Rapid7 InsightVM

The Rapid7 InsightVM connector allows you to retrieve your asset inventory and the vulnerabilities detected on them from the Rapid7 Command Platform directly into OverView for a consolidated view of your security posture.

Objective

The Rapid7 InsightVM connector retrieves the following information:

• Asset inventory (hostname, IP address, MAC address, operating system)
• Vulnerabilities detected on each asset, with their CVSS score, CVE identifiers and severity
• Ports assessed during the scan
• Rapid7 agent identifier, sites and asset tags

Prerequisites

• Access to the Rapid7 Command Platform
• A Vulnerability Management (InsightVM) user with the Read Only role, granted access to the sites containing the assets to import
• The cloud version of InsightVM — the connector uses the InsightVM Cloud API, not the API of an on-premises Security Console

Information to provide in OverView

Parameters

These parameters are optional. Leave them at their default value unless you have a specific reason to change them.

Procedure

Prepare a dedicated user

Create a user in Vulnerability Management (InsightVM) dedicated to the integration and assign it the Read Only role, granting it access to the sites containing the assets you want to import. Role assignment is performed by a Global Administrator. See the Rapid7 user management documentation for the detailed steps.

Generate an API key

1. Sign in to the Rapid7 Command Platform with that user.
2. From the left menu, click Administration.
3. Click API Key Management.
4. Click Generate New User Key.
5. Select the organization and enter a name for the key (e.g., "OverView Connector").
6. Generate the key, then copy it immediately — it can no longer be displayed once the window is closed.

The key inherits the permissions of the user who owns it, which keeps the integration limited to read access.

Identify your region

Your region is the prefix of the URL of any Rapid7 product you have access to. For a URL starting with eu., the region to enter is eu.

Configure the Connector in OverView

1. In OverView, go to Data Sources Settings > Sources.
2. Select Rapid7 and click Configure.
3. Fill in the required fields:
   • API Key
   • Region
4. Click Save Configuration.

View the InsightVM Cloud API documentation

Required Permissions

The API key authenticates with the X-Api-Key header and needs read access only. The two endpoints below are called with the same key.

A Read Only user only sees the sites and asset groups it has been granted access to. Any site not assigned to that user will be absent from the import.

Security Best Practices

• Use a dedicated user for the OverView integration rather than a personal account
• Grant read-only access — OverView never writes to your Rapid7 platform
• Prefer a user key over an organization key: an organization key grants access to every Rapid7 product in the organization, well beyond what the connector needs
• Rotate the key regularly according to your organization's security policy