rapid7appsec

Rapid7 AppSec integration allows the management of applications vulnerabilities and scans.
This integration was integrated and tested with version 1 of rapid7appsec.

Configure Rapid7AppSec in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

app-sec-vulnerability-update

Update the severity or The status of the vulnerability.

Base Command

app-sec-vulnerability-update

Input

Context Output

There is no context output for this command.

Command example

!app-sec-vulnerability-update vulnerability_id=1111 severity=High

Human Readable Output

Vulnerability “1111” was successfully updated.

app-sec-vulnerability-list

List vulnerabilities. Vulnerabilities are aspects of your app that can make it susceptible to attackers. If a vulnerability_id is given, the command will return the information about that specific vulnerability.

Base Command

app-sec-vulnerability-list

Input

Context Output

Command example

!app-sec-vulnerability-list limit=1

Context Example

{
    "Rapid7AppSec": {
        "Vulnerability": {
            "Variances": [
                {
                    "attack_id": "1111",
                    "id": "1111",
                    "message": "The form action points to an HTTP site",
                    "module_id": "1111",
                    "original_exchange_id": "1111",
                    "original_exchange_request": "test",
                    "proof": "",
                    "proof_description": "The form action points to an HTTP site"
                }
            ],
            "app_id": "1111",
            "first_discovered": "2023-07-24T13:40:07.64407",
            "id": "1111",
            "insight_ui_url": "test",
            "last_discovered": "2023-09-07T07:11:59.108573",
            "newly_discovered": false,
            "root_cause_method": "GET",
            "root_cause_url": "http://test/user/password",
            "severity": "HIGH",
            "status": "UNREVIEWED",
            "vector_string": "1111",
            "vulnerability_score": 2.8
        }
    }
}

Human Readable Output

Vulnerability

Id	App Id	Root Cause Url	Severity	Status	First Discovered	Last Discovered	Newly Discovered	Vulnerability Score
1111	1111	http://test/user/password	HIGH	UNREVIEWED	2023-07-24T13:40:07.64407	2023-09-07T07:11:59.108573	false	2.8

app-sec-vulnerability-history-list

List the history of changes for a vulnerability.

Base Command

app-sec-vulnerability-history-list

Input

Context Output

Command example

!app-sec-vulnerability-history-list vulnerability_id=1111

Context Example

{
    "Rapid7AppSec": {
        "VulnerabilityHistory": {
            "Changes": [
                {
                    "field": "SEVERITY",
                    "new_value": "HIGH",
                    "previous_value": "MEDIUM"
                }
            ],
            "create_time": "2023-09-10T10:20:29.202337",
            "id": "1111",
            "source_id": "1111",
            "source_type": "USER",
            "vulnerability_id": "1111"
        }
    }
}

Human Readable Output

Vulnerability History

Vulnerability Id	Id	Create Time	Source Id	Source Type	Changes
1111	1111	2023-09-10T10:20:29.202337	1111	USER	{‘field’: ‘SEVERITY’, ‘previous_value’: ‘MEDIUM’, ‘new_value’: ‘HIGH’}

app-sec-vulnerability-comment-create

Create a new vulnerability comment. A vulnerability comment is a resource that allows users to add context to the vulnerability.

Base Command

app-sec-vulnerability-comment-create

Input

Context Output

There is no context output for this command.

Command example

!app-sec-vulnerability-comment-create vulnerability_id=1111 comment_content="test"

Human Readable Output

Vulnerability Comment was successfully added to vulnerability “1111”.

app-sec-vulnerability-comment-update

Update an existing vulnerability comment.

Base Command

app-sec-vulnerability-comment-update

Input

Context Output

There is no context output for this command.

Command example

!app-sec-vulnerability-comment-update vulnerability_id=1111 comment_id=1111 comment_content="test2"

Human Readable Output

Vulnerability Comment “1111” was successfully updated.

app-sec-vulnerability-comment-delete

Delete an existing vulnerability comment.

Base Command

app-sec-vulnerability-comment-delete

Input

Context Output

There is no context output for this command.

Command example

!app-sec-vulnerability-comment-delete vulnerability_id=1111 comment_id=1111

Human Readable Output

Vulnerability Comment “1111” was successfully deleted.

app-sec-vulnerability-comment-list

List the vulnerability comments. If a comment_id is given, the command will return the information about the specific comment.

