What it does. Deploy and configure Rapid7 InsightVM Security Console and Scan Engines, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/implementing-rapid7-insightvm-for-scanning/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-rapid7-insightvm-for-scanning, or copy the skill folder into ~/.claude/skills/implementing-rapid7-insightvm-for-scanning/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-rapid7-insightvm-for-scanning/SKILL.md

SKILL.md (verbatim)

name: implementing-rapid7-insightvm-for-scanning
description: Deploy and configure Rapid7 InsightVM Security Console and Scan Engines,
  including scan templates, credentialed scanning, and Insight Agent integration, for
  authenticated and unauthenticated vulnerability scanning across enterprise environments.
  Use when standing up InsightVM infrastructure, configuring credentialed vulnerability
  scans, or integrating continuous asset assessment via the Insight Agent.
domain: cybersecurity
subdomain: vulnerability-management
tags:
- rapid7
- insightvm
- vulnerability-scanning
- nexpose
- scan-engine
- asset-discovery
- authenticated-scanning
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
mitre_attack:
- T1190
- T1203
- T1068

Implementing Rapid7 InsightVM for Scanning

Overview

Rapid7 InsightVM (formerly Nexpose) is an enterprise vulnerability management platform that combines on-premises scanning via Security Console and Scan Engines with cloud-based analytics through the Insight Platform. InsightVM leverages Rapid7's vulnerability research library, Metasploit exploit knowledge, global attacker behavior data, internet-wide scanning telemetry, and real-time reporting to provide comprehensive vulnerability visibility. This skill covers deploying the Security Console, configuring Scan Engines, setting up scan templates, credentialed scanning, and integrating with the Insight Agent for continuous assessment.

When to Use

• When deploying or configuring implementing rapid7 insightvm for scanning capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Server meeting minimum requirements: 16 GB RAM, 4 CPU cores, 500 GB disk (Security Console)
• Scan Engine: 8 GB RAM, 4 CPU cores, 100 GB disk
• Network access to target subnets (ports vary by scan type)
• Administrative credentials for authenticated scanning (SSH, WMI, SNMP)
• Rapid7 InsightVM license and Insight Platform account
• PostgreSQL database (bundled with Security Console)

Core Concepts

InsightVM Architecture Components

Security Console

The central management server that:

• Hosts the web-based management interface (default port 3780)
• Stores scan results in an embedded PostgreSQL database
• Manages Scan Engine deployments and scan schedules
• Generates reports and dashboards
• Connects to Rapid7 Insight Platform for cloud analytics

Note: Security Console is NOT supported in containerized environments.

Scan Engines

Distributed scanning components that:

• Perform active network scanning against target assets
• Can be deployed across network segments for segmented environments
• Available as container images on Docker Hub for flexible deployment
• Report results back to the Security Console

Insight Agent

Lightweight endpoint agent providing:

• Continuous vulnerability assessment without network scans
• Assessment of remote/roaming endpoints
• Complement to engine-based scanning for comprehensive coverage
• Real-time asset inventory updates

Scan Template Types

Template	Use Case	Depth
Discovery Scan	Asset inventory, host enumeration	Low
Full Audit without Web Spider	Standard vulnerability assessment	Medium
Full Audit Enhanced Logging	Deep assessment with verbose logging	High
HIPAA Compliance	Healthcare regulatory compliance	High
PCI ASV Audit	PCI DSS external scanning requirement	High
CIS Policy Compliance	Configuration benchmarking	Medium
Web Spider	Web application discovery and assessment	Medium

Workflow

Step 1: Install Security Console

# Download InsightVM installer (Linux)
chmod +x Rapid7Setup-Linux64.bin
./Rapid7Setup-Linux64.bin -c

# Verify service is running
systemctl status nexposeconsole.service

# Access web interface
# https://<console-ip>:3780

Initial configuration:

