; the same credentials are reused for every subsequent API call.
Endpoint
| Method | URL |
|---|---|
GET | https://<host>:<port>/api/3 (connectivity / credential validation) |
Request Headers
| Header | Value |
|---|---|
Authorization | Basic <base64(username:password)> |
Accept | application/json |
X-Requested-With | brinqa |
Sample Response
{
"resources": [
{ "id": 1, "name": "Default Site", "type": "static" }
],
"page": { "number": 0, "size": 10, "totalResources": 1, "totalPages": 1 }
}
Usage
A 200 OK response confirms the credentials are valid. The same Basic credentials are then reused on every model sync request.
Sync Behavior
The connector performs a mix of full and incremental (delta) syncs depending on the model. Models that support delta filter by the sync token (see each model's Sync Duration Parameter below); the rest perform a full sync every run.
How to obtain Rapid7 Nexpose credentials
Obtain the required credentials (url, username, password) from your Rapid7 Nexpose administrator or the Rapid7 Nexpose admin console, then enter them in the connection settings above.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Host
| Source Field Name | SDM Attribute |
|---|---|
active | STATUS |
AssetResource.addresses[].ip, AssetResource.ip | IP_ADDRESSES |
AssetResource.addresses[].mac, AssetResource.mac (normalized) | MAC_ADDRESSES |
AssetResource.assessedForVulnerabilities | ASSESSED_FOR_VULNERABILITIES |
AssetResource.cpe.v2_3 (else v2_2) | CPE |
AssetResource.dns | DNS_NAMES |
AssetResource.dns (when private) | PRIVATE_DNS_NAMES |
AssetResource.dns (when public) | PUBLIC_DNS_NAMES |
AssetResource.hostName / first hostNames[].name | NAME |
AssetResource.hostNames[].name, AssetResource.hostName (normalized) | HOSTNAMES |
AssetResource.ids[] where source = amazon-web-services | AWS_ID |
AssetResource.last_scanned | LAST_SCANNED |
AssetResource.last_seen | LAST_SEEN |
AssetResource.netbios | NETBIOS_NAME |
AssetResource.operatingSystem | OPERATING_SYSTEM |
AssetResource.riskScore | RISK_SCORE |
AssetResource.services[].name | SERVICES |
AssetResource.services[].port | PORTS |
AssetResource.software[].id | SOFTWARES |
AssetResource.uuid | UUID |
| AWS/GCP/Azure config values named in the cloudProperties setting | (cloud properties) |
generated (Instant.now) | LAST_CAPTURED |
generated Rapid7 NexposeHost- + AssetResource.id | UID |
host + AssetResource.type | CATEGORIES |
| IP addresses classified as local | PRIVATE_IP_ADDRESSES |
| IP addresses not classified as local | PUBLIC_IP_ADDRESSES |
site.id + : + site.name | SITES |
tag names from GET /api/3/tags/{id}/assets (when fetch_tags enabled) | TAGS |
Package
| Source Field Name | SDM Attribute |
|---|---|
Software.cpe.edition | CPE_EDITION |
Software.cpe.language | CPE_LANGUAGE |
Software.cpe.other | CPE_OTHER |
Software.cpe.part | CPE_PART |
Software.cpe.product | CPE_PRODUCT |
Software.cpe.swEdition | CPE_SW_EDITION |
Software.cpe.targetHW | CPE_TARGET_HW |
Software.cpe.targetSW | CPE_TARGET_SW |
Software.cpe.update | CPE_UPDATE |
Software.cpe.v2_2 | CPE_V2_2 |
Software.cpe.v2_3 | CPE_V2_3 |
Software.cpe.vendor | CPE_VENDOR |
Software.cpe.version | CPE_VERSION |
