Rapid7 Nexpose

Vulnerability management solution to help reduce threat exposure.
This integration was integrated and tested with version 6.6.103 of Rapid7 Nexpose.

Configure Rapid7 InsightVM on Cortex XSOAR

1. Navigate to Settings > Integrations > Servers & Services.
2. Search for Rapid7 InsightVM.

3. Click Add instance to create and configure a new integration instance.

   Parameter	Required
   Server URL (e.g., https://192.0.2.0:8080)	True
   Username	True
   Password	True
   2FA Token	False
   Trust any certificate (not secure)	False
   Use system proxy settings	False

4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

nexpose-get-asset

Returns the specified asset.

Base Command

nexpose-get-asset

Input

Context Output

nexpose-get-asset-tags

Returns the specified tags for an asset.

Base Command

nexpose-get-asset-tags

Input

Context Output

Command example

!nexpose-get-asset-tags asset_id=1

Context Example

{
    "Nexpose":{
        "AssetTag":[
                {
                    "CreatedTime": "2023-00-00T00:00:00.000Z",
                    "Name": "Low",
                    "RiskModifier": "0.75",
                    "Type": "criticality"
                },
                {
                    "CreatedTime": "2023-00-00T00:00:00.000Z",
                    "Name": "FAKELOCATION",
                    "RiskModifier": null,
                    "Type": "location"
                },
                {
                    "CreatedTime": "2023-00-00T00:00:00.000Z",
                    "Name": "FAKEOWNER",
                    "RiskModifier": null,
                    "Type": "owner"
                },
                {
                    "CreatedTime": "2023-00-00T00:00:00.000Z",
                    "Name": "AWS",
                    "RiskModifier": null,
                    "Type": "custom"
                }
            ]
    }
}

Human Readable Output

Nexpose Asset Tags for Asset 1

Type	Name	Risk Modifier	Created Time
criticality	Low	0.75	2023-00-00T00:00:00.000Z
location	FAKELOCATION		2023-00-00T00:00:00.000Z
owner	FAKEOWNER		2023-00-00T00:00:00.000Z
custom	AWS		2023-00-00T00:00:00.000Z

nexpose-get-assets

Returns all assets for which you have access.

Base Command

nexpose-get-assets

Input

Context Output

Command example

!nexpose-get-assets limit=3

Context Example

{
    "Endpoint": [
        {
            "Hostname": "pool-96-252-18-158.bstnma.fios.verizon.net",
            "ID": 9,
            "IPAddress": "192.0.2.1",
            "Vendor": "Rapid7 Nexpose"
        },
        {
            "Hostname": "angular.testsparker.com",
            "ID": 11,
            "IPAddress": "192.0.2.2",
            "OS": "Ubuntu Linux",
            "Vendor": "Rapid7 Nexpose"
        },
        {
            "ID": 12,
            "IPAddress": "192.0.2.3",
            "OS": "Microsoft Windows",
            "Vendor": "Rapid7 Nexpose"
        }
    ],
    "Nexpose": {
        "Asset": [
            {
                "Address": "192.0.2.1",
                "Assessed": true,
                "AssetId": 9,
                "Exploits": 0,
                "LastScanDate": "2020-10-01T22:37:33.710Z",
                "LastScanId": 650,
                "Malware": 0,
                "Name": "pool-96-252-18-158.bstnma.fios.verizon.net",
                "OperatingSystem": null,
                "RiskScore": 0,
                "Site": "PANW",
                "Vulnerabilities": 0
            },
            {
                "Address": "192.0.2.2",
                "Assessed": true,
                "AssetId": 11,
                "Exploits": 2,
                "LastScanDate": "2022-11-02T14:54:19.055Z",
                "LastScanId": "-",
                "Malware": 0,
                "Name": "angular.testsparker.com",
                "OperatingSystem": "Ubuntu Linux",
                "RiskScore": 7718.4091796875,
                "Site": "PANW",
                "Vulnerabilities": 26
            },
            {
                "Address": "192.0.2.3",
                "Assessed": true,
                "AssetId": 12,
                "Exploits": 4,
                "LastScanDate": "2049-03-01T04:31:56Z",
                "LastScanId": "-",
                "Malware": 0,
                "Name": null,
                "OperatingSystem": "Microsoft Windows",
                "RiskScore": 18819.919921875,
                "Site": "PANW",
                "Vulnerabilities": 45
            }
        ]
    }
}

Human Readable Output

Nexpose Asset 12

AssetId	Address	Site	Exploits	Malware	OperatingSystem	Vulnerabilities	RiskScore	Assessed	LastScanDate	LastScanId
12	192.0.2.3	PANW	4	0	Microsoft Windows	45	18819.919921875	true	2049-03-01T04:31:56Z	-

nexpose-search-assets

Search and return all assets matching specific filters. Returns only assets the user has access to.

