Rapid7 InsightVM

runZero imports asset and vulnerability data from Rapid7 InsightVM through the InsightVM API.

runZero supports both Rapid7 InsightVM Cloud and on-premises InsightVM.

On-premises InsightVM

For an on-premises installation, run the InsightVM connector as a scan probe from a runZero Explorer with network access to the InsightVM deployment.

To set up the InsightVM integration, you’ll need to:

Create or obtain user credentials to use with the InsightVM API.
Add the InsightVM API username, password, and API URL in runZero.
Choose whether to run the integration as a scan probe or connector task.
Activate the InsightVM integration to pull your data into runZero.

Requirements

Before you set up the InsightVM integration:

Obtain credentials for an InsightVM user with administrator access to the InsightVM portal.
To use trusted authentication, scan your InsightVM with a runZero Explorer (optional).

Step 1: Add the InsightVM credentials to runZero

Create a new credential from the runZero Credentials page.
Provide a name for the credentials, like InsightVM.
Choose InsightVM Username & Password from the list of credential types.
Fill in these fields:
- InsightVM username - The username you use to connect to the InsightVM API. This account needs the User role or greater permissions in InsightVM.
- InsightVM password - The password for your InsightVM username.
- InsightVM API URL - The URL of your InsightVM API instance, in the form https://ip:3780 or https://domain.tld:3780. By default, the InsightVM API uses port 3780. runZero appends api/3/sites?size=500 to this URL automatically.
- InsightVM insecure - Set this to Yes to attempt authentication without a verified thumbprint.
- InsightVM thumbprints (optional) - A set of IP=SHA256:B64HASH or domain.tld=SHA256:B64HASH pairs to trust for authentication.
  - To get the TLS thumbprint, scan your InsightVM instance with runZero. The TLS fingerprints service attribute report lists all previously seen fingerprints.
  - If InsightVM insecure is set to No and you provide no thumbprints:
    - With a self-signed certificate, the connection fails because the certificate chain cannot be verified.
    - With a valid certificate from a public CA, the connection can work without thumbprints.
To let all other organizations use this credential, select the Make this a global credential option. Otherwise, you can grant access per organization.
Save the credential.

Step 2: Choose how to configure the Rapid7 integration

You can run the Rapid7 InsightVM integration as either a scan probe or a connector task. A scan probe gathers integration data during scan tasks. A connector task runs on its own, from the cloud or from one of your Explorers, and performs only the integration sync. A scan probe is the right option for most users. A connector works only if you self-host runZero or your InsightVM instance is publicly accessible.

Step 3: Sync your InsightVM data

After you add your InsightVM credential, activate the integration to sync your data.

Step 3a: Configure the InsightVM scan probe

Run the InsightVM integration as a scan probe to have the runZero Explorer pull your vulnerability data into the runZero Console.

In a new or existing scan configuration:

Set the INSIGHTVM option to Yes in the Probes and SNMP tab and change any default options as needed.
Set the correct InsightVM credential to Yes in the Credentials tab.
Set the severity and risk levels for ingested vulnerability scan results (optional).
Enter a Site Name Filter to filter results by InsightVM site using regular expressions (optional).

Step 3b: Configure the InsightVM connector

A connection needs a schedule and a site. The schedule sets when the sync runs, and the site is where runZero creates any new InsightVM-only assets.

Activate a connection to InsightVM. You can reach every available third-party connection from the integrations page, your inventory, or the tasks page.
Choose the credentials you added earlier. If they are not listed, check that the credentials have access to the organization you are in.
Set the severity and risk levels you want to import (optional).
Enter a Site Name Filter to limit your results to specific sites (optional). The filter is a regular expression and supports the re2 syntax.
Set the Fingerprint only toggle to Yes to ingest vulnerability records for fingerprint analysis without storing them in your runZero vulnerability inventory (optional).
Enter a name for the task, like InsightVM sync (optional).
Choose the Explorer to run this connector task from (optional).
Choose the site to add your assets to. runZero stores all newly discovered assets in this site.
Enter a description for the task (optional).
To leave out assets that runZero has not scanned, switch the Exclude unknown assets toggle to Yes. By default, the integration includes them.
Schedule the sync to run once or on a recurring schedule. The schedule starts on the date and time you set.
Activate the connection when you are done. The sync runs on the defined schedule, and the Scheduled tasks page shows when the next sync will occur.

Step 4: View InsightVM assets and vulnerabilities

After a successful sync, go to your inventory to view your InsightVM assets. They show a Rapid7 icon in the Source column.