Base Command

app-sec-vulnerability-comment-list

Input

Context Output

Command example

!app-sec-vulnerability-comment-list vulnerability_id=1111

Context Example

{
    "Rapid7AppSec": {
        "VulnerabilityComment": [
            {
                "author_id": "1111",
                "content": "test",
                "create_time": "2023-09-10T10:20:38.784939",
                "id": "1111",
                "last_update_author_id": "1111",
                "update_time": "2023-09-10T10:20:38.784939",
                "vulnerability_id": "1111"
            },
            {
                "author_id": "1111",
                "content": "test",
                "create_time": "2023-09-10T10:23:19.119359",
                "id": "1111",
                "last_update_author_id": "1111",
                "update_time": "2023-09-10T10:23:19.119359",
                "vulnerability_id": "1111"
            }
        ]
    }
}

Human Readable Output

Vulnerability Comment

Content	Id	Vulnerability Id	Author Id	Create Time	Update Time
test	1111	1111	1111	2023-09-10T10:20:38.784939	2023-09-10T10:20:38.784939
test	1111	1111	1111	2023-09-10T10:23:19.119359	2023-09-10T10:23:19.119359

app-sec-attack-get

Get the metadata of an attack. AppSec can attempt multiple variations of the same attack on a URL to ensure the security of your applications against a variety of attacks.

Base Command

app-sec-attack-get

Input

Context Output

Command example

!app-sec-attack-get module_id=1111 attack_id=1111

Context Example

{
    "Rapid7AppSec": {
        "Attack": {
            "class": "Best Practice",
            "description": "test.",
            "id": "1111",
            "module_id": "1111",
            "type": "CSPHeaders"
        }
    }
}

Human Readable Output

Attack metadata

Id	Module Id	Type	Class	Description
1111	1111	CSPHeaders	Best Practice	test.

app-sec-attack-documentation-get

Get the documentation of an attack. The documentation contains the references and description about the attack and recommendations for handling it.

Base Command

app-sec-attack-documentation-get

Input

Context Output

Command example

!app-sec-attack-documentation-get module_id=1111 attack_id=1111

Context Example

{
    "Rapid7AppSec": {
        "AttackDocumentation": {
            "description": "test.",
            "id": "1111",
            "module_id": "1111",
            "recommendation": "test.",
            "references": {
                "test3": "test3",
                "test2": "test2",
                "test": "test"
            }
        }
    }
}

Human Readable Output

Attack Documentation

Module Id	Id	References	Description	Recommendation
1111	1111	test2: test test: test test3: test	test.	test.

app-sec-scan-submit

Submit a new scan. A scan encapsulates all the information for a single execution of the criteria defined in the provided scan configuration.

Base Command

app-sec-scan-submit

Input

Context Output

There is no context output for this command.

Command example

!app-sec-scan-submit scan_config_id=1111

Human Readable Output

Scan was successfully submitted.

app-sec-scan-action-get

Get any current scan action. Scan actions values are: “PAUSE”, “RESUME”, “STOP”, “AUTHENTICATE”, and “CANCEL”. Relevant when the scan is Running and when the scan is on an action (Scan is on an action when moving between statuses. For example: After submitting a new action, the scan has an action before the new status is updated).

Base Command

app-sec-scan-action-get

Input

Context Output

Command example

!app-sec-scan-action-get scan_id=1111

Context Example

{
    "Rapid7AppSec": {
        "Scan": {
            "action": "RESUME",
            "id": "1111"
        }
    }
}

Human Readable Output

Scan

Id	Action
1111	RESUME

app-sec-scan-action-submit

Submit a new scan action. Scan actions values are: “PAUSE”, “RESUME”, “STOP”, “AUTHENTICATE”, and “CANCEL”. Relevant when the scan status is Running. In case the action is Stop/ Cancel, the status of the scan should be Queued/ Pending/ Running/ Provisioning.

Base Command

app-sec-scan-action-submit

Input

Context Output

There is no context output for this command.

app-sec-scan-delete

Delete a scan. The scan must be FAILED or marked as FutureObsolete to be deleted.