Software.description | DESCRIPTION |
Software.family | FAMILY |
Software.id | UID |
Software.product | PRODUCT |
Software.vendor | VENDOR |
Software.vendor + Software.product + Software.version | NAME |
Software.version | VERSION |
Installed Package
| Source Field Name | SDM Attribute |
|---|---|
AssetResource.id | TARGETS |
MD5 of AssetResource.id + Software.id (generated) | UID |
Software.cpe.edition | CPE_EDITION |
Software.cpe.language | CPE_LANGUAGE |
Software.cpe.other | CPE_OTHER |
Software.cpe.part | CPE_PART |
Software.cpe.product | CPE_PRODUCT |
Software.cpe.swEdition | CPE_SW_EDITION |
Software.cpe.targetHW | CPE_TARGET_HW |
Software.cpe.targetSW | CPE_TARGET_SW |
Software.cpe.update | CPE_UPDATE |
Software.cpe.v2_2 | CPE_V2_2 |
Software.cpe.v2_3 | CPE_V2_3 |
Software.cpe.vendor | CPE_VENDOR |
Software.cpe.version | CPE_VERSION |
Software.description | DESCRIPTION |
Software.family | FAMILY |
Software.id | TYPE |
Software.product | PRODUCT |
Software.vendor | VENDOR |
Software.vendor + Software.product + Software.version | NAME |
Software.version | VERSION |
Vulnerability
| Source Field Name | SDM Attribute |
|---|---|
generated (Instant.now) | LAST_CAPTURED |
Instance.id | TYPE |
max of AssetResource.last_scanned and last_seen | LAST_FOUND |
MD5 of Instance.id + HOST_ID + PORT + PROTOCOL + RESULTS (generated) | UID |
Rapid7 NexposeHost- + AssetResource.id | TARGETS |
Rapid7 NexposeHost- + AssetResource.id | HOST_ID |
Result.port | PORT |
Result.proof | RESULTS |
Result.protocol | PROTOCOL |
Result.since | FIRST_FOUND |
Result.status | SOURCE_STATUS |
Result.status | PROVIDER_STATUS |
Result.status (normalized) | STATUS_CATEGORY |
Result.status (normalized; invulnerable → non-vulnerable) | STATUS |
Vulnerability Definition
| Source Field Name | SDM Attribute |
|---|---|
calculated from Definition.cvss.v2.vector | CVSS_V2_BASE_SCORE |
calculated from Definition.cvss.v2.vector | CVSS_V2_TEMPORAL_SCORE |
calculated from Definition.cvss.v3.vector | CVSS_V3_BASE_SCORE |
calculated from Definition.cvss.v3.vector | CVSS_V3_TEMPORAL_SCORE |
Definition.categories | CATEGORIES |
Definition.cves | CVE_IDS |
Definition.cves | CVE_RECORDS |
Definition.cvss.v2.vector | CVSS_V2_VECTOR |
Definition.cvss.v3.vector | CVSS_V3_VECTOR |
Definition.description.value | DESCRIPTION |
Definition.id | UID |
Definition.severity | SOURCE_SEVERITY |
Definition.severity (normalized to score) | SEVERITY_SCORE |
Definition.severityScore (normalized) | SEVERITY |
Definition.title | NAME |
derived from Definition.cvss.v2.vector | CVSS_V2_AV / CVSS_V2_AC / CVSS_V2_AU / CVSS_V2_CI / CVSS_V2_II / CVSS_V2_AI / CVSS_V2_E / CVSS_V2_RL / CVSS_V2_RC / CVSS_V2_SEVERITY |
derived from Definition.cvss.v3.vector | CVSS_V3_AV / CVSS_V3_AC / CVSS_V3_PR / CVSS_V3_UI / CVSS_V3_CI / CVSS_V3_II / CVSS_V3_AI / CVSS_V3_E / CVSS_V3_RL / CVSS_V3_RC / CVSS_V3_SEVERITY |
exploit names (from /api/3/exploits/{id}/vulnerabilities) | EXPLOITS |
malware kit names (from /api/3/malware_kits/{id}/vulnerabilities) | MALWARE |
Solution.summary.value (from /api/3/vulnerabilities/{id}/solutions) | RECOMMENDATION |
Asset Policy