1. Navigate to https://localhost:3780
2. Complete the setup wizard with license key
3. Configure database settings (embedded PostgreSQL recommended)
4. Set administrator credentials
5. Activate Insight Platform connection for cloud analytics

Step 2: Deploy Distributed Scan Engines

# Install Scan Engine on remote server
./Rapid7Setup-Linux64.bin -c

# During installation, select "Scan Engine only"
# Pair with Security Console using shared secret

# Docker-based Scan Engine deployment
docker pull rapid7/insightvm-scan-engine
docker run -d \
  --name scan-engine \
  -p 40814:40814 \
  -e CONSOLE_HOST=<console-ip> \
  -e CONSOLE_PORT=3780 \
  -e ENGINE_NAME=DMZ-Scanner \
  -e SHARED_SECRET=<pairing-secret> \
  rapid7/insightvm-scan-engine

Pair engines in Security Console:

1. Administration > Scan Engines > New Scan Engine
2. Enter engine hostname/IP and port (default 40814)
3. Use shared secret for authentication
4. Verify connectivity status shows "Active"

Step 3: Configure Asset Discovery Sites

Site Configuration:
  Name:           Production-Network
  Scan Engine:    Primary-Engine-01
  Scan Template:  Full Audit without Web Spider

  Included Assets:
    - 10.0.0.0/8     (Internal network)
    - 172.16.0.0/12   (DMZ network)

  Excluded Assets:
    - 10.0.0.1        (Core router - fragile)
    - 10.0.100.0/24   (ICS/SCADA segment)

  Schedule:
    Frequency:    Weekly
    Day:          Sunday
    Time:         02:00 AM
    Max Duration: 8 hours

Step 4: Configure Authenticated Scanning

Windows Credentials (WMI)

Credential Type:    Microsoft Windows/Samba (SMB/CIFS)
Domain:             CORP.EXAMPLE.COM
Username:           svc_insightvm_scan
Password:           <service-account-password>
Authentication:     NTLM

Privilege Elevation:
  Type:   None (use domain admin or local admin)

Linux/Unix Credentials (SSH)

Credential Type:    Secure Shell (SSH)
Username:           insightvm_scan
Authentication:     SSH Key (preferred) or Password
SSH Private Key:    /opt/rapid7/.ssh/scan_key
Port:               22

Privilege Elevation:
  Type:             sudo
  sudo User:        root
  sudo Password:    <sudo-password>

Database Credentials

Credential Type:    Microsoft SQL Server
Instance:           MSSQLSERVER
Domain:             CORP
Username:           insightvm_db_scan
Authentication:     Windows Authentication

Credential Type:    Oracle
Port:               1521
SID:                ORCL
Username:           insightvm_scan

Step 5: Configure Scan Templates

Custom scan template for balanced scanning:

Template Name:      Enterprise-Standard-Scan

Service Discovery:
  TCP Ports:        Well-known (1-1024) + common services
  UDP Ports:        DNS(53), SNMP(161), NTP(123), TFTP(69)
  Method:           SYN scan (stealth)

Vulnerability Checks:
  Safe checks only: Enabled
  Skip potential:   Disabled
  Web spidering:    Disabled (separate template)
  Policy checks:    Enabled (CIS benchmarks)

Performance:
  Max parallel assets:     10
  Max requests per second: 100
  Timeout per asset:       30 minutes
  Retries:                 2

Step 6: Set Up Insight Agent Deployment

# Windows Agent Installation (via GPO or SCCM)
msiexec /i agentInstaller-x86_64.msi /quiet /norestart `
  CUSTOMTOKEN=<platform-token> `
  CUSTOMCONFIG=<agent-config>

# Linux Agent Installation
chmod +x agent_installer.sh
./agent_installer.sh install_start \
  --token <platform-token>

# Verify agent connectivity
# Check InsightVM console: Assets > Agent Management

Step 7: Configure Remediation Workflows

Remediation Project:
  Name:             Q1-2025-Critical-Remediation

  Scope:
    Severity:       Critical + High
    CVSS Score:     >= 7.0
    Assets:         Production-Network site