Base Command

nexpose-search-assets

Input

Context Output

Command example

!nexpose-search-assets match=all riskScoreHigherThan=1000 limit=3

Context Example

{
    "Endpoint": [
        {
            "Hostname": "angular.testsparker.com",
            "ID": 11,
            "IPAddress": "192.0.2.2",
            "OS": "Ubuntu Linux",
            "Vendor": "Rapid7 Nexpose"
        },
        {
            "ID": 12,
            "IPAddress": "192.0.2.3",
            "OS": "Microsoft Windows",
            "Vendor": "Rapid7 Nexpose"
        },
        {
            "Hostname": "57.27.185.35.bc.googleusercontent.com",
            "ID": 13,
            "IPAddress": "192.0.2.4",
            "OS": "Linux 2.6.18",
            "Vendor": "Rapid7 Nexpose"
        }
    ],
    "Nexpose": {
        "Asset": [
            {
                "Address": "192.0.2.2",
                "Assessed": true,
                "AssetId": 11,
                "Exploits": 2,
                "LastScanDate": "2022-11-02T14:54:19.055Z",
                "LastScanId": "-",
                "Malware": 0,
                "Name": "angular.testsparker.com",
                "OperatingSystem": "Ubuntu Linux",
                "RiskScore": 7718.4091796875,
                "Site": "PANW",
                "Vulnerabilities": 26
            },
            {
                "Address": "192.0.2.3",
                "Assessed": true,
                "AssetId": 12,
                "Exploits": 4,
                "LastScanDate": "2049-03-01T04:31:56Z",
                "LastScanId": "-",
                "Malware": 0,
                "Name": null,
                "OperatingSystem": "Microsoft Windows",
                "RiskScore": 18819.919921875,
                "Site": "PANW",
                "Vulnerabilities": 45
            },
            {
                "Address": "192.0.2.4",
                "Assessed": true,
                "AssetId": 13,
                "Exploits": 0,
                "LastScanDate": "2022-11-15T11:53:25.281Z",
                "LastScanId": "-",
                "Malware": 0,
                "Name": "57.27.185.35.bc.googleusercontent.com",
                "OperatingSystem": "Linux 2.6.18",
                "RiskScore": 1323.0916748046875,
                "Site": "PANW",
                "Vulnerabilities": 2
            }
        ]
    }
}

Human Readable Output

Nexpose Asset 13

AssetId	Address	Name	Site	Exploits	Malware	OperatingSystem	RiskScore	Assessed	LastScanDate	LastScanId
13	192.0.2.4	57.27.185.35.bc.googleusercontent.com	PANW	0	0	Linux 2.6.18	1323.0916748046875	true	2022-11-15T11:53:25.281Z	-

nexpose-get-scan

Get a specific scan.

Base Command

nexpose-get-scan

Input

Context Output

Command example

!nexpose-get-scan id=1

Context Example

{
    "Nexpose": {
        "Scan": {
            "Assets": 0,
            "Completed": "2019-12-03T20:48:01.368Z",
            "Id": 1,
            "Message": null,
            "ScanName": "Tue 03 Dec 2019 10:47 PM",
            "ScanType": "Manual",
            "StartedBy": null,
            "Status": "finished",
            "TotalTime": "51.316 seconds",
            "Vulnerabilities": {
                "Critical": 0,
                "Moderate": 0,
                "Severe": 0,
                "Total": 0
            }
        }
    }
}

Human Readable Output

Nexpose Scan ID 1

Id	ScanType	ScanName	Assets	TotalTime	Completed	Status
1	Manual	Tue 03 Dec 2019 10:47 PM	0	51.316 seconds	2019-12-03T20:48:01.368Z	finished

Vulnerabilities

Critical	Severe	Moderate	Total
0	0	0	0

nexpose-get-asset-vulnerability

Returns details and possible remediations for an asset’s vulnerability.

Base Command

nexpose-get-asset-vulnerability

Input

Context Output

Command example

!nexpose-get-asset-vulnerability id=1 vulnerabilityId=apache-httpd-cve-2017-15710

Context Example

{
    "CVE": {
        "CVSS": {
            "Score": 7.5,
            "Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "Version": "3"
        },
        "Description": "The affected asset is vulnerable to this vulnerability ONLY if it is running one of the following modules: mod_authnz_ldap. Review your web server configuration for validation. mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example, 'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the process would crash which could be used as a Denial of Service attack. In the more likely case, this memory is already reserved for future use and the issue has no effect at all.",
        "ID": "CVE-2017-15710",
        "Modified": "2020-01-30",
        "Published": "2018-03-26"
    },
    "DBotScore": {
        "Indicator": "CVE-2017-15710",
        "Score": 0,
        "Type": "cve",
        "Vendor": "Rapid7 Nexpose"
    },
    "Nexpose": {
        "Asset": {
            "AssetId": "1",
            "Vulnerability": [
                {
                    "Added": "2018-03-26",
                    "CVES": [
                        "CVE-2017-15710"
                    ],
                    "CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                    "CVSSScore": 5,
                    "CVSSV3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "CVSSV3Score": 7.5,
                    "Categories": [
                        "Apache",
                        "Apache HTTP Server",
                        "Denial of Service",
                        "LDAP",
                        "Web"
                    ],
                    "Check": [
                        {
                            "Port": 80,
                            "Proof": "Running HTTP serviceProduct HTTPD exists -- Apache HTTPD 2.4.29Vulnerable version of product HTTPD found -- Apache HTTPD 2.4.29",
                            "Protocol": "tcp",
                            "Since": "2020-10-01T22:40:08.844Z",
                            "Status": "vulnerable-version"
                        },
                        {
                            "Port": 8000,
                            "Proof": "Running HTTP serviceProduct HTTPD exists -- Apache HTTPD 2.4.29Vulnerable version of product HTTPD found -- Apache HTTPD 2.4.29",
                            "Protocol": "tcp",
                            "Since": "2020-10-01T22:40:08.844Z",
                            "Status": "vulnerable-version"
                        }
                    ],
                    "Id": "apache-httpd-cve-2017-15710",
                    "Modified": "2020-01-30",
                    "Published": "2018-03-26",
                    "RiskScore": 175.22,
                    "Severity": "Severe",
                    "Solution": [
                        {
                            "AdditionalInformation": "The latest version of Apache HTTPD is 2.4.48.\n\nMany platforms and distributions provide pre-built binary packages for Apache HTTP server. These pre-built packages are usually customized and optimized for a particular distribution, therefore we recommend that you use the packages if they are available for your operating system.",
                            "Estimate": "2 hours",
                            "Steps": "Download and apply the upgrade from: http://archive.apache.org/dist/httpd/httpd-2.4.48.tar.gz (http://archive.apache.org/dist/httpd/httpd-2.4.48.tar.gz)",
                            "Summary": "Upgrade to the latest version of Apache HTTPD",
                            "Type": "rollup-patch"
                        }
                    ],
                    "Title": "Apache HTTPD: Out of bound write in mod_authnz_ldap when using too small Accept-Language values (CVE-2017-15710)"
                }
            ]
        }
    }
}