| Source Field Name | SDM Attribute |
|---|---|
AssetPolicyResource.id | TYPE |
AssetPolicyResource.status | SOURCE_STATUS |
AssetPolicyResource.status | PROVIDER_STATUS |
AssetPolicyResource.status (normalized) | STATUS |
AssetPolicyResource.status (normalized) | STATUS_CATEGORY |
MD5 of AssetPolicyResource.id + HOST_ID (generated) | UID |
Rapid7 NexposeHost- + AssetResource.id | TARGETS |
Rapid7 NexposeHost- + AssetResource.id | HOST_ID |
Policy
| Source Field Name | SDM Attribute |
|---|---|
PolicyResource.benchmarkName | BENCHMARK_NAME |
PolicyResource.benchmarkVersion | BENCHMARK_VERSION |
PolicyResource.category | CATEGORIES |
PolicyResource.description | DESCRIPTION |
PolicyResource.failedAssetsCount | FAILED_ASSETS_COUNT |
PolicyResource.failedRulesCount | FAILED_RULES_COUNT |
PolicyResource.id | UID |
PolicyResource.isCustom | IS_CUSTOM |
PolicyResource.links[].href | LINKS |
PolicyResource.notApplicableAssetsCount | NOT_APPLICABLE_ASSETS_COUNT |
PolicyResource.notApplicableRulesCount | NOT_APPLICABLE_RULES_COUNT |
PolicyResource.passedAssetsCount | PASSED_ASSETS_COUNT |
PolicyResource.passedRulesCount | PASSED_RULES_COUNT |
PolicyResource.policyName | POLICY_NAME |
PolicyResource.ruleCompliance | RULE_COMPLIANCE |
PolicyResource.ruleComplianceDelta | RULE_COMPLIANCE_DELTA |
PolicyResource.scope | SCOPE |
PolicyResource.surrogateId | SURROGATE_ID |
PolicyResource.title | NAME |
PolicyResource.title | TITLE |
PolicyResource.unscoredRules | UNSCORED_RULES |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Host
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
fetch_tags | Boolean | false | Bulk-fetch asset tags and populate TAGS |
_asset-search filters_ | String | — | Any supported Nexpose asset-search field (e.g. site-id, ip-address, operating-system, risk-score) applied as an is/in filter |
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on last-scan-date.
API
- Type: REST endpoint · Endpoint:
GET /api/3/sites
Package
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on last-scan-date.
API
- Type: REST endpoint · Endpoint:
POST /api/3/assets/search
Installed Package
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on last-scan-date.
API
- Type: REST endpoint · Endpoint:
POST /api/3/assets/search
Vulnerability
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
include_invulnerable | Boolean | true | Include results with an invulnerable status (emitted as non-vulnerable) |
_asset-search filters_ | String | — | Any supported Nexpose asset-search field applied as an is/in filter |
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on last-scan-date.
API
- Type: REST endpoint · Endpoint:
POST /api/3/assets/search
Vulnerability Definition
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Vulnerability Definition on every run and applies no incremental date filter.
API
- Type: REST endpoint · Endpoint:
GET /api/3/vulnerabilities
Asset Policy
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on last-scan-date.
API
- Type: REST endpoint · Endpoint:
POST /api/3/assets/search
Policy
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Policy on every run and applies no incremental date filter.