  Assignment:
    Team:           Infrastructure-Ops
    Due Date:       2025-03-31

  Tracking:
    Auto-verify:    Enabled (re-scan on next scheduled scan)
    Notification:   Email on overdue items
    Escalation:     Manager notification at 75% SLA

Step 8: API Integration for Automation

import requests
import json

class InsightVMClient:
    """Rapid7 InsightVM API v3 client for automation."""

    def __init__(self, console_url, api_key):
        self.base_url = f"{console_url}/api/3"
        self.session = requests.Session()
        self.session.headers.update({
            "Content-Type": "application/json",
            "Authorization": f"Bearer {api_key}"
        })
        self.session.verify = not os.environ.get("SKIP_TLS_VERIFY", "").lower() == "true"  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments

    def get_sites(self):
        """List all configured scan sites."""
        response = self.session.get(f"{self.base_url}/sites")
        response.raise_for_status()
        return response.json().get("resources", [])

    def start_scan(self, site_id, engine_id=None, template_id=None):
        """Trigger an ad-hoc scan for a site."""
        payload = {}
        if engine_id:
            payload["engineId"] = engine_id
        if template_id:
            payload["templateId"] = template_id

        response = self.session.post(
            f"{self.base_url}/sites/{site_id}/scans",
            json=payload
        )
        response.raise_for_status()
        return response.json()

    def get_asset_vulnerabilities(self, asset_id):
        """Retrieve vulnerabilities for a specific asset."""
        response = self.session.get(
            f"{self.base_url}/assets/{asset_id}/vulnerabilities"
        )
        response.raise_for_status()
        return response.json().get("resources", [])

    def get_scan_status(self, scan_id):
        """Check the status of a running scan."""
        response = self.session.get(f"{self.base_url}/scans/{scan_id}")
        response.raise_for_status()
        return response.json()

    def create_remediation_project(self, name, description, assets, vulns):
        """Create a remediation tracking project."""
        payload = {
            "name": name,
            "description": description,
            "assets": {"includedTargets": {"addresses": assets}},
            "vulnerabilities": {"includedVulnerabilities": vulns}
        }
        response = self.session.post(
            f"{self.base_url}/remediations",
            json=payload
        )
        response.raise_for_status()
        return response.json()


# Usage
client = InsightVMClient("https://insightvm-console:3780", "api-key-here")
sites = client.get_sites()
for site in sites:
    print(f"Site: {site['name']} - Assets: {site.get('assets', 0)}")

Best Practices

1. Deploy Scan Engines close to target networks to minimize scan traffic traversing firewalls
2. Use Insight Agents for roaming laptops and remote workers that are not always reachable by network scans
3. Combine agent-based and engine-based scanning for the most accurate vulnerability view
4. Configure scan blackout windows during business-critical hours to avoid operational impact
5. Use credential testing before full scans to validate authentication works
6. Enable safe checks to prevent accidental denial of service on production systems
7. Separate scan sites by network segment, business unit, or compliance scope
8. Leverage tag-based asset groups for dynamic reporting and remediation tracking

Common Pitfalls

• Running full scans during business hours causing network congestion or service degradation
• Using unauthenticated scans only, missing 60-80% of local vulnerabilities
• Not excluding fragile devices (printers, ICS/SCADA, medical devices) from aggressive scan templates
• Failing to distribute Scan Engines across network segments, causing firewall bottlenecks
• Ignoring scan engine resource utilization leading to incomplete scans
• Not configuring scan duration limits, allowing runaway scans to consume resources indefinitely

Related Skills

• performing-agentless-vulnerability-scanning
• building-vulnerability-data-pipeline-with-api
• implementing-wazuh-for-vulnerability-detection
• performing-remediation-validation-scanning