Human Readable Output

Vulnerability apache-httpd-cve-2017-15710

Id	Title	Severity	RiskScore	CVSS	CVSSV3	Published	Added	Modified	CVSSScore	CVSSV3Score	Categories	CVES
apache-httpd-cve-2017-15710	Apache HTTPD: Out of bound write in mod_authnz_ldap when using too small Accept-Language values (CVE-2017-15710)	Severe	175.22	AV:N/AC:L/Au:N/C:N/I:N/A:P	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	2018-03-26	2018-03-26	2020-01-30	5.0	7.5	Apache, Apache HTTP Server, Denial of Service, LDAP, Web	CVE-2017-15710

Checks

Port	Protocol	Since	Proof	Status
80	tcp	2020-10-01T22:40:08.844Z	Running HTTP serviceProduct HTTPD exists – Apache HTTPD 2.4.29Vulnerable version of product HTTPD found – Apache HTTPD 2.4.29	vulnerable-version
8000	tcp	2020-10-01T22:40:08.844Z	Running HTTP serviceProduct HTTPD exists – Apache HTTPD 2.4.29Vulnerable version of product HTTPD found – Apache HTTPD 2.4.29	vulnerable-version

Solutions

Type	Summary	Steps	Estimate	AdditionalInformation
rollup-patch	Upgrade to the latest version of Apache HTTPD	Download and apply the upgrade from: http://archive.apache.org/dist/httpd/httpd-2.4.48.tar.gz (http://archive.apache.org/dist/httpd/httpd-2.4.48.tar.gz)	2 hours	The latest version of Apache HTTPD is 2.4.48. Many platforms and distributions provide pre-built binary packages for Apache HTTP server. These pre-built packages are usually customized and optimized for a particular distribution, therefore we recommend that you use the packages if they are available for your operating system.

nexpose-create-shared-credential

Create a new shared credential. For detailed explanation of all parameters of this command, see: https://help.rapid7.com/insightvm/en-us/api/index.html#operation/createSharedCredential

Base Command

nexpose-create-shared-credential

Input

Context Output

nexpose-create-site

Creates a new site with the specified configuration.

Base Command

nexpose-create-site

Input

Context Output

nexpose-create-vulnerability-exception

Create a new vulnerability exception.

Base Command

nexpose-create-vulnerability-exception

Input

Context Output

nexpose-delete-asset

Delete an asset.

Base Command

nexpose-delete-asset

Input

Context Output

There is no context output for this command.

Command example

!nexpose-delete-asset id=1

Human Readable Output

Asset 1 has been deleted.

nexpose-delete-scan-schedule

Delete a scheduled scan.

Base Command

nexpose-delete-scan-schedule

Input

Context Output

There is no context output for this command.

nexpose-delete-shared-credential

Note:
This command couldn’t have been tested on our side, and therefore could have issues. Please let us know if you encounter any bugs or issues.

Delete a shared credential.

Base Command

nexpose-delete-shared-credential

Input

Context Output

There is no context output for this command.

nexpose-delete-site-scan-credential

Note:
This command couldn’t have been tested on our side, and therefore could have issues. Please let us know if you encounter any bugs or issues.

Delete a site scan credential.

Base Command

nexpose-delete-site-scan-credential

Input

Context Output

There is no context output for this command.

nexpose-delete-site

Deletes a site.

Base Command

nexpose-delete-site

Input

Context Output

There is no context output for this command.

nexpose-delete-vulnerability-exception

Delete a vulnerability exception.

Base Command

nexpose-delete-vulnerability-exception

Input

Command example

!nexpose-delete-vulnerability-exception id=1

Human Readable Output

Vulnerability exception with ID 1 has been deleted.

nexpose-get-sites

Retrieves accessible sites.

