diff --git a/plugins/rapid7_insightvm_cloud/.CHECKSUM b/plugins/rapid7_insightvm_cloud/.CHECKSUM index 17133dd924..e2b8a71c11 100644 --- a/plugins/rapid7_insightvm_cloud/.CHECKSUM +++ b/plugins/rapid7_insightvm_cloud/.CHECKSUM @@ -1,35 +1,35 @@ { - "spec": "e1f237bade1b5d382fac05a02cb3a45a", - "manifest": "bc89426afbe122ee3ad2b05e51de0602", - "setup": "1e99ccbf1717b1b3e8ff39002604d078", + "spec": "6898a8d3dcf35326c62bafd1839a3e31", + "manifest": "9b38d02526a7afbb04657bcaccec85e2", + "setup": "553502e1e832fa699fdc97d3d133ae51", "schemas": [ { "identifier": "asset_search/schema.py", - "hash": "b211d020317e7b641dc0a3e3fdf8fcac" + "hash": "67a13b58197e8ce0461e74e751c9a016" }, { "identifier": "get_asset/schema.py", - "hash": "5b22eee46330010e6643ed9d53e3e9ba" + "hash": "3a86f822596b87d396b2fa504e881f68" }, { "identifier": "get_scan/schema.py", - "hash": "2548da3a6866369f0c42dc04fe8594d4" + "hash": "39fab23452ba6ce5c51f0cce26c60d86" }, { "identifier": "start_scan/schema.py", - "hash": "716d68a738614777d6af43175502ea33" + "hash": "2714095eb5fef0071a4cc6104d18386f" }, { "identifier": "stop_scan/schema.py", - "hash": "67e09984958f9e98d6dfc4656b997ea0" + "hash": "4f9c72e4ae4e52709a21ba45c38b8c08" }, { "identifier": "vuln_search/schema.py", - "hash": "204bae762b488e566690c42a1b66836a" + "hash": "c9d9fc5a0879166c61079cf7071a73a9" }, { "identifier": "connection/schema.py", - "hash": "7bb85d81e314b1c547f165d7d00951cf" + "hash": "0a852d930eae09a49c541fb998107f69" } ] } \ No newline at end of file diff --git a/plugins/rapid7_insightvm_cloud/Dockerfile b/plugins/rapid7_insightvm_cloud/Dockerfile index 17e88f0a55..07a9757a56 100755 --- a/plugins/rapid7_insightvm_cloud/Dockerfile +++ b/plugins/rapid7_insightvm_cloud/Dockerfile @@ -1,26 +1,20 @@ -FROM rapid7/insightconnect-python-3-38-slim-plugin:4 -# Refer to the following documentation for available SDK parent images: https://komand.github.io/python/sdk.html#version +FROM rapid7/insightconnect-python-3-plugin:5 LABEL organization=rapid7 LABEL sdk=python -# Add any custom package dependencies here -# NOTE: Add pip packages to requirements.txt - -# End package dependencies - -# Add source code WORKDIR /python/src + ADD ./plugin.spec.yaml /plugin.spec.yaml -ADD . /python/src +ADD ./requirements.txt /python/src/requirements.txt -# Install pip dependencies RUN if [ -f requirements.txt ]; then pip install -r requirements.txt; fi -# Install plugin -RUN python setup.py build && python setup.py install +ADD . /python/src + +RUN python setup.py build && python setup.py install # User to run plugin code. The two supported users are: root, nobody USER nobody -ENTRYPOINT ["/usr/local/bin/icon_rapid7_insightvm_cloud"] \ No newline at end of file +ENTRYPOINT ["/usr/local/bin/icon_rapid7_insightvm_cloud"] diff --git a/plugins/rapid7_insightvm_cloud/bin/icon_rapid7_insightvm_cloud b/plugins/rapid7_insightvm_cloud/bin/icon_rapid7_insightvm_cloud index 98ffb7435a..69f22a94eb 100755 --- a/plugins/rapid7_insightvm_cloud/bin/icon_rapid7_insightvm_cloud +++ b/plugins/rapid7_insightvm_cloud/bin/icon_rapid7_insightvm_cloud @@ -1,12 +1,12 @@ #!