What Is Automated Vulnerability Remediation (AVR)?
AVR allows you to bridge the gap that exists between vulnerability discovery and vulnerability remediation. AVR allows you to do the following:
Automatically ingest prioritized vulnerabilities from InsightVM’s Platform API into the Automox console
Extend remediation actions through Worklets using Rapid7 vulnerability solution details, moving remediation possibilities beyond patching alone
Identify coverage gaps in managed devices between Rapid7’s InsightVM API and the Automox console
Using Automated Vulnerability Remediation
Follow these requirements and configuration steps to ensure the integration with Rapid7 is successful.
Note:
You have zone administrator or zone operator permissions for the zone where the devices are located.
Your zone is under a “Complete” plan that includes AVR.
Requirements
To use AVR, you need the following information:
Your active Rapid7 license for InsightVM (Cloud Enabled)
Your active Rapid7 Insight Platform API key
Rapid7 Insight Platform region information
You have an active Automox license that includes AVR
Prerequisites for Rapid7 Connection Configuration
Prior to configuring a connection to Rapid7 InsightVM from within Automox, it is first necessary to collect the information needed to save a connection. This includes generating a Rapid7 Insight Platform API key and identifying the appropriate Rapid7 region.
Using an administrator account, login to the Rapid7 Insight Platform at https://insight.rapid7.com/platform#/
After logging in, capture the region information (you will need this later) and click the gear icon (⚙) to reveal the API Keys sub-menu. Click API Keys to continue.
Click New User Key
To generate a new user key, select an Organization from the drop-down menu and assign a Name to that organization.
Click Generate.
Copy the API key from the dialog window. This is needed to configure the provider connection in a later step. When you are finished, click Done.
Getting Started
Follow these two steps to set up the automated vulnerability remediation integration with Rapid7. After you complete these steps, remediations are pulled into Automox on a recurring basis.
Creating a Connection to the Rapid7 Platform API
Creation of an Integration Configuration defining Asset and Vulnerability scope
Creating a Connection
Start in the Automox console to create a connection.
From the Automox console, select Manage → Remediations. If you do not see the Remediations option, ensure that your account includes AVR (contact Automox Support).
From the Import drop-down menu, select Third Party Integration.
From the Integration Provider drop-down menu, select Rapid7 InsightVM. Click Next.
Follow these steps to configure the connection:
Select Create a new connection. Make sure you have the required information ready.
In the Connection Name field, enter a descriptive instance name. (For example, for customers with multiple organizations or regions: division01-us3 an division02-us2).
Enter the Rapid7 API key.
Select the region from the Rapid7 Region menu.
Click Next.
Because connections are reusable, these steps only need to be performed more than once if there are multiple Rapid7 organizations in the environment. If only a single connection is necessary, select the existing connection from the Connection drop-down menu.
Creating a Configuration
After creating or selecting a connection, define the configuration settings.
See “What is Asset Tagging?” on the Rapid7 InsightVM Academy for information about R7 Asset Tags.
Enter a descriptive Configuration Name.
Add any Rapid7 Asset Tags that you would like to scope from Rapid7. Hit enter or tab to define multiple tags.
From the Rapid7 Vulnerability Scope drop-down list, select a scope from the options available:
> CISA Recommended Vulnerabilities
Cybersecurity and Infrastructure Security Agency identified threats
> Vulnerabilities with 3+ Exploits
Vulnerabilities that have three or more exploits published
> Exploitable Critical Vulnerabilities
Vulnerabilities with critical exploits available
> Common Exploitable Vulnerabilities
Commonly exploited vulnerabilities
> CVSS Score > 8
(CVSSv3) Vulnerabilities that are greater than 8 severity score
Click Submit to complete the configuration. The integration is saved and a pull of Rapid7 data is immediately initiated.
When the sync successfully finishes, the status is updated in the banner area of the Automox console.
Frequently Asked Questions
If I execute any actions from AVR, will it reboot those systems?
No - The patch executes but the system is not be rebooted
Can I recreate a connection?
If an API key needs to be updated, we currently recommend creating a new connection with the updated API key and region information.
Can Automated Vulnerability Remediation be used with Rapid7 Nexpose?
No - AVR is a platform to platform integration and does not support pulling data directly from the Rapid7 Nexpose console.
Is it currently possible to leverage worklets from the Worklet Catalog for remediations?
It is possible to use worklets from the catalog as long as the worklet has already been defined as a custom policy within the organization.
Is it possible to configure the integration to run at a particular time during the day?
No - The integration with Rapid7 is only configured to run on a schedule once per day at 4 AM MT.
Troubleshooting
When a saved configuration runs, I receive an “invalid action connection unauthorized” error.
This error occurs when an invalid API key or region is selected when creating a connection. Create a new connection and verify the API key and region are correct for your Rapid7 Platform organization.
Comments
0 comments
Please sign in to leave a comment.