Base Command

nexpose-get-sites

Input

Context Output

Command example

!nexpose-get-sites limit=5

Context Example

{
    "Nexpose": {
        "Site": [
            {
                "Assets": 4,
                "Id": 1,
                "LastScan": "2021-08-03T14:09:15.321Z",
                "Name": "Authenticated-Assets",
                "Risk": 20416,
                "Type": "static",
                "Vulnerabilities": 41
            },
            {
                "Assets": 18,
                "Id": 2,
                "LastScan": "2021-06-29T07:06:54.733Z",
                "Name": "PANW",
                "Risk": 213245,
                "Type": "static",
                "Vulnerabilities": 455
            },
            {
                "Assets": 10,
                "Id": 3,
                "LastScan": "2020-11-26T17:13:54.117Z",
                "Name": "Test",
                "Risk": 18820,
                "Type": "static",
                "Vulnerabilities": 45
            }
        ]
    }
}

Human Readable Output

Nexpose Sites

Id	Name	Assets	Vulnerabilities	Risk	Type	LastScan
1	Authenticated-Assets	4	41	20416.0	static	2021-08-03T14:09:15.321Z
2	PANW	18	455	213245.0	static	2021-06-29T07:06:54.733Z
3	Test	10	45	18820.0	static	2020-11-26T17:13:54.117Z

nexpose-get-report-templates

Returns all available report templates.

Base Command

nexpose-get-report-templates

Input

There are no input arguments for this command.