/usr/bin/env python -# GENERATED BY KOMAND SDK - DO NOT EDIT +# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT import os import json from sys import argv Name = "Rapid7 InsightVM Cloud" Vendor = "rapid7" -Version = "4.0.0" +Version = "5.0.0" Description = "InsightVM is a powerful vulnerability management tool which finds, prioritizes, and remediates vulnerabilities. This plugin uses the InsightVM Cloud Integrations API to view assets and start scans" @@ -23,7 +23,7 @@ def main(): monkey.patch_all() import insightconnect_plugin_runtime - from icon_rapid7_insightvm_cloud import connection, actions, triggers + from icon_rapid7_insightvm_cloud import connection, actions, triggers, tasks class ICONRapid7InsightvmCloud(insightconnect_plugin_runtime.Plugin): def __init__(self): @@ -34,18 +34,18 @@ def main(): description=Description, connection=connection.Connection() ) + self.add_action(actions.StartScan()) + + self.add_action(actions.GetScan()) + self.add_action(actions.AssetSearch()) - + self.add_action(actions.GetAsset()) - - self.add_action(actions.GetScan()) - - self.add_action(actions.StartScan()) - + self.add_action(actions.StopScan()) - + self.add_action(actions.VulnSearch()) - + """Run plugin""" cli = insightconnect_plugin_runtime.CLI(ICONRapid7InsightvmCloud()) diff --git a/plugins/rapid7_insightvm_cloud/help.md b/plugins/rapid7_insightvm_cloud/help.md old mode 100755 new mode 100644 index 02741ebcbc..7f26031074 --- a/plugins/rapid7_insightvm_cloud/help.md +++ b/plugins/rapid7_insightvm_cloud/help.md @@ -1,6 +1,6 @@ # Description -InsightVM is a powerful vulnerability management tool which finds, prioritizes, and remediates vulnerabilities. This plugin uses the v4 cloud API to view assets, retrieve scan results and start scans. With an InsightVM scan engine paired to the platform, take advantage of triggering scans on assets in your environment along with performing robust asset searches to lookup and make actionable the asset and vulnerability data in your environment. +InsightVM is a powerful vulnerability management tool which finds, prioritizes, and remediates vulnerabilities. This plugin uses the InsightVM Cloud Integrations API to view assets and start scans # Key Features @@ -14,21 +14,21 @@ InsightVM is a powerful vulnerability management tool which finds, prioritizes, * InsightVM Scan Engine(s) paired to the Insight Platform # Supported Product Versions - -* InsightVM Cloud Integration API v4 -* 2022-08-10 + +* InsightVM Cloud Integration API v4 +* 2023-11-24 # Documentation ## Setup - -The connection configuration accepts the following parameters: + +The connection configuration accepts the following parameters: |Name|Type|Default|Required|Description|Enum|Example| -|----|----|-------|--------|-----------|----|-------| +| :--- | :--- | :--- | :--- | :--- | :--- | :--- | |credentials|credential_secret_key|None|True|API key from account|None|9de5069c5afe602b2ea0a04b66beb2c0| |region|string|None|True|the region in which the plugin will work|['us', 'us2', 'us3', 'eu', 'ca', 'au', 'ap']|us| - + Example input: ``` @@ -42,25 +42,30 @@ Example input: ### Actions -#### Vulnerability Search -This action is used to search for vulnerabilities using filtered vulnerability search. +#### Asset Search + +Search for assets using filtered asset search ##### Input |Name|Type|Default|Required|Description|Enum|Example| -|----|----|-------|--------|-----------|----|-------| -|asset_criteria|string|None|False|Filters to apply to the asset search such as IPv4 or IPv6 addresses and hostnames|None|asset.ipv4 = 2001:db8:1:1:1:1:1:1 || asset.name STARTS WITH 'example'|", "|vuln_criteria|string|None|False|Vulnerability criteria to filter by|None|vulnerability.categories IN ['example']| -|size|integer|200|False|The number of vulnerabilities to retrieve. If blank then will default to 200 vulnerabilities returned, the maximum limit is 500 vulnerabilities|None|100| +| :--- | :--- | :--- | :--- | :--- | :--- | :--- | +|asset_criteria|string|None|False|Filters