Rapid7 InsightVM

1. Ensure that your Archer system meets the following requirements:

   • Archer Platform Release 2024.03

2. Read and understand "Packaging Data" in the Archer Platform Help.

Installing a package requires that you import the package file, map the objects in the package to objects in the target instance, and then install the package. For more information, see Installing the Packages.

You must import and schedule each use case data feed that you want to use. See Setting Up Data Feeds for complete information.

Note: Rapid7 data feeds are packaged in the Rapid7 Insight VM integration installation package. Please use this section in cases where the data feeds need to the imported separately.

Test the application according to your company standards and procedures, to ensure that the use case works with your existing processes.

There is no undo function for package installation. Packaging is a powerful feature that can make significant changes to an instance. Archer strongly recommends that you back up the instance database before installing a package. This process enables a full restoration if necessary.

An alternate method for undoing a package installation is to create a package of the affected objects in the target instance before installing the new package. This package provides a snapshot of the instance before the new package is installed, which can be used to help undo the changes made by the package installation. You must manually delete new objects created by the package installation.

1. From the menu bar, click > Application Builder > Install Packages.

2. In the Available Packages section, click Import.

3. Click Add New, then select the package file that you want to import.

4. Click OK.

The Available Packages section displays the package file and is ready for installation.

Important: This step is required only if you are upgrading to a later version of [ODA name].

1. From the menu bar, click > Application Builder > Install Packages.

2. In the Available Packages section, select the package you want to map.

3. In the Actions column, click for that package.

   The analyzer runs and examines the information in the package. The analyzer automatically matches the system IDs of the objects in the package with the objects in the target instances and identifies objects from the package that are successfully mapped to objects in the target instance, objects that are new or exist but are not mapped, and objects that do not exist (the object is in the target but not in the source).

   Note: This process can take several minutes or more, especially if the package is large, and may time out after 60 minutes. This time-out setting temporarily overrides any IIS time-out settings set to less than 60 minutes.

4. When the analyzer is complete, the Advanced Package Mapping page lists the objects in the package file and corresponding objects in the target instance. The objects are divided into tabs, depending on whether they are found within Applications, Solutions, Access Roles, Groups, Sub- forms, or Questionnaires.

   On each tab of the Advanced Mapping Page, review the icons next to each object to determine which objects you must map manually.

   Icon	Name	Description
   	Awaiting Mapping Review	Indicates that the system could not automatically match the object or children of the object to a corresponding object in the target instance. Objects marked with this icon must be mapped manually through the mapping process. Important: New objects should not be mapped. This icon should remain visible. The mapping process can proceed without mapping all the objects. Note: You can run the mapping process without mapping all the objects. The icon is for informational purposes only.
   	Mapping Completed	Indicates that the object and all child objects are mapped to an object in the target instance. There are no further steps required with these objects in Advanced Package Mapping.
   	Do Not Map	Indicates that the object does not exist in the target instance, or the object was not mapped through the Do Not Map option. These objects will not be mapped through Advanced Package Mapping and must be remedied manually.
   	Undo	Indicates that a mapped object can be unmapped. This icon is displayed in the Actions column of a mapped object or object flagged as Do Not Map.

5. For each object that requires remediation, do one of the following:

   • To map each item individually, on the Target column, select the object in the target instance to which you want to map the source object. If an object is new or if you do not want to map an object, select Do Not Map from the drop-down list.

     Important: Ensure that you map all objects to their lowest level. When objects have child or related objects, the parent object provides a drill-down link. You must map child objects before parent objects. For more details, see "Mapping Parent/Child Objects" in the Archer Platform Help.

   • To automatically map all objects in a tab that have different system IDs but the same object name as an object in the target instance, do the following:

     1. In the toolbar, click Auto Map.

     2. Select an option for mapping objects by name.

        Option	Description
        Ignore case	Select this option to match objects with similar names regardless of the case of the characters in the object names.
        Ignore spaces	Select this option to match objects with similar names regardless of whether spaces exist in the object names.