The integration also gathers the vulnerabilities InsightVM detected. Go to Inventory > Vulnerabilities to view the vulnerability data from InsightVM. To search and filter those results, use the vulnerability instance inventory keywords.

To filter to Rapid7 assets, run this query:

View all Rapid7 assets:
```
source:Rapid7
```

Click an asset to see its attributes. runZero shows the attributes gathered from the Rapid7 scan data.

Troubleshooting

If you are having trouble with this integration, the questions and answers below may help.

Why is the Rapid7 InsightVM integration unable to connect?

Check whether the Rapid7 InsightVM integration is returning any data.
- Query the inventory rather than the task details to review all the data available from this integration.
- In some cases, an integration’s configuration limits how much data reaches the runZero console.
Some integrations require specific actions that are easy to overlook. If you miss a step during setup, the integration may not work correctly. Review this page and follow the steps exactly.
If the Rapid7 InsightVM integration can’t connect, check the task log for errors. Common errors include:
- 500: server error, unable to connect to the endpoint
- 404: hitting an unknown endpoint on the server
- 403: not authorized, likely a credential issue

How can I get a TLS thumbprint for the InsightVM credential?

These example commands calculate your TLS thumbprint, where <IP address> is the IP address of your InsightVM instance:

$ (echo|openssl s_client -connect <IP address>:3780 -showcerts 2>/dev/null) | openssl x509 -inform PEM -outform DER |  openssl dgst -sha256 -binary | base64

The commands return a value like this: X1NWttnkIQprK6zSre/VweKpbRlj7Dt4M6hNfUacytE= Use the following entry for the corresponding TLS thumbprint: 192.168.0.3:3780=SHA256:X1NWttnkIQprK6zSre/VweKpbRlj7Dt4M6hNfUacytE=

InsightVM Cloud

The Rapid7 InsightVM Cloud integration enriches your runZero inventory with data from the Rapid7 InsightVM Cloud service.

To set up the Rapid7 InsightVM Cloud integration, you’ll need to:

Create or obtain a Rapid7 Platform API Key to use with the Insight API.
Create a credential in runZero with the Rapid7 Platform API Key.
Choose whether to run the integration as a scan probe or connector task.
Activate the integration to pull your data into runZero.

Step 1: Add the Rapid7 Platform API credentials to runZero

Create a new credential from the runZero Credentials page.
Provide a name for the credential, like Rapid7 InsightVM Cloud.
Choose InsightVM Cloud API Key from the list of credential types.
Fill in these fields:
- InsightVM API Key - The API key for your InsightVM account.
- InsightVM Host - The host of your InsightVM API instance. Use the hostname only, for example, “us2.api.insight.rapid7.com”.
To let all other organizations use this credential, select the Make this a global credential option. Otherwise, you can grant access per organization.
Save the credential.

Step 2: Choose how to configure the Rapid7 integration

Step 3: Sync your InsightVM data

After you add your InsightVM credential, activate the integration to sync your data.

Step 3a: Configure the InsightVM Cloud scan probe

Run the InsightVM integration as a scan probe to have the runZero Explorer pull your vulnerability data into the runZero Console.

In a new or existing scan configuration:

Set the INSIGHTVMCLOUD option to Yes in the Probes and SNMP tab and change any default options as needed.
Set the correct InsightCloud credential to Yes in the Credentials tab.
Set the severity and risk levels for ingested vulnerability scan results (optional).

Step 3b: Configure the InsightVM connector

A connector needs a schedule and a site. The schedule sets when the sync runs, and the site is where runZero creates any new InsightVM-only assets.

Activate a connection to InsightVM Cloud. You can reach every available third-party connection from the integrations page, your inventory, or the tasks page.
Choose the credential you added earlier. If it is not listed, check that the credential has access to the organization you are in.
Set the severity and risk levels you want to import (optional).
Enter a name for the task, like InsightVM Cloud sync (optional).
Choose the Explorer to run this connector task from (optional).
Choose the site to add your assets to. runZero stores all newly discovered assets in this site.
Enter a description for the task (optional).
To leave out assets that runZero has not scanned, switch the Exclude unknown assets toggle to Yes. By default, the integration includes them.
Schedule the sync to run once or on a recurring schedule. The schedule starts on the date and time you set.
Activate the connection when you are done. The sync runs on the defined schedule, and the Scheduled tasks page shows when the next sync will occur.

Updated September 17, 2026

← Rapid7

Nexpose →