Automated Vulnerability Remediation

What Is Automated Vulnerability Remediation (AVR)?

AVR allows you to bridge the gap that exists between vulnerability discovery and vulnerability remediation. AVR allows you to do the following:

• Automatically ingest prioritized vulnerabilities from InsightVM’s Platform API into the Automox console

• Extend remediation actions through Worklets using Rapid7 vulnerability solution details, moving remediation possibilities beyond patching alone

• Identify coverage gaps in managed devices between Rapid7’s InsightVM API and the Automox console
  

  

Using Automated Vulnerability Remediation

Follow these requirements and configuration steps to ensure the integration with Rapid7 is successful.

Requirements

To use AVR, you need the following information:

• Your active Rapid7 license for InsightVM (Cloud Enabled)

• Your active Rapid7 Insight Platform API key

• Rapid7 Insight Platform region information

• You have an active Automox license that includes AVR

Prerequisites for Rapid7 Connection Configuration

Prior to configuring a connection to Rapid7 InsightVM from within Automox, it is first necessary to collect the information needed to save a connection. This includes generating a Rapid7 Insight Platform API key and identifying the appropriate Rapid7 region.

1. Using an administrator account, login to the Rapid7 Insight Platform at https://insight.rapid7.com/platform#/  

2. After logging in, capture the region information (you will need this later) and click the gear icon (⚙) to reveal the API Keys sub-menu. Click API Keys to continue.
   

   

    

3. Click New User Key
   

   

    

4. To generate a new user key, select an Organization from the drop-down menu and assign a Name to that organization.
   

   

    

5. Click Generate.

6. Copy the API key from the dialog window. This is needed to configure the provider connection in a later step. When you are finished, click Done.
   

   

Getting Started

To set up the automated vulnerability remediation integration with Rapid7, follow the steps described in this section:

1. Creating a Connection to the Rapid7 Platform API

2. Creating a Configuration, which defines Asset and Vulnerability scope

After you complete these steps, remediations are pulled into Automox on a recurring basis.

Creating a Connection

Start in the Automox console to create a connection.

1. From the Automox console, select Manage → Remediations. If you do not see the Remediations option, ensure that your account includes AVR (contact Automox Support).
   

   

2. From the Import drop-down menu, select Third-Party Integration.
   

   

    

3. From the Integration Provider drop-down menu, select Rapid7 InsightVM. Click Next.
   

   

    

4. Follow these steps to configure the connection:

   1. Select Create a new connection. Make sure you have the required information ready.

   2. In the Connection Name field, enter a descriptive instance name. (For example, for customers with multiple organizations or regions: division01-us3 an division02-us2).

   3. Enter the Rapid7 API key.

   4. Select the region from the Rapid7 Region menu.

   5. Click Next.
      

      

       

5. Because connections are reusable, these steps only need to be performed more than once if there are multiple Rapid7 organizations in the environment. If only a single connection is necessary, select the existing connection from the Connection drop-down menu.

Creating a Configuration

After creating or selecting a connection, define the configuration settings.

See “What is Asset Tagging?” on the Rapid7 InsightVM Academy for information about R7 Asset Tags.

1. Enter a descriptive Configuration Name.

2. Add any Rapid7 Asset Tags that you would like to scope from Rapid7. Hit enter or tab to define multiple tags.
   

   

    

3. From the Rapid7 Vulnerability Scope drop-down list, select a scope from the options available:

   > CISA Recommended Vulnerabilities

   Cybersecurity and Infrastructure Security Agency identified threats

   > Vulnerabilities with 3+ Exploits

   Vulnerabilities that have three or more exploits published

   > Exploitable Critical Vulnerabilities

   Vulnerabilities with critical exploits available

   > Common Exploitable Vulnerabilities

   Commonly exploited vulnerabilities

   > CVSS Score > 8

   (CVSSv3) Vulnerabilities that are greater than 8 severity score
   

4. Click Submit to complete the configuration. The integration is saved and a pull of Rapid7 data is immediately initiated.

5. When the sync successfully finishes, the status is updated in the banner area of the Automox console.

Frequently Asked Questions

1. If I execute any actions from AVR, will it reboot those systems?

   1. No - The patch executes but the system is not be rebooted

2. Can I recreate a connection?

   1. If an API key needs to be updated, we currently recommend creating a new connection with the updated API key and region information.

3. Can Automated Vulnerability Remediation be used with Rapid7 Nexpose?

   1. No - AVR is a platform to platform integration and does not support pulling data directly from the Rapid7 Nexpose console.

4. Is it currently possible to leverage worklets from the Worklet Catalog for remediations?

   1. It is possible to use worklets from the catalog as long as the worklet has already been defined as a custom policy within the organization.

5. Is it possible to configure the integration to run at a particular time during the day?

   1. No - The integration with Rapid7 is only configured to run on a schedule once per day at 4 AM MT.

Troubleshooting

1. When a saved configuration runs, I receive an “invalid action connection unauthorized” error.

   1. This error occurs when an invalid API key or region is selected when creating a connection. Create a new connection and verify the API key and region are correct for your Rapid7 Platform organization.