Context Output

Command example

#### Context Example

```json
{
    "Nexpose": {
        "Template": [
            {
                "Description": "Provides comprehensive details about discovered assets, vulnerabilities, and users.",
                "Id": "audit-report",
                "Name": "Audit Report",
                "Type": "document"
            },
            {
                "Description": "Compares current scan results to those of an earlier baseline scan.",
                "Id": "baseline-comparison",
                "Name": "Baseline Comparison",
                "Type": "document"
            },
            {
                "Description": "Provides a high-level view of security data, including general results information and statistical charts.",
                "Id": "executive-overview",
                "Name": "Executive Overview",
                "Type": "document"
            },
            {
                "Description": "Provides information and metrics about 10 discovered vulnerabilities with the highest risk scores.",
                "Id": "highest-risk-vulns",
                "Name": "Highest Risk Vulnerabilities",
                "Type": "document"
            },
            {
                "Description": "Lists results for standard policy scans (AS/400, Oracle, Domino, Windows Group, CIFS/SMB account). Does not include Policy Manager results.",
                "Id": "policy-eval",
                "Name": "Policy Evaluation",
                "Type": "document"
            },
            {
                "Description": "Provides detailed remediation instructions for each discovered vulnerability.",
                "Id": "remediation-plan",
                "Name": "Remediation Plan",
                "Type": "document"
            },
            {
                "Description": "Lists test results for each discovered vulnerability, including how it was verified.",
                "Id": "report-card",
                "Name": "Report Card",
                "Type": "document"
            }
        ]
    }
}

Human Readable Output

Nexpose Templates

Id	Name	Description	Type
audit-report	Audit Report	Provides comprehensive details about discovered assets, vulnerabilities, and users.	document
baseline-comparison	Baseline Comparison	Compares current scan results to those of an earlier baseline scan.	document
executive-overview	Executive Overview	Provides a high-level view of security data, including general results information and statistical charts.	document
highest-risk-vulns	Highest Risk Vulnerabilities	Provides information and metrics about 10 discovered vulnerabilities with the highest risk scores.	document
policy-eval	Policy Evaluation	Lists results for standard policy scans (AS/400, Oracle, Domino, Windows Group, CIFS/SMB account). Does not include Policy Manager results.	document
remediation-plan	Remediation Plan	Provides detailed remediation instructions for each discovered vulnerability.	document
report-card	Report Card	Lists test results for each discovered vulnerability, including how it was verified.	document

nexpose-create-asset

Create a new asset.

Base Command

nexpose-create-asset

Input

Context Output

Command example

!nexpose-create-asset site_id="1" date="2022-01-01T10:00:00Z" ip="192.0.2.0"

Context Example

{
    "Nexpose": {
        "Asset": {
            "id": 1
        }
    }
}

Human Readable Output

New asset has been created with ID 1.

nexpose-create-assets-report

Generates a new report on given assets according to a template and arguments.

Base Command

nexpose-create-assets-report

Input

Context Output

nexpose-create-sites-report

Generates a new report on given sites according to a template and arguments.

Base Command

nexpose-create-sites-report

Input

Context Output

nexpose-create-site-scan-credential

Note:
This command couldn’t have been tested on our side, and therefore could have issues. Please let us know if you encounter any bugs or issues.

Create a new site scan credential. For detailed explanation of all parameters of this command, see: https://help.rapid7.com/insightvm/en-us/api/index.html#operation/createSiteCredential

Base Command

nexpose-create-site-scan-credential

Input

Context Output

nexpose-create-scan-report

Generates a new report for a specified scan.

Base Command

nexpose-create-scan-report

Input

Context Output

Command example

!nexpose-create-scan-report scan=1 download_immediately=false

Context Example

{
    "Nexpose": {
        "Report": {
            "Format": "pdf",
            "ID": 3241,
            "InstanceID": 3212,
            "Name": "report 2022-11-30 09:25:36.359529"
        }
    }
}

Human Readable Output

Report Information

Format	ID	InstanceID	Name
pdf	3241	3212	report 2022-11-30 09:25:36.359529

nexpose-create-scan-schedule

Note:
This command couldn’t have been tested on our side, and therefore could have issues. Please let us know if you encounter any bugs or issues.

Create a new site scan schedule.

Base Command

nexpose-create-scan-schedule

Input

Context Output

nexpose-list-assigned-shared-credential

Retrieve information about shared credentials for a specific site.

Base Command

nexpose-list-assigned-shared-credential

Input

Context Output

Command example

!nexpose-list-assigned-shared-credential site_id=1 limit=3

Context Example

{
    "Nexpose": {
        "AssignedSharedCredential": [
            {
                "enabled": true,
                "id": 1,
                "name": "Test 1",
                "service": "ftp"
            },
            {
                "enabled": true,
                "id": 2,
                "name": "Test 2",
                "service": "ftp"
            },
            {
                "enabled": true,
                "id": 3,
                "name": "Test 3",
                "service": "ftp"
            }
        ]
    }
}

Human Readable Output

Nexpose Assigned Shared Credentials

Id	Name	Service	Enabled
1	Test 1	ftp	true
2	Test 2	ftp	true
3	Test 3	ftp	true

nexpose-list-vulnerability

Retrieve information about all or a specific vulnerability.

Base Command

nexpose-list-vulnerability

Input

Context Output

Command example

!nexpose-list-vulnerability limit=3

Context Example

{
    "Nexpose": {
        "Vulnerability": [
            {
                "added": "2018-05-16",
                "categories": [
                    "7-Zip"
                ],
                "cves": [
                    "CVE-2008-6536"
                ],
                "cvss": {
                    "v2": {
                        "accessComplexity": "L",
                        "accessVector": "N",
                        "authentication": "N",
                        "availabilityImpact": "C",
                        "confidentialityImpact": "C",
                        "exploitScore": 9.9968,
                        "impactScore": 10.0008,
                        "integrityImpact": "C",
                        "score": 10,
                        "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"
                    }
                },
                "denialOfService": false,
                "description": {