     3. Click OK. The Confirmation dialog box opens with the total number of mappings performed. These mappings have not been committed to the database yet and can be modified in the Advanced Package Mapping page.

     4. Click OK.

        • To set all objects in the tab to Do Not Map, in the toolbar, click Do Not Map.

   To undo the mapping settings for any individual object, in the Actions column, click Undo.

   When all objects are mapped, the icon is displayed in the tab title. The icon is displayed next to the object to indicate that the object will not be mapped.

6. Verify that all other objects are mapped correctly.

7. (Optional) To save your mapping settings so that you can resume working later, see "Importing and Exporting Mapping Settings" in the Archer Platform Help.

8. Once you have reviewed and mapped all objects, click Execute.

9. Select I understand the implications of performing this operation and click OK.

The Advanced Package Mapping process updates the system IDs of the objects in the target instance as defined on the Advanced Package Mapping page. When the mapping is complete, the Import and Install Packages page is displayed.

Important: Advanced Package Mapping modifies the system IDs in the target instance. You will need to update any Data Feeds and Web Service APIs that use these objects, with the new system IDs.

All objects from the source instance are installed in the target instance unless the object cannot be found or is flagged to not be installed in the target instance. The Log Messages section provides a list of conditions that may cause objects not to be installed. The Package Installation Log section displays a log entry.

1. From the menu bar, click > Application Builder > Install Packages.

2. In the Available Packages section, locate the package file that you want to install, and click Install.

3. In the Selected Components section, click the Lookup button to open the Package Selector window.

   • To select all components, select the top-level checkbox.

   • To install only specific global reports in an already installed application, select the checkbox associated with each report that you want to install.

   Note: Items in the package that do not match an existing item in the target instance are selected by default.

4. Under the Install Method drop-down menu, select an option for each selected component. To use the same Install Method for all selected components, select a method from the top-level drop-down list.

   Note: If you have any existing components that you do not want to modify, select Create New Only. You may have to modify those components after installing the package to use the changes made by the package.

5. To deactivate target fields and data-driven events that are not in the package, in the Post-Install Actions section, select the Deactivate target fields and data-driven events that are not in the package checkbox. To rename the deactivated target fields and data-driven events with a user-defined prefix, select the Apply a prefix to all deactivated objects checkbox, and enter a prefix. This can help you identify any fields or data-driven events that you may want to review for cleanup post-install.

6. Click Install.

7. Click OK.

1. From the menu bar, click > Application Builder > Install Packages.

2. In the Package Installation Log tab, click the package that you want to view.

3. In the Package Installation Log page, in the Object Details section, click View All Errors.

   Note: To view individual logs, in the Errors column of the log you want to view, click the Failures link or Warnings link. Clicking View All Errors, Failures, or Warnings opens the specific errors on a different page
   

4. Click Export to export the log file.

5. Click Close.
   

1. Go to the Manage Data Feeds page.

   1. From the menu bar, click .

   2. Under Integration, click Data Feeds.

2. In the Manage Data Feeds section, click Import.

3. Locate and select the Rapid7-1 Vulnerability 2024.03.dfx5 file for the data feed.

4. From the General tab in the General Information section, in the Status field, select Active.

5. Click the Transport tab. Complete the fields in the Transport Configuration section as follows: In the URL field, type: FTP full qualified URL of the Rapid7 report. In case of Archer SAAS instances, the FTP full qualified URL of the Rapid7 report should be ftp://ftp01/Rapid7/rapid7_vulns_report_latest.xml.

6. In the Username and Password fields, type the username and password of the FTP user that has read access to the Rapid7 report.

7. Verify that key field values are not missing from the data feed setup window.

8. Click Save.

9. Follow the steps from 1-8 for Rapid7-2 Hosts 2024.03.dfx5 and Rapid7-3 Vulnerability Scan Results 2024.03.dfx5 data feed files.