to apply to the asset search such as IPv4 or IPv6 addresses and hostnames|None|asset.ipv4 = 2001:db8:1:1:1:1:1:1 || asset.name STARTS WITH 'example'| +|comparison_time|date|None|False|The date and time to compare the asset current state against to detect changes|None|2021-04-15T17:56:47Z| +|current_time|date|None|False|The current date and time to compare against the asset state to detect changes|None|2021-04-15T17:56:47Z| +|size|integer|200|False|The number of assets to retrieve. If blank then will default to 200 assets returned, the maximum limit is 500 assets|None|100| |sort_criteria|object|None|False|JSON object for sorting by criteria. Multiple criteria can be specified with an order of 'asc' (ascending) or 'desc' (descending)|None|{'risk-score': 'asc', 'criticality-tag': 'desc'}| -|vuln_criteria|string|None|False|Vulnerability criteria to filter by|None|https://example.com IN ['example']| - +|vuln_criteria|string|None|False|Vulnerability criteria to filter by|None|vulnerability.categories IN ['example']| + Example input: ``` { "asset_criteria": "asset.ipv4 = 2001:db8:1:1:1:1:1:1 || asset.name STARTS WITH 'example'", - "size": 100, + "comparison_time": "2021-04-15T17:56:47Z", + "current_time": "2021-04-15T17:56:47Z", + "size": 200, "sort_criteria": "{'risk-score': 'asc', 'criticality-tag': 'desc'}", "vuln_criteria": "vulnerability.categories IN ['example']" } @@ -68,1079 +73,782 @@ Example input: ##### Output -|Name|Type|Required|Description| -|----|----|--------|-----------| -|vulnerabilities|[]vulnerability|True|Vulnerabilities associated with the asset| - +|Name|Type|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | +|assets|[]asset|True|List of asset details returned by the search|None| + Example output: ``` { - "vulnerabilities": [ + "assets": [ { - "added": "2018-05-16T00:00:00Z", - "categories": "7-Zip", - "cves": "CVE-1234-5678", - "cvss_v2_access_complexity": "low", - "cvss_v2_access_vector": "network", - "cvss_v2_authentication": "none", - "cvss_v2_availability_impact": "complete", - "cvss_v2_confidentiality_impact": "complete", - "cvss_v2_exploit_score": 9.996799945831299, - "cvss_v2_impact_score": 10.000845454680942, - "cvss_v2_integrity_impact": "complete", - "cvss_v2_score": 10.0, - "cvss_v2_vector": "(AV:N/AC:L/Au:N/C:C/I:C/A:C)", - "cvss_v3_attack_complexity": null, - "cvss_v3_attack_vector": null, - "cvss_v3_availability_impact": null, - "cvss_v3_confidentiality_impact": null, - "cvss_v3_exploit_score": 0.0, - "cvss_v3_impact_score": null, - "cvss_v3_integrity_impact": null, - "cvss_v3_privileges_required": null, - "cvss_v3_scope": null, - "cvss_v3_score": 0.0, - "cvss_v3_user_interaction": null, - "cvss_v3_vector": null, - "denial_of_service": false, - "description": "Unspecified vulnerability in 7-zip before 4.5.7 has unknown impact and remote attack vectors, as demonstrated by the PROTOS GENOME test suite for Archive Formats (c10).", - "exploits": [], - "id": "7-zip-cve-1234-5678", - "links": [ + "assessed_for_policies": false, + "assessed_for_vulnerabilities": true, + "credential_assessments": [], + "critical_vulnerabilities": 12, + "exploits": 5, + "id": "cdc978de-4178-a1d9-d5a94a114b87-example", + "ip": "2001:db8:1:1:1:1:1:1", + "last_assessed_for_vulnerabilities": "2020-06-25T15:19:51.543Z", + "last_scan_end": "2020-10-26T22:35:53.590Z", + "last_scan_start": "2020-10-26T22:35:53.564Z", + "mac": "00:50:56:94:52:04", + "malware_kits": 0, + "moderate_vulnerabilities": 4, + "new": [], + "os_architecture": "", + "os_description": "Linux 