                    "html": "<p>Unspecified vulnerability in 7-zip before 4.5.7 has unknown impact and remote attack vectors, as demonstrated by the PROTOS GENOME test suite for Archive Formats (c10).</p>",
                    "text": "Unspecified vulnerability in 7-zip before 4.5.7 has unknown impact and remote attack vectors, as demonstrated by the PROTOS GENOME test suite for Archive Formats (c10)."
                },
                "exploits": 0,
                "id": "7-zip-cve-2008-6536",
                "malwareKits": 0,
                "modified": "2018-06-08",
                "pci": {
                    "adjustedCVSSScore": 10,
                    "adjustedSeverityScore": 5,
                    "fail": true,
                    "status": "Fail"
                },
                "published": "2009-03-29",
                "riskScore": 898.63,
                "severity": "Critical",
                "severityScore": 10,
                "title": "7-Zip: CVE-2008-6536: Unspecified vulnerability in 7-zip before 4.5.7"
            },
            {
                "added": "2018-05-16",
                "categories": [
                    "7-Zip",
                    "Remote Execution"
                ],
                "cves": [
                    "CVE-2016-2334"
                ],
                "cvss": {
                    "v2": {
                        "accessComplexity": "M",
                        "accessVector": "N",
                        "authentication": "N",
                        "availabilityImpact": "C",
                        "confidentialityImpact": "C",
                        "exploitScore": 8.5888,
                        "impactScore": 10.0008,
                        "integrityImpact": "C",
                        "score": 9.3,
                        "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"
                    },
                    "v3": {
                        "attackComplexity": "L",
                        "attackVector": "L",
                        "availabilityImpact": "H",
                        "confidentialityImpact": "H",
                        "exploitScore": 1.8346,
                        "impactScore": 5.8731,
                        "integrityImpact": "H",
                        "privilegeRequired": "N",
                        "scope": "U",
                        "score": 7.8,
                        "userInteraction": "R",
                        "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
                    }
                },
                "denialOfService": false,
                "description": {
                    "html": "<p>Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to execute arbitrary code via a crafted HFS+ image.</p>",
                    "text": "Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to execute arbitrary code via a crafted HFS+ image."
                },
                "exploits": 0,
                "id": "7-zip-cve-2016-2334",
                "malwareKits": 0,
                "modified": "2018-06-08",
                "pci": {
                    "adjustedCVSSScore": 9,
                    "adjustedSeverityScore": 5,
                    "fail": true,
                    "status": "Fail"
                },
                "published": "2016-12-13",
                "riskScore": 717.53,
                "severity": "Critical",
                "severityScore": 9,
                "title": "7-Zip: CVE-2016-2334: Heap-based buffer overflow vulnerability"
            },
            {
                "added": "2018-05-16",
                "categories": [
                    "7-Zip",
                    "Trojan"
                ],
                "cves": [
                    "CVE-2016-7804"
                ],
                "cvss": {
                    "v2": {
                        "accessComplexity": "M",
                        "accessVector": "N",
                        "authentication": "N",
                        "availabilityImpact": "P",
                        "confidentialityImpact": "P",
                        "exploitScore": 8.5888,
                        "impactScore": 6.443,
                        "integrityImpact": "P",
                        "score": 6.8,
                        "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"
                    },
                    "v3": {
                        "attackComplexity": "L",
                        "attackVector": "L",
                        "availabilityImpact": "H",
                        "confidentialityImpact": "H",
                        "exploitScore": 1.8346,
                        "impactScore": 5.8731,
                        "integrityImpact": "H",
                        "privilegeRequired": "N",
                        "scope": "U",
                        "score": 7.8,
                        "userInteraction": "R",
                        "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
                    }
                },
                "denialOfService": false,
                "description": {
                    "html": "<p>Untrusted search path vulnerability in 7 Zip for Windows 16.02 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.</p>",
                    "text": "Untrusted search path vulnerability in 7 Zip for Windows 16.02 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory."
                },
                "exploits": 0,
                "id": "7-zip-cve-2016-7804",
                "malwareKits": 0,
                "modified": "2018-06-08",
                "pci": {
                    "adjustedCVSSScore": 6,
                    "adjustedSeverityScore": 4,
                    "fail": true,
                    "specialNotes": "The presence of malware, including rootkits, backdoors, or trojan horse programs are a violation of PCI DSS, and result in an automatic failure. ",
                    "status": "Fail"
                },
                "published": "2017-05-22",
                "riskScore": 578.88,
                "severity": "Severe",
                "severityScore": 7,
                "title": "7-Zip: CVE-2016-7804: Untrusted search path vulnerability"
            }
        ]
    }
}

Human Readable Output

Nexpose Vulnerabilities

Title	MalwareKits	Exploits	CVSS	CVSSv3	Risk	PublishedOn	ModifiedOn	Severity
7-Zip: CVE-2008-6536: Unspecified vulnerability in 7-zip before 4.5.7	0	0	10.0		898.63	2009-03-29	2018-06-08	Critical
7-Zip: CVE-2016-2334: Heap-based buffer overflow vulnerability	0	0	9.3	7.8	717.53	2016-12-13	2018-06-08	Critical
7-Zip: CVE-2016-7804: Untrusted search path vulnerability	0	0	6.8	7.8	578.88	2017-05-22	2018-06-08	Severe

nexpose-list-scan-schedule

Note:
This command couldn’t have been tested on our side, and therefore could have issues. Please let us know if you encounter any bugs or issues.

Retrieve information about scan schedules for a specific site or a specific scan schedule.

Base Command

nexpose-list-scan-schedule

Input

Context Output

nexpose-list-shared-credential

Retrieve information about all or a specific shared credential.

Base Command

nexpose-list-shared-credential

Input

Context Output

Command example

!nexpose-list-shared-credential limit=3