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

InsightVM Deployment and Scan Report Template

Deployment Summary

Field	Value
Console Version	[Version]
Console Hostname	[hostname:3780]
Total Scan Engines	[N]
Total Insight Agents	[N]
Total Sites Configured	[N]
Deployment Date	[YYYY-MM-DD]

Scan Engine Inventory

Engine Name	Location	IP Address	Status	Assets Covered
[Engine-1]	[DC-1]	[IP]	Active	[N]
[Engine-2]	[DMZ]	[IP]	Active	[N]

Site Configuration Summary

Site Name	Engine	Template	Schedule	Assets	Auth Scan
[Site-1]	[Engine]	[Template]	[Weekly]	[N]	[Yes/No]

Scan Results Summary

Metric	Value
Total Assets Scanned	[N]
Total Vulnerabilities	[N]
Critical	[N]
High	[N]
Medium	[N]
Low	[N]
Informational	[N]

Top 10 Critical Vulnerabilities

Rank	CVE	Title	CVSS	Affected Assets	Exploitable
1	[CVE-ID]	[Title]	[N.N]	[N]	[Yes/No]

Remediation Progress

Priority	Total	Remediated	In Progress	Overdue
Critical	[N]	[N]	[N]	[N]
High	[N]	[N]	[N]	[N]
Medium	[N]	[N]	[N]	[N]

references/api-reference.md (verbatim)

API Reference: Rapid7 InsightVM Vulnerability Scanning

Libraries Used

Library	Purpose
requests	HTTP client for InsightVM REST API v3
json	Parse scan results and vulnerability data
base64	Encode Basic Auth credentials
os	Read INSIGHTVM_URL, INSIGHTVM_USER, INSIGHTVM_PASS

Installation

pip install requests

Authentication

InsightVM API v3 uses HTTP Basic Authentication:

import requests
import os
from requests.auth import HTTPBasicAuth

INSIGHTVM_URL = os.environ.get("INSIGHTVM_URL", "https://insightvm.example.com:3780")
auth = HTTPBasicAuth(
    os.environ["INSIGHTVM_USER"],
    os.environ["INSIGHTVM_PASS"],
)

REST API v3 Endpoints

Method	Endpoint	Description
GET	/api/3/sites	List all scan sites
GET	/api/3/sites/{id}	Get site details
POST	/api/3/sites	Create a new site
GET	/api/3/sites/{id}/assets	List assets in a site
POST	/api/3/sites/{id}/scans	Launch a scan on a site
GET	/api/3/scans	List all scans
GET	/api/3/scans/{id}	Get scan status and details
GET	/api/3/assets	List all assets
GET	/api/3/assets/{id}	Get asset details
GET	/api/3/assets/{id}/vulnerabilities	Get vulnerabilities for asset
GET	/api/3/vulnerabilities	List all known vulnerabilities
GET	/api/3/vulnerabilities/{id}	Get vulnerability details
GET	/api/3/vulnerability_checks	List vulnerability checks
GET	/api/3/scan_engines	List scan engines
GET	/api/3/reports	List generated reports
POST	/api/3/reports	Create a report configuration
POST	/api/3/reports/{id}/generate	Generate a report
GET	/api/3/tags	List all tags
GET	/api/3/policies	List compliance policies

Core Operations

List Sites

resp = requests.get(
    f"{INSIGHTVM_URL}/api/3/sites",
    auth=auth,
    params={"page": 0, "size": 100},
    timeout=30,
    verify=True,
)
for site in resp.json().get("resources", []):
    print(f"Site: {site['name']} (ID: {site['id']}) — {site.get('description', '')}")

Launch a Scan

resp = requests.post(
    f"{INSIGHTVM_URL}/api/3/sites/{site_id}/scans",
    auth=auth,
    json={"engineId": engine_id},
    timeout=30,
    verify=True,
)
scan_id = resp.json()["id"]

