Proofroom
Book a callStart free trial
Start free trial
Menu
Try the demoBook a call

Rapid7

Proofroom reads Rapid7 InsightVM through the Insight Platform’s Cloud Integrations API (v4) with a user key. It collects your internal scan cadence and every vulnerable finding with its age and remediation target.

Your Security Console must be paired with the Insight Platform (cloud integration). A console that is not paired is not reachable from Proofroom; export a CSV report and import it on a Scan imports integration instead.

What each collector shows

Collector Kind Default cadence What it shows Suggested controls
Internal scans window quarterly Scans in the period with status and scan engine; which of the last four quarters had a finished internal scan; likely rescans (another scan with the same name within 30 days). PCI DSS 11.3.1; SOC 2 CC7.1
Open vulnerabilities and remediation snapshot monthly Every vulnerable finding on InsightVM assets by severity, with its age from first found; those past the remediation target; findings remediated since the last run, with days to fix. A findings.csv is attached. PCI DSS 6.3.1, 6.3.3; SOC 2 CC7.1

Severities. Rapid7’s critical is shown as critical, severe as high, moderate as medium and low as low. Informational findings are left out and counted. Findings Rapid7 does not report as vulnerable (exceptions, overrides, skipped or superseded checks) are counted by status in the notes, not listed.

Internal or external. List the names of scans that scan from outside your network; every other scan counts as internal. A name that matches no scan in the last year fails the run.

Remediation targets. A critical finding is past target when it is still open more than critical days (default 30, PCI DSS 6.3.3) after Rapid7 first found it; a high finding after high days (default 90). A critical or high finding with no first-found date is never counted as within target. Medium and low have no target, so PCI DSS 11.3.1.1 is not suggested.

Create the key

  1. Create a dedicated InsightVM user with read-only access to the sites and asset groups in scope.
  2. Sign in to the Insight Platform as that user, open Settings → API Keys → User Key, and generate a key. A user key has the permissions of its user. Do not use an organization key: it is a key for everything.

Connect

Field Value
Region Your Insight Platform region: us, us2, us3, eu, ca, au, ap, aps2 or me1
API key The user key
External scans Names of scans that scan from outside your network, one per line
Critical days, High days Your remediation targets

The connection test calls the Insight Platform’s /validate.

Calls

  • GET /vm/v4/integration/scan?page=0&size=500, then the next page number while it is below totalPages. Scans before a year ago are dropped.
  • POST /vm/v4/integration/assets?comparisonTime=<start of the period>&currentTime=<run time>&includeSame=true&size=50: new and still-present findings are open; remediated ones are fixed in the period.
  • POST /vm/v4/integration/vulnerabilities with id IN [...], 100 at a time, for titles, severities and CVSS scores.

Known limits

  • Next pages are built from Proofroom’s own request (the cursor, or the next page number), never from the response’s links, and a run that reads fewer records or pages than totalResources or totalPages says fails. UNVERIFIED until a live run: how v4 combines cursor and page.
  • UNVERIFIED: the least-privileged InsightVM role a v4 user key needs (Rapid7 does not state it; some users report 401 with user keys); the scan status values (Rapid7 documents only “Success”, which counts as finished); that the asset search accepts an empty search; the id IN [...] search on vulnerabilities; Rapid7’s 429 behaviour.
  • The first run compares with one month before it; later runs compare with the previous run.

Live check

After the first runs, check that the scans list matches the console’s scan history for the period, and that the open critical count matches the Vulnerabilities page filtered to Critical.