Context Example

{
    "Nexpose": {
        "SharedCredential": [
            {
                "account": {
                    "authenticationType": "md5",
                    "privacyType": "no-privacy",
                    "service": "snmpv3",
                    "username": "test"
                },
                "id": 1,
                "name": "shared credentials",
                "siteAssignment": "specific-sites",
                "sites": [
                    1
                ]
            },
            {
                "account": {
                    "service": "as400",
                    "username": "test"
                },
                "id": 2,
                "name": "shared credentials",
                "siteAssignment": "specific-sites",
                "sites": [
                    1
                ]
            },
            {
                "account": {
                    "permissionElevation": "sudosu",
                    "permissionElevationUsername": "test",
                    "service": "ssh",
                    "username": "test"
                },
                "id": 3,
                "name": "shared credentials",
                "siteAssignment": "specific-sites",
                "sites": [
                    1
                ]
            }
        ]
    }
}

Human Readable Output

Nexpose Shared Credentials

Id	Name	Service	UserName
1	shared credentials	snmpv3	test
2	shared credentials	as400	test
3	shared credentials	ssh	test

nexpose-list-site-scan-credential

Note:
This command couldn’t have been tested on our side, and therefore could have issues. Please let us know if you encounter any bugs or issues.

Retrieve information about all or a specific sca credential.

Base Command

nexpose-list-site-scan-credential

Input

Context Output

nexpose-list-vulnerability-exceptions

Retrieve information about scan schedules for a specific site or a specific scan schedule.

Base Command

nexpose-list-vulnerability-exceptions

Input

Context Output

Command example

!nexpose-list-vulnerability-exceptions sort="submit.date,ASC" limit=3

Context Example

{
    "Nexpose": {
        "VulnerabilityException": [
            {
                "expires": "2028-03-01T04:31:56Z",
                "id": 1,
                "review": {
                    "comment": "Auto approved by submitter.",
                    "date": "2022-10-31T14:39:15.736Z",
                    "name": "admin",
                    "user": 1
                },
                "scope": {
                    "type": "global",
                    "vulnerability": "tlsv1_0-enabled"
                },
                "state": "approved",
                "submit": {
                    "date": "2022-06-29T16:10:06.616880Z",
                    "name": "admin",
                    "reason": "false positive",
                    "user": 1
                }
            },
            {
                "id": 2,
                "review": {
                    "date": "2022-10-30T13:54:31.084Z",
                    "name": "admin",
                    "user": 1
                },
                "scope": {
                    "type": "global",
                    "vulnerability": "php-cve-2018-10545"
                },
                "state": "rejected",
                "submit": {
                    "date": "2022-07-13T13:27:31.647402Z",
                    "name": "admin",
                    "reason": "acceptable use",
                    "user": 1
                }
            },
            {
                "id": 3,
                "scope": {
                    "type": "global",
                    "vulnerability": "cifs-smb-signing-disabled"
                },
                "state": "under review",
                "submit": {
                    "date": "2022-10-27T11:40:34.109268Z",
                    "name": "admin",
                    "reason": "acceptable use",
                    "user": 1
                }
            }
        ]
    }
}

Human Readable Output

Nexpose Vulnerability Exceptions

Id	Vulnerability	ExceptionScope	Reason	ReportedBy	ReviewStatus	ReviewedOn	ExpiresOn
1	tlsv1_0-enabled	global	false positive	admin	approved	2022-10-31T14:39:15.736Z	2028-03-01T04:31:56Z
2	php-cve-2018-10545	global	acceptable use	admin	rejected	2022-10-30T13:54:31.084Z
3	cifs-smb-signing-disabled	global	acceptable use	admin	under review

nexpose-start-site-scan

Starts a scan for the specified site.

Base Command

nexpose-start-site-scan

Input

Context Output

nexpose-stop-scan

Stop a running scan.

Base Command

nexpose-stop-scan

Input

nexpose-pause-scan

Pause a running scan.

Base Command

nexpose-pause-scan

Input

nexpose-resume-scan

Resume a paused scan.

Base Command

nexpose-resume-scan

Input

nexpose-get-scans

Return a list of scans. Returns only active scans by default (active=true).

Base Command

nexpose-get-scans

Input

Context Output

Command example

!nexpose-get-scans active=false limit=3

Context Example

{
    "Nexpose": {
        "Scan": [
            {
                "Assets": 0,
                "Completed": "2019-12-03T20:48:01.368Z",
                "Id": 1,
                "Message": null,
                "ScanName": "Tue 03 Dec 2019 10:47 PM",
                "ScanType": "Manual",
                "StartedBy": null,
                "Status": "finished",
                "TotalTime": "51.316 seconds"
            },
            {
                "Assets": 0,
                "Completed": "2019-12-03T20:53:09.453Z",
                "Id": 2,
                "Message": null,
                "ScanName": "Tue 03 Dec 2019 10:52 PM",
                "ScanType": "Manual",
                "StartedBy": null,
                "Status": "finished",
                "TotalTime": "29.91 seconds"
            },
            {
                "Assets": 0,
                "Completed": "2019-12-03T21:01:33.970Z",
                "Id": 3,
                "Message": null,
                "ScanName": "scan 2019-12-03 19:58:25.961787",
                "ScanType": "Manual",
                "StartedBy": null,
                "Status": "finished",
                "TotalTime": "28.904 seconds"
            }
        ]
    }
}

Human Readable Output

Nexpose Scans

Id	ScanType	ScanName	Assets	TotalTime	Completed	Status
1	Manual	Tue 03 Dec 2019 10:47 PM	0	51.316 seconds	2019-12-03T20:48:01.368Z	finished
2	Manual	Tue 03 Dec 2019 10:52 PM	0	29.91 seconds	2019-12-03T20:53:09.453Z	finished
3	Manual	scan 2019-12-03 19:58:25.961787	0	28.904 seconds	2019-12-03T21:01:33.970Z	finished

nexpose-disable-shared-credential

Note:
This command couldn’t have been tested on our side, and therefore could have issues. Please let us know if you encounter any bugs or issues.

Disable an assigned shared credential.

Base Command

nexpose-disable-shared-credential

Input

nexpose-download-report

Returns the generated report.

Base Command

nexpose-download-report

Input

Context Output

Command example

!nexpose-download-report report_id=1 instance_id=latest

Context Example

{
    "InfoFile": {
        "EntryID": "4127@403762e2-be4e-4f12-8a17-26cdb21b129e",
        "Extension": "pdf",
        "Info": "application/pdf",