10. For Rapid7 Vulnerability Verified Status 2024.03.dfx5 , Click the Transport tab, Complete the fields in the Transport Configuration section as follows: In the URL field, type: YourServerName/VirtualDirectoryName/ws/search.asmx.

11. In the Username and Password fields, type the username and password of a Platform user that has API access and access to all the records on the Platform instance (from which the data feed is coming).

12. In the Instance field, type the name of the Platform instance from which the data feed is coming (this is the instance name as you enter it on the Login window).

13. The following are the mappings of the source and target fields of the data feeds.

Rapid7-1 Vulnerability 2024.03

Key Field:

Vulnerability Library: DFMKey

Vulnerability Reference Lists: URL

Rapid7-2 Hosts 2024.03

Key Field:

Devices: Device Unique Key

Note: The Rapid7 Hosts 2024.03 data feed has been provided with two DFM key values- DFMKey_DNS and DFMKey_IP with DFMKey_DNS being the default mapped value. 

Change the mapping of the DFM key field based on the following considerations:

1. DFMKey_IP – Use this field mapping in cases where the requirement is to create Device records for all IP addresses or there is no consistent DNS name resolution for Rapid7.

2. DFMKey_DNS- Use this field mapping in case the Device application is already populated with values or there are multi-home servers in the network and Device records are not needed to be created for all IPs’.

Rapid7-3 Vulnerability Scan Results 2024.03

Key Field:

Vulnerability Scan Results: DFMKey

Vulnerability Library Details: ID

Impacted Device: Rapid7 Device ID

Rapid7 Vulnerability Verified Status 2024.03

Key Field:

Vulnerability Scan Results: DFMKey

A data feed must be active and valid to successfully run. A successful data feed run processes all input data, completes all expected record updates, and does not report any failures in the Run Details Report.

A reference feed allows you to specify another feed. This indicates to the Data Feed Service that this feed will start running as soon as the referenced feed completes successfully.

1. Go to the Run Configuration tab > Schedule section.

2. Do one of the following to schedule your data feed.

   • Run on Schedule. You can configure your data feed to run on a defined schedule.

   • Run After. The Data Feed Services starts the current data feed after the referenced data feed completes successfully.

   • Run Now.

3. To save the data feed, click Save or Save and Close.

1. Login to Rapid7 InsightVM Security Console.

2. Click Report

3. Click Create a Report.

4. Select Export and select the report type as XML Export 2.0.

5. Select the scope of the report by selecting Assets, Groups or tags.

6. Select the Frequency as Run a recurring report on a schedule and select the time and frequency based on the requirements.

7. Click Save the report.

8. Navigate to the Reports home screen.

9. Click the Report Name.

10. The report will open in a new tab with the URL with the following format: ‘domain_name/report_ID/report_instance_id/report.xml. The prefixed zeroes should be ignored while selecting the report Id. For example, if the report URL is ‘<domain_name>/reports/00000002/000000A6/report.xml’, then the report ID is 2.

11. The Rapid7 Report endpoint format is ‘<domain_name>/api/<report_ID>/reports/1/history/latest/output’. The following is the URL for accessing report with Report ID 22. <domain_name>/api/3/reports/22/history/latest/output.The Rapid7 APIs provide basic authentication and valid Username and password are required for accessing the APIs.

1. Unzip the Rapid7 Console.zip file.

2. The unzipped folder should have the following contents:

   1. Rapid7.exe

   2. Rapid7.exe.config

3. Place the contents in the package in a location that has access to Rapid7 API.

4. The following table describes the options present in the Rapid7.exe.config file.

   Note: The Rapid7 console application requires the following access:

• Access to fetch Rapid7 API response

• CRUD access to the FTP server where API report must be created. For security reasons, basic authentication must be enabled in the FTP server.

1. Create a Task in Window Scheduler to execute the application daily at a desired time.

   Note: The Rapid7.exe.config file will be encrypted after the first execution of the console application.