Poll Scan Status

import time

while True:
    resp = requests.get(
        f"{INSIGHTVM_URL}/api/3/scans/{scan_id}",
        auth=auth,
        timeout=30,
        verify=True,
    )
    status = resp.json()["status"]
    if status in ("finished", "stopped", "error"):
        break
    time.sleep(30)

Get Asset Vulnerabilities

resp = requests.get(
    f"{INSIGHTVM_URL}/api/3/assets/{asset_id}/vulnerabilities",
    auth=auth,
    params={"page": 0, "size": 500},
    timeout=60,
    verify=True,
)
vulns = resp.json().get("resources", [])
for v in vulns:
    print(f"  {v['id']} — CVSS: {v.get('cvssV3Score', 'N/A')} — {v.get('status')}")

Get Vulnerability Details

resp = requests.get(
    f"{INSIGHTVM_URL}/api/3/vulnerabilities/{vuln_id}",
    auth=auth,
    timeout=30,
    verify=True,
)
vuln = resp.json()
# Fields: title, description, cvss, severity, publishedDate, references, exploits

Generate a Report

report_config = {
    "name": "Monthly Vuln Report",
    "format": "pdf",
    "scope": {"sites": [site_id]},
    "template": "audit-report",
}
resp = requests.post(
    f"{INSIGHTVM_URL}/api/3/reports",
    auth=auth,
    json=report_config,
    timeout=30,
    verify=True,
)
report_id = resp.json()["id"]

# Generate the report
requests.post(
    f"{INSIGHTVM_URL}/api/3/reports/{report_id}/generate",
    auth=auth,
    timeout=30,
    verify=True,
)

Pagination

All list endpoints support cursor-based pagination:

def paginate(endpoint, auth, params=None):
    params = params or {}
    params.setdefault("size", 500)
    page = 0
    while True:
        params["page"] = page
        resp = requests.get(endpoint, auth=auth, params=params, timeout=60, verify=True)
        data = resp.json()
        yield from data.get("resources", [])
        if page >= data.get("page", {}).get("totalPages", 1) - 1:
            break
        page += 1

Output Format

{
  "id": 12345,
  "status": "finished",
  "vulnerabilities": {
    "critical": 3,
    "severe": 12,
    "moderate": 45,
    "total": 60
  },
  "assets": 128,
  "startTime": "2025-01-15T08:00:00Z",
  "endTime": "2025-01-15T09:45:00Z",
  "engineName": "Local Scan Engine"
}

references/standards.md (verbatim)

Standards and References - Rapid7 InsightVM

Official Documentation

• InsightVM Product Page: https://www.rapid7.com/products/insightvm/
• InsightVM Quick Start Guide: https://docs.rapid7.com/insightvm/insightvm-quick-start-guide/
• InsightVM System Requirements: https://docs.rapid7.com/insightvm/system-requirements/
• InsightVM API v3 Documentation: https://help.rapid7.com/insightvm/en-us/api/index.html
• Insight Agent Documentation: https://docs.rapid7.com/insightvm/using-the-insight-agent-with-insightvm/

Scan Configuration References

• Scan Templates: https://docs.rapid7.com/insightvm/selecting-vulnerability-checks/
• Credential Configuration: https://docs.rapid7.com/insightvm/configuring-scan-credentials/
• Scan Scheduling: https://docs.rapid7.com/insightvm/configuring-scan-schedules/

Industry Standards

• NIST SP 800-115: Technical Guide to Information Security Testing and Assessment
• NIST SP 800-40 Rev 4: Guide to Enterprise Patch Management Planning
• PCI DSS v4.0 Req 11.3: External and internal vulnerability scanning
• CIS Controls v8.1 Control 7: Continuous Vulnerability Management
• ISO 27001:2022 A.8.8: Management of technical vulnerabilities