        "Name": "report 2022-11-30 09:25:43.835638.pdf",
        "Size": 76699,
        "Type": "PDF document, version 1.4"
    }
}

nexpose-enable-shared-credential

Note:
This command couldn’t have been tested on our side, and therefore could have issues. Please let us know if you encounter any bugs or issues.

Enable an assigned shared credential.

Base Command

nexpose-enable-shared-credential

Input

nexpose-get-report-status

Returns the status of a report generation process.

Base Command

nexpose-get-report-status

Input

Context Output

Command example

!nexpose-get-report-status report_id=1 instance_id=latest

Context Example

{
    "Nexpose": {
        "Report": {
            "ID": "1",
            "InstanceID": "latest",
            "Status": "complete"
        }
    }
}

Human Readable Output

Report Generation Status

ID	InstanceID	Status
1	latest	complete

nexpose-update-scan-schedule

Note:
This command couldn’t have been tested on our side, and therefore could have issues. Please let us know if you encounter any bugs or issues.

Update an existing site scan schedule.

Base Command

nexpose-update-scan-schedule

Input

Context Output

There is no context output for this command.

nexpose-update-site-scan-credential

Note:
This command couldn’t have been tested on our side, and therefore could have issues. Please let us know if you encounter any bugs or issues.

Update an existing site scan credential. For detailed explanation of all parameters of this command, see: https://help.rapid7.com/insightvm/en-us/api/index.html#operation/setSiteCredentials.

Base Command

nexpose-update-site-scan-credential

Input

Context Output

There is no context output for this command.

nexpose-update-vulnerability-exception-expiration

Update an existing vulnerability exception.

Base Command

nexpose-update-vulnerability-exception-expiration

Input

Command example

!nexpose-update-vulnerability-exception-expiration id=1 expiration=2024-10-10T10:00:00Z

Human Readable Output

Successfully updated expiration date of vulnerability exception 1.

nexpose-update-vulnerability-exception-status

Update an existing vulnerability exception.

Base Command

nexpose-update-vulnerability-exception-status

Input

Command example

!nexpose-update-vulnerability-exception-status id=1 status=Approve

Human Readable Output

Successfully updated status of vulnerability exception 1.

nexpose-update-shared-credential

Update an existing shared credential.

Base Command

nexpose-update-shared-credential

Input

Context Output

There is no context output for this command.

nexpose-add-site-included-asset

Base Command

nexpose-add-site-included-asset

Input

Context Output

There is no context output for this command.

Command example

!nexpose-add-site-included-asset site_id=848 assets=8.8.8.8

Human Readable Output

Added assets 8.8.8.8 to site with ID 848

nexpose-remove-tag-asset

Remove an asset from a tag. Note that the asset must be added through the asset or tag. If the asset is added using a site, asset group, or search criteria, this action will not remove the asset from the tag.

Base Command

nexpose-remove-tag-asset

Input

Context Output

There is no context output for this command.

Command example

!nexpose-remove-tag-asset asset_id=25 tag_id=61

Human Readable Output

Asset 25 was removed from tag 61 successfully

nexpose-list-tag-asset

Return a list of assets for a tag.

Base Command

nexpose-list-tag-asset

Input

Context Output

Command example

!nexpose-list-tag-asset tag_id=33

Context Example

{
    "Nexpose": {
        "TagAsset": [
            {
                "id": 18,
                "sources": [
                    "tag"
                ]
            },
            {
                "id": 25,
                "sources": [
                    "tag"
                ]
            },
            {
                "id": 28,
                "sources": [
                    "tag"
                ]
            }
        ]
    }
}

Human Readable Output

Tag 33 assets

Id	Sources
18	tag
25	tag
28	tag

nexpose-delete-tag

Delete a tag.

Base Command

nexpose-delete-tag

Input

Context Output

There is no context output for this command.

nexpose-list-site-included-asset

Return a list of included assets for a site.

Base Command

nexpose-list-site-included-asset

Input

Context Output

Command example

!nexpose-list-site-included-asset site_id=848

Context Example

{
    "Nexpose": {
        "IncludedAsset": {
            "addresses": [
                "8.8.8.8",
                "1.1.1.1"
            ],
            "site_id": 848
        }
    }
}

Human Readable Output

Asset list for site ID 848

Addresses
8.8.8.8
1.1.1.1

nexpose-list-site-excluded-asset-group

Return a list of excluded asset groups for a site.

Base Command

nexpose-list-site-excluded-asset-group

Input

Context Output

Command example

!nexpose-list-site-excluded-asset-group site_id=848

Context Example

{
    "Nexpose": {
        "ExcludedAssetGroup": {
            "resources": [],
            "site_id": 848
        }
    }
}

nexpose-list-site-included-asset-group

Return a list of included asset groups for a site.

Base Command

nexpose-list-site-included-asset-group

Input

Context Output

Command example

!nexpose-list-site-included-asset-group site_id=848

Context Example

{
    "Nexpose": {
        "IncludedAssetGroup": {
            "resources": [],
            "site_id": 848
        }
    }
}

Human Readable Output

Asset group list for site ID 848

No entries.

nexpose-remove-tag-asset-group

Remove an asset group from a tag.

Base Command

nexpose-remove-tag-asset-group

Input

Context Output

There is no context output for this command.

Command example

!nexpose-remove-tag-asset-group asset_group_id=1 tag_id=61

Human Readable Output

Asset group 1 was removed from tag 61 successfully

nexpose-create-tag

Create a tag.

Base Command

nexpose-create-tag

Input

Context Output

nexpose-add-tag-asset

Add an existing asset to an existing tag.

Base Command

nexpose-add-tag-asset

Input

Context Output

There is no context output for this command.

Command example

!nexpose-add-tag-asset asset_id=25 tag_id=61

Human Readable Output

Asset 25 was added in tag 61 successfully

nexpose-remove-site-excluded-asset

Remove excluded assets from a site.

Base Command

nexpose-remove-site-excluded-asset

Input

Context Output

There is no context output for this command.

Command example

!nexpose-remove-site-excluded-asset site_id=848 assets=8.8.8.8

Human Readable Output

Removed assets 8.8.8.8 from site with ID 848

nexpose-remove-site-included-asset

Base Command

nexpose-remove-site-included-asset

Input

Context Output

There is no context output for this command.

Command example

!nexpose-remove-site-included-asset site_id=848 assets=8.8.8.8

Human Readable Output

Removed assets 8.8.8.8 from site with ID 848

nexpose-update-tag-search-criteria

Update tag search criteria.

Base Command

nexpose-update-tag-search-criteria

Input

Context Output

There is no context output for this command.

nexpose-add-tag-asset-group

Add existing asset groups to an existing tag.()

Base Command

nexpose-add-tag-asset-group

Input