Base Command

app-sec-scan-delete

Input

Context Output

There is no context output for this command.

Command example

!app-sec-scan-delete scan_id=1111

Human Readable Output

Scan “1111” was successfully deleted.

app-sec-scan-list

List scans. Scans attack the URLs in your app to identify behaviors that could be exploited by attackers. The specific attack types, URLs, and many other options are set in the scan configuration. If a scan_id is given, the command will return the information about the specific scan.

Base Command

app-sec-scan-list

Input

Context Output

Command example

!app-sec-scan-list limit=1

Context Example

{
    "Rapid7AppSec": {
        "Scan": {
            "app_id": "1111",
            "completion_time": "2023-09-07T07:12:57.372961",
            "id": "1111",
            "scan_config_id": "1111",
            "scan_type": "VERIFICATION",
            "status": "COMPLETE",
            "submit_time": "2023-09-07T06:58:18.724285",
            "submitter_id": "1111",
            "submitter_type": "USER",
            "validation_parent_scan_id": "1111"
        }
    }
}

Human Readable Output

Scan list

Id	Status	Scan Type	Submit Time	Completion Time	App Id	Scan Config Id	Submitter Id	Validation Parent Scan Id
1111	COMPLETE	VERIFICATION	2023-09-07T06:58:18.724285	2023-09-07T07:12:57.372961	1111	1111	1111	1111

app-sec-scan-engine-event-list

List the engine events from a scan. These logs typically capture specific events that occur during the scanning process.

Base Command

app-sec-scan-engine-event-list

Input

Context Output

Command example

!app-sec-scan-engine-event-list scan_id=1111

Context Example

{
    "Rapid7AppSec": {
        "EngineEvent": {
            "Event": [
                {
                    "event": "Initializing Scan",
                    "time": "2023-09-06T14:00:24"
                },
                {
                    "event": "Engine Version:  (64-bit)",
                    "time": "2023-09-06T14:00:24"
                }
            ],
            "scan_id": "1111"
        }
    }
}

Human Readable Output

Engine Event

Time	Event
2023-09-06T14:00:24	Initializing Scan
2023-09-06T14:00:24	Engine Version: (64-bit)

app-sec-scan-platform-event-list

List the platform events from a scan. Platform logs are broader in scope and usually cover various activities and events related to the platform hosting the security scanning tool.

Base Command

app-sec-scan-platform-event-list

Input

Context Output

Command example

!app-sec-scan-platform-event-list scan_id=1111

Context Example

{
    "Rapid7AppSec": {
        "PlatformEvent": {
            "Event": [
                {
                    "event": "Gathering Seed URLs from app",
                    "time": "2023-09-06T13:51:55.236413"
                },
                {
                    "event": "Gathering Seed URLs from scan config",
                    "time": "2023-09-06T13:51:55.242736"
                }
            ],
            "scan_id": "1111"
        }
    }
}

Human Readable Output

Platform Event

Time	Event
2023-09-06T13:51:55.236413	Gathering Seed URLs from app
2023-09-06T13:51:55.242736	Gathering Seed URLs from scan config

app-sec-scan-execution-details-get

Get real-time details of the execution of a scan (for example: Coverage, Attack, and Network details).

Base Command

app-sec-scan-execution-details-get

Input

Context Output

Command example

!app-sec-scan-execution-details-get scan_id=1111

Context Example

{
    "Rapid7AppSec": {
        "ExecutionDetail": {
            "attacked": 8860,
            "attacks_in_queue": 0,
            "drip_delay": 0,
            "failed_requests": 0,
            "id": "1111",
            "links_crawled": 151,
            "links_in_queue": 0,
            "logged_in": false,
            "network_speed": 215687,
            "requests": 2049,
            "vulnerable": 328
        }
    }
}

Human Readable Output

Execution Detail

Id	Logged In	Links In Queue	Links Crawled	Attacks In Queue	Attacked	Vulnerable	Requests	Failed Requests	Network Speed	Drip Delay
1111	false	0	151	0	8860	328	2049	0	215687	0

app-sec-scan-config-list

List the scan configuration. A scan configuration defines all the necessary information required to perform a scan of an app. If a scan_config_id is given, the command will return the information about the specific scan configuration. Mainly used to submit scans.