2.6.32", + "os_family": "Linux", + "os_name": "Linux", + "os_system_name": "Linux", + "os_type": "General", + "os_vendor": "Linux", + "os_version": "2.6.32", + "remediated": [], + "risk_score": 9304.376953125, + "severe_vulnerabilities": 21, + "tags": [ { - "href": "http://www.example.com", - "id": "http://www.example.com", - "source": "url" + "name": "integrations discovery", + "type": "SITE" } ], - "malware_kits": [], - "modified": "2018-06-08T00:00:00Z", - "pci_cvss_score": 10.0, - "pci_fail": true, - "pci_severity_score": 5, - "pci_special_notes": "", - "pci_status": "fail", - "published": "2009-03-29T00:00:00Z", - "references": "http://www.example.com", - "risk_score": 898.76, - "severity": "critical", - "severity_score": 10, - "title": "7-Zip: CVE-1234-5678: Unspecified vulnerability in 7-zip before 4.5.7" + "total_vulnerabilities": 37, + "unique_identifiers": [] }, { - "added": "2018-05-16T00:00:00Z", - "categories": "7-Zip,Remote Execution", - "cves": "CVE-1234-5678", - "cvss_v2_access_complexity": "medium", - "cvss_v2_access_vector": "network", - "cvss_v2_authentication": "none", - "cvss_v2_availability_impact": "complete", - "cvss_v2_confidentiality_impact": "complete", - "cvss_v2_exploit_score": 8.588799953460693, - "cvss_v2_impact_score": 10.000845454680942, - "cvss_v2_integrity_impact": "complete", - "cvss_v2_score": 9.3, - "cvss_v2_vector": "(AV:N/AC:M/Au:N/C:C/I:C/A:C)", - "cvss_v3_attack_complexity": "low", - "cvss_v3_attack_vector": "local", - "cvss_v3_availability_impact": "high", - "cvss_v3_confidentiality_impact": "high", - "cvss_v3_exploit_score": 1.8345765900000002, - "cvss_v3_impact_score": 5.873118720000001, - "cvss_v3_integrity_impact": "high", - "cvss_v3_privileges_required": "none", - "cvss_v3_scope": "unchanged", - "cvss_v3_score": 7.8, - "cvss_v3_user_interaction": "required", - "cvss_v3_vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", - "denial_of_service": false, - "description": "Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to execute arbitrary code via a crafted HFS+ image.", - "exploits": [], - "id": "7-zip-cve-1234-5678", - "links": [ + "assessed_for_policies": false, + "assessed_for_vulnerabilities": true, + "credential_assessments": [], + "critical_vulnerabilities": 12, + "exploits": 5, + "id": "cdc978de-4178-a1d9-d5a94a114b87-example", + "ip": "2001:db8:1:1:1:1:1:1", + "last_assessed_for_vulnerabilities": "2020-06-25T15:19:51.543Z", + "last_scan_end": "2020-10-26T22:35:53.590Z", + "last_scan_start": "2020-10-26T22:35:53.564Z", + "mac": "00:50:56:94:52:04", + "malware_kits": 0, + "moderate_vulnerabilities": 4, + "new": [], + "os_architecture": "", + "os_description": "Linux 2.6.32", + "os_family": "Linux", + "os_name": "Linux", + "os_system_name": "Linux", + "os_type": "General", + "os_vendor": "Linux", + "os_version": "2.6.32", + "remediated": [], + "risk_score": 9304.376953125, + "severe_vulnerabilities": 21, + "tags": [ { - "href": "http://www.example.com", - "id": "http://www.example.com", - "source": "url" + "name": "integrations discovery", + "type": "SITE" } ], - "malware_kits": [], - "modified": "2018-06-08T00:00:00Z", - "pci_cvss_score": 9.3, - "pci_fail": true, - "pci_severity_score": 5, - "pci_special_notes": "", - "pci_status": "fail", - "published": "2016-12-13T00:00:00Z", - "references": "http://www.example.com", - "risk_score": 718.8, - "severity": "critical", - "severity_score": 9, - "title": "7-Zip: CVE-1234-5678: Heap-based buffer overflow vulnerability" + "total_vulnerabilities": 