API
- Type: REST endpoint · Endpoint:
GET /api/3/policies
Changelog
The Rapid7 Nexpose connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.4.27 | Improvements - Improved troubleshooting by making the connector log detailed information about every API call it makes and the response it receives — without needing to turn on verbose logging. | N/A |
| 3.4.26 | No changes in this release. | N/A |
| 3.4.25 | Improvements - Asset tags from Nexpose are now retrieved and synchronized with hosts, giving better visibility into how assets are categorized and grouped. | N/A |
| 3.4.24 | No changes in this release. | N/A |
| 3.4.23 | Improvements - Reworked vulnerability synchronization to use on-disk storage for intermediate data (malware kits, exploits, and solutions). This significantly reduces memory usage and improves stability when synchronizing very large vulnerability datasets. | N/A |
| 3.4.22 | Improvements - Improved the reliability of policy compliance violation processing, including clearer logging when individual violations cannot be processed. | N/A |
| 3.4.21 | New Features - Added an AWS ID attribute to hosts so cloud-hosted assets can be correlated with their AWS instance identity. Improvements - Reworked how host identity and network details are populated. A host's name is now derived from its primary hostname, all hostnames are captured together, and IP addresses (including separate public and private address lists) are aggregated into multi-valued attributes for more complete asset data. | • Host: Host name and IP address attributes are now populated from consolidated, multi-valued sources. Action: re-sync hosts to refresh these attributes. |
| 3.4.20 | Improvements - Vulnerability findings now record when they were last captured, improving the accuracy of finding age and freshness reporting. | N/A |
| 3.4.19 | Bug Fixes - Fixed how cloud-provider configuration properties on hosts are read and populated, ensuring these attributes are captured correctly. | N/A |
| 3.4.18 | No changes in this release. | N/A |
| 3.4.17 | Improvements - Cloud-provider configuration on hosts is now expanded into individual, named attributes (one per cloud property) instead of a single combined Configuration value, making cloud metadata easier to consume and report on. | • Host: The single Configuration attribute has been replaced by individual cloud-property attributes. Action: re-sync hosts to refresh these attributes. |
| 3.4.16 | Bug Fixes - Fixed how the last-found date is set on vulnerability findings so that the value reflects the correct scan time. | N/A |
| 3.4.15 | Improvements - Hosts now record a last-seen date, improving asset freshness and inactivity reporting. | N/A |
| 3.4.14 | Improvements - Installed packages now record when they were last captured, improving software inventory freshness reporting. | N/A |
| 3.4.13 | No changes in this release. | N/A |
| 3.4.12 | New Features - Hosts now indicate whether they have been assessed for vulnerabilities and carry an explicit status, making it easier to distinguish scanned assets from those that have not yet been evaluated. | N/A |
| 3.4.11 | New Features - Hosts now synchronize their associated sites and tags, providing richer context on how assets are grouped and organized within Nexpose. Improvements - Site information on hosts has been consolidated into a single multi-valued Sites attribute, replacing the separate site identifier and site name attributes. | • Host: Separate site identifier and site name attributes have been replaced by a consolidated, multi-valued Sites attribute. Action: re-sync hosts to refresh these attributes. |
| 3.4.10 | Dependency Upgrades - Updated bundled platform model libraries. | N/A |
| 3.4.9 | New Features - Added Policy and Asset Policy models, enabling synchronization of Nexpose policy compliance definitions and the per-asset compliance results associated with them. | N/A |
| 3.4.8 | No changes in this release. | N/A |
| 3.4.7 | No changes in this release. | N/A |
| 3.4.6 | No changes in this release. | N/A |
| 3.4.5 | Improvements - Reworked how installed software is captured on hosts, replacing the numeric software attribute with a descriptive, multi-valued software list for more meaningful software inventory data. | • Host: The Software attribute (numeric identifiers) has been replaced by a Softwares attribute containing software descriptions. Action: re-sync hosts to refresh these attributes. |
| 3.4.4 | Dependency Upgrades - Replaced the embedded key-value storage engine (RocksDB) with Speedb. | N/A |
| 3.4.3 | No changes in this release. | N/A |
| 3.4.2 | Bug Fixes - Fixed paginated data retrieval so that all pages of results are read correctly, preventing assets and other records from being missed during synchronization. | N/A |
| 3.4.1 | Improvements - Reworked the synchronization engine to stream large API responses and automatically retry transient failures, improving reliability and reducing memory usage when synchronizing large environments. | N/A |
| 3.4.0 | No changes in this release. | N/A |
| 3.3.3 | Dependency Upgrades - Updated bundled storage and platform model libraries and removed the unused RocksDB dependency. | N/A |
| 3.3.2 | No changes in this release. | N/A |
| 3.3.1 | No changes in this release. | N/A |
| 3.3.0 | Overview The Rapid7 Nexpose connector integrates with Rapid7 Nexpose (InsightVM on-premises) to synchronize host assets, installed software, and vulnerability findings and their definitions. Category: Vulnerability Management Models | N/A |