Compliance Scan Templates

Standard	InsightVM Template	Frequency
PCI DSS	PCI ASV External Audit	Quarterly
HIPAA	HIPAA Compliance	Quarterly
CIS Benchmarks	CIS Policy Compliance	Monthly
DISA STIG	DISA STIG Compliance	Monthly
NIST 800-53	Full Audit Enhanced	Quarterly

references/workflows.md (verbatim)

Workflows - Rapid7 InsightVM Deployment

Workflow 1: InsightVM Deployment Pipeline

┌──────────────────┐     ┌──────────────────┐     ┌──────────────────┐
│ Install Security │────>│ Deploy Scan      │────>│ Pair Engines     │
│ Console          │     │ Engines          │     │ with Console     │
└──────────────────┘     └──────────────────┘     └──────────────────┘
                                                          │
        ┌────────────────────────────────────────────────┘
        v
┌──────────────────┐     ┌──────────────────┐     ┌──────────────────┐
│ Configure Scan   │────>│ Set Up Credential│────>│ Create Sites &   │
│ Templates        │     │ Store            │     │ Asset Groups     │
└──────────────────┘     └──────────────────┘     └──────────────────┘
        │
        v
┌──────────────────┐     ┌──────────────────┐     ┌──────────────────┐
│ Schedule Scans   │────>│ Deploy Insight   │────>│ Configure        │
│                  │     │ Agents           │     │ Reports & Alerts │
└──────────────────┘     └──────────────────┘     └──────────────────┘

Workflow 2: Scan Execution Cycle

For each scheduled scan:
    1. Console dispatches scan job to assigned Scan Engine
    2. Engine performs host discovery (ARP, ICMP, TCP SYN)
    3. Engine fingerprints OS and services on discovered hosts
    4. Engine selects vulnerability checks based on fingerprint
    5. If credentials configured: authenticate and perform local checks
    6. Engine reports findings back to Console database
    7. Console correlates with previous scan data (new/fixed/unchanged)
    8. Console updates risk scores and remediation projects
    9. Notifications sent for new critical/high findings
   10. Dashboard and reports refreshed automatically

Workflow 3: Hybrid Scanning Strategy

┌─────────────────────────────────────────────────────┐
│                 Enterprise Network                    │
├─────────────────────────────────────────────────────┤
│                                                       │
│  ┌──────────────┐  Engine Scan   ┌────────────────┐ │
│  │ Data Center  │ <───────────── │ DC Scan Engine │ │
│  │ Servers      │                └────────────────┘ │
│  └──────────────┘                                    │
│                                                       │
│  ┌──────────────┐  Engine Scan   ┌────────────────┐ │
│  │ DMZ Servers  │ <───────────── │ DMZ Scan Engine│ │
│  └──────────────┘                └────────────────┘ │
│                                                       │
│  ┌──────────────┐  Agent-Based   ┌────────────────┐ │
│  │ Laptops /    │ <───────────── │ Insight Agent  │ │
│  │ Remote Users │                │ (on endpoint)  │ │
│  └──────────────┘                └────────────────┘ │
│                                                       │
│  ┌──────────────┐  Agent-Based   ┌────────────────┐ │
│  │ Cloud VMs    │ <───────────── │ Insight Agent  │ │
│  │ (AWS/Azure)  │                │ (on instance)  │ │
│  └──────────────┘                └────────────────┘ │
│                                                       │
│           All results ──> Security Console            │
│                        ──> Insight Platform (Cloud)   │
└─────────────────────────────────────────────────────┘

Workflow 4: Remediation Tracking

Phase	Action	Owner	Timeline
Discovery	Scan identifies vulnerability	InsightVM	Automated
Triage	Severity confirmed, assigned to team	Security Ops	24 hours
Remediation	Patch/config change applied	IT Operations	Per SLA
Validation	Re-scan confirms fix	InsightVM	Next scan cycle
Closure	Remediation project updated	Security Ops	Automated

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.