37, + "unique_identifiers": [] } ] } ``` -#### Stop Scan - -This action is used to stop a scan in progress. +#### Get Asset + +Gets an asset by ID ##### Input |Name|Type|Default|Required|Description|Enum|Example| -|----|----|-------|--------|-----------|----|-------| -|id|string|None|True|Scan ID|None|abb37782-df95-4cf6-b4c2-8d466ca5734| - +| :--- | :--- | :--- | :--- | :--- | :--- | :--- | +|id|string|None|True|Get an asset by ID|None|abc978-5678-abc-a5a94a1234b8-asset| +|include_vulns|boolean|False|False|Whether or not the list of vulnerabilities should be returned|None|True| + Example input: ``` { - "id": "abb37782-df95-4cf6-b4c2-8d466ca5734" + "id": "abc978-5678-abc-a5a94a1234b8-asset", + "include_vulns": false } ``` ##### Output -|Name|Type|Required|Description| -|----|----|--------|-----------| -|message|string|False|Reason why the action failed| -|status_code|integer|False|Code returned by API call| -|success|boolean|True|Was operation successful| - +|Name|Type|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | +|asset|asset|True|Asset details|None| +|vulnerabilities|[]asset_vulnerability|False|Vulnerabilities associated with the asset|None| + Example output: ``` { - "success": true + "asset": { + "assessed_for_policies": false, + "assessed_for_vulnerabilities": true, + "credential_assessments": [ + { + "port": 22, + "protocol": "TCP", + "status": "NO_CREDS_SUPPLIED" + } + ], + "critical_vulnerabilities": 1, + "exploits": 2, + "host_name": "example.rapid7.com", + "id": "cdc978de-4178-a1d9-d5a94a114b87-example", + "ip": "2001:db8:1:1:1:1:1:1", + "last_assessed_for_vulnerabilities": "2021-04-26T08:04:28.536Z", + "last_scan_end": "2021-04-26T08:04:28.536Z", + "last_scan_start": "2021-04-26T08:00:56.006Z", + "mac": "00:50:56:94:42:6B", + "malware_kits": 0, + "moderate_vulnerabilities": 7, + "new": [], + "remediated": [], + "risk_score": 9006.3388671875, + "severe_vulnerabilities": 19, + "tags": [ + { + "name": "sn_pt_LDAP Admins", + "type": "OWNER" + }, + { + "name": "sn_CAB Approval", + "type": "OWNER" + }, + { + "name": "integrations", + "type": "CUSTOM" + }, + { + "name": "ck_test_site_2", + "type": "SITE" + }, + { + "name": "integrations", + "type": "SITE" + }, + { + "name": "ck_test_site_3", + "type": "SITE" + }, + { + "name": "integrations discovery", + "type": "SITE" + }, + { + "name": "ck_test_site_1", + "type": "SITE" + } + ], + "total_vulnerabilities": 27, + "unique_identifiers": [] + } } ``` -#### Start Scan - -This action is used to start an InsightVM scan of previously scanned devices. +#### Get Scan + +Get the status of a scan ##### Input |Name|Type|Default|Required|Description|Enum|Example| -|----|----|-------|--------|-----------|----|-------| -|asset_ids|[]string|None|False|IDs of the assets to scan|None|["abc978-5678-abc-a5a94a1234b8-asset"]| -|hostnames|[]string|None|False|List of hostnames to scan|None|["rapid7.com"]| -|ips|[]string|None|False|List of IPv4 or IPv6 addresses to scan|None|["2001:db8:1:1:1:1:1:1"]| -|name|string|None|True|The name of the scan|None|test cloud scan| - +| :--- | :--- | :--- | :--- | :--- | :--- | :--- | +|scan_id|string|None|True|ID of the scan to obtain|None|abb37782-df95-4cf6-b4c2-8d466ca57349| + Example input: ``` { - "asset_ids": [ - "abc978-5678-abc-a5a94a1234b8-asset" - ], - "hostnames": [ - "rapid7.com" - ], - "ips": [ - "2001:db8:1:1:1:1:1:1" - ], - "name": "test cloud scan" + "scan_id": "abb37782-df95-4cf6-b4c2-8d466ca57349" } ``` ##### Output -|Name|Type|Required|Description| -|----|----|--------|-----------| -|asset_ids|[]string|