Base Command

app-sec-scan-config-list

Input

Context Output

Command example

!app-sec-scan-config-list limit=1

Context Example

{
    "Rapid7AppSec": {
        "ScanConfig": {
            "app_id": "1111",
            "assignment_environment": "CLOUD",
            "assignment_type": "ENGINE_GROUP",
            "attack_template_id": "1111",
            "id": "1111",
            "incremental": false,
            "name": "All Attack Modules (No Auth)"
        }
    }
}

Human Readable Output

Scan Config list

Id	Name	App Id	Incremental	Attack Template Id	Assignment Type	Assignment Environment
1111	All Attack Modules (No Auth)	1111	false	1111	ENGINE_GROUP	CLOUD

app-sec-app-list

List apps. An app owns scan configurations, schedules, scans, and vulnerabilities. Mainly used to understand vulnerabilities and scan configuration outputs. If an app_id is given, the command will return the information about the specific app.

Base Command

app-sec-app-list

Input

Context Output

Command example

!app-sec-app-list limit=1

Context Example

{
    "Rapid7AppSec": {
        "App": {
            "id": "1111",
            "name": "test"
        }
    }
}

Human Readable Output

App list

Id	Name
1111	test

app-sec-module-list

List the modules. If a module_id is given, the command will return the information about the specific module. Mainly used to understand the vulnerability outputs.

Base Command

app-sec-module-list

Input

Context Output

Command example

!app-sec-module-list limit=1

Context Example

{
    "Rapid7AppSec": {
        "Module": [
            {
                "description": "test..",
                "id": "1111",
                "name": "Brute Force (Form Auth)"
            },
            {
                "description": "Check for OpenSSL Heartbleed Vulnerability",
                "id": "1111",
                "name": "Heartbleed Check"
            }
        ]
    }
}

Human Readable Output

Module

Id	Name	Description
1111	Brute Force (Form Auth)	test..
1111	Heartbleed Check	Check for OpenSSL Heartbleed Vulnerability

app-sec-attack-template-list

List the attack templates. An attack template describes if and how attacks should be executed during the execution of a scan. Mainly used to understand the scan configuration outputs. If an attack_template_id is given, the command will return the information about the specific attack.

Base Command

app-sec-attack-template-list

Input

Context Output

Command example

!app-sec-attack-template-list limit=1

Context Example

{
    "Rapid7AppSec": {
        "AttackTemplate": {
            "advanced_attacks_enabled": false,
            "attack_prioritization": "SMART",
            "browser_encoding_enabled": false,
            "id": "1111",
            "name": "All API Modules",
            "system_defined": true
        }
    }
}

Human Readable Output

Attack Template list

Id	Name	System Defined	Browser Encoding Enabled	Attack Prioritization	Advanced Attacks Enabled
1111	All API Modules	true	false	SMART	false

app-sec-engine-list

List the engines. An engine encapsulates the state and high-level attributes of the components which may be installed and running on a specific on-premise host. If an engine_id is given, the command will return the information about the specific engine.

Base Command

app-sec-engine-list

Input

Context Output

Command example

!app-sec-engine-list limit=1

Context Example

{
    "Rapid7AppSec": {
        "Engine": {
            "auto_upgrade": true,
            "engine_group_id": "1111",
            "id": "1111",
            "latest_version": false,
            "name": "engine-test",
            "upgradeable": false
        }
    }
}

Human Readable Output

Engine

Id	Name	Engine Group Id	Latest Version	Upgradeable	Auto Upgrade
1111	engine-test	1111	false	false	true

app-sec-engine-group-list

List the engine groups. An engine group is a resource which defines a container for a logical grouping of engines and therefore the purpose of assigning scans to one of those engines. Mainly used to understand the scan configuration outputs. If an engine_group_id is given, the command will return the information about the specific engine group.

Base Command

app-sec-engine-group-list

Input

Context Output

Command example

!app-sec-engine-group-list limit=1

Context Example

{
    "Rapid7AppSec": {
        "EngineGroup": {
            "description": "string",
            "id": "1111",
            "name": "string"
        }
    }
}

Human Readable Output

Engine Group

Id	Name	Description
1111	string	string