Before you run the integration on your instance, the installation and configuration steps must be completed so the Rapid7 Nexpose or Rapid7 InsightVM product properly integrates with Vulnerability Response. This application is available as a separate subscription.

1. Log in to the instance you want to install the Rapid7 Vulnerability Integration application on.
2. For the Rapid7 Nexpose data warehouse vulnerability integration, install the PostgreSQL JAR file.
   1. In your ServiceNow instance, navigate to MID Server > JAR Files.
   2. Click New.
   3. Enter the name of the PostgresSQL driver that you downloaded earlier.
      Optionally, enter the Version, Source, and Description information. Leave the Active check box selected.
   4. Attach the downloaded JAR file using the paper clip icon in the header.
   5. Click Submit.
   This process completes the Rapid7 Nexpose data warehouse-specific integration tasks.
3. Navigate to the ServiceNow Store.
4. In the ServiceNow Store, search for the Rapid7 Vulnerability Integration application.
5. Click the application tile.
   Detailed information about the application you are installing is displayed.

   Note: Consider reading the Other Requirements and Dependencies sections, as applicable.
6. Click Request App and enter your HI login credentials.
7. Click Get.
8. Enter the Instance Name and Reason for the Instance, and click Validate Instance.
9. Click Request.
   You will receive an email with detailed installation instructions.
10. Navigate to System Applications > Applications.
11. Locate the application, select it, and click Install.
    Your application is automatically installed on your instance.

    The vulnerability admin can now configure the application.

12. Once the installation completes, navigate to Rapid7 > Configuration.
13. Select an Integration Type from the drop-down menu.

    

    

14. Version 9.0: Select an integration instance. The default Rapid7 InsightVM integration instance is selected by default. If that is the one you want, go to step 15.
    For multiple deployments of the Rapid7 InsightVM integrations:
    1. Open the Lookup list on Integration Instance field, select an existing integration instance and go to step 15, or click New in the pop-up menu.
    2. For New, enter a Name for the integration instance and click Submit.
       The integration instance appears in the Rapid7 configuration form.

       Note: You can delete any integration instance except the default. Deleting an instance deletes the following (excluding VIs):

       • Integrations
       • Instance Parameters
       • Integration Runs
       • Integration Processes
       • Instance column on the VI is marked empty
    3. Continue to step 15.
15. Click the Integration Setup tab.
16. On the appropriate form, fill in the fields:

    Table 1. Integration Setup tab for InsightVM

    Field	Description
    InsightVM Region	The server URL you acquired from the Rapid7 site.
    API Key	The API key you acquired from your Rapid7 Insight account.
    Validation Status	Read only: Status of credential validation process.

    Table 2. Integration Setup tab for Data Warehouse

    Field	Description
    JDBC credential name	Name of your data warehouse credentials.
    User name	Rapid7 Data warehouse user name.
    Password	Rapid7 Data warehouse password.
    Validation Status	Read only: Status of credential validation process.
    Database server DNS/IP	DNS or IP address for your data warehouse.
    Database port	Port to use for your data warehouse integration.
    Database name	Name of your data warehouse.
    Data delay offset (Days)	The data delay offset factors in the delay between the real-time data in Rapid7 Nexpose and the data in the data warehouse.
    MID Server	MID Server to use. Only standalone MID servers are supported. Clustered MID servers are not supported.
    MID Server timeout (min)	Number of minutes to wait for the MID Server to respond before timing out the integration run.

17. Click Save.
18. Verify successful configuration by clicking Test credentials.
    Configuration is successfully completed unless an error message is displayed.
    If an error message is displayed during the configuration, reenter your data.
19. Click the Import Configuration tab.
20. On the appropriate form, fill in the fields.

    Table 3. Import Configuration tab for InsightVM

    Field	Description
    Version 9.0: Min CVSS score	Minimum vulnerable item CVSS score used to filter vulnerable items during import.
    Version 9.0: Max CVSS score	Maximum vulnerable item CVSS score used to filter vulnerable items during import.
    Version 9.0: Site filter	Limits the data to the Rapid7 InsightVM sites chosen from the Sites list. You can choose more than one. The default (empty) is all sites. Note: Sites for Rapid7 InsightVM must be created manually in order to use this feature. See Create sites for Rapid7 InsightVM for more information. For information on using site filtering, see Filtering by Rapid7 sites.
    Version 8.0: Create CVE entry	When checked, placeholders for CVEs, not already present, are created as NVD records and referenced in the third-party entry for Rapid7. When unchecked, these CVEs are ignored. Note: In version 9.0, CVE records, not already present, are created as NVD records and referenced in the third-party entry for Rapid7, by default.
    Close by age (Deprecated)	Date after which the scheduled job, Check Close Vul Item By Age, closes the record. When selected, the choices are 30, 60, or 90 days from the Last Found date.
    v 10.3: Reopen resolved by age	When selected, vulnerable items are automatically reopened when the number of days they have been resolved but not closed matches the value displayed in the Reopen resolved after field.

    Table 4. Import Configuration tab for Data Warehouse

    Field	Description
    Version 8.0: Create CVE entry check box	When checked, placeholders for CVEs, not already present, are created as NVD records and referenced in the third-party entry for Rapid7. When unchecked, these CVEs are ignored. Note: In version 9.0, CVE records, not already present, are created as NVD records and referenced in the third-party entry for Rapid7, by default.
    Min CVSS score	Minimum vulnerable item CVSS score used to filter vulnerable items during import.
    Max CVSS score	Maximum vulnerable item CVSS score used to filter vulnerable items during import.
    Site filter	Limits the imported Sites Integration data to the sites chosen. You can choose more than one. Note: Since the default setting is to import data from all sites, you do not need to use the filter if you want all sites. Doing so slows down the request.
    Close by age check box (Deprecated)	Date after which the scheduled job, Check Close Vul Item By Age, closes the record. When selected, the choices are 30, 60, or 90 days from the Last Found date.
    v 10.3: Reopen resolved by age	When selected, vulnerable items are automatically reopened when the number of days they have been resolved but not closed matches the value displayed in the Reopen resolved after field.

21. Click Save.

    The Import since date field in the Rapid7 integrations is blank, by default, except for the Rapid7 Vulnerability Integration - API and the Rapid7 Vulnerable Item Integration - API. For these integrations, these fields are set to 1998-12-31 or 1999-01-01.

    To retrieve historical data during your initial import from the Rapid7 scan, set a start date in the appropriate integration records. This process works for any Rapid7 integration with the following exceptions:

    • The Rapid7 Exploit and Malware Kit integrations do not show the Import since field, because they do not do delta updates and therefore do not use that field.
    • The Rapid7 Asset List integration ignores the field since its intent is to retrieve all data.
    • For the initial run of the Rapid7 InsightVM Comprehensive Vulnerable Item Integration – API when the Auto-Close Stale Vulnerable Items module is enabled and the Import since field is left blank.

      Starting with v10.3, when you enable the Automatically close stale Vulnerability Response vulnerable items feature, a successful run from the Rapid7 Comprehensive Vulnerable Item Integration or the Rapid7 Comprehensive Vulnerable Item Integration - API is required. These integrations are disabled by default.

      When you enable the Rapid7 InsightVM Comprehensive Vulnerable Item Integration – API, if you leave the Import since field blank on the integration configuration page, the value in the days ago field of the Auto-Close Stale Vulnerable Items form is also used for the Import since date on the first integration run. The default value for Auto-Close Stale Vulnerable Items is (90 days).

      For example, if the days ago field in the Auto-Close Stale Vulnerable Items form is 90, and the Import since field on the Rapid7 Comprehensive Vulnerable Item Integration – API configuration page is blank, the first integration run imports the data for the last 90 days.

      This relationship between the Import since and days ago fields applies only to the first integration run. After that, changing the days ago field on the Auto-Close Stale Vulnerable Items form doesn’t affect the Import since field on the Rapid7 Comprehensive Vulnerable Item Integration – API configuration page. The field is changed to the first run’s start time so that the subsequent integration runs import only the delta information

      The Import since field is editable, and you can enter whatever values you want for each of the integrations. To edit the Import since field, follow these steps.

    1. Navigate to Rapid 7 > Administration > Integrations
    2. Select, for example, Rapid7 Vulnerable Item Integration - API.
    3. Set the Import since field to the earliest date you want to retrieve. Each successful import resets this date to that day's date and time.
    Your Rapid7 Vulnerability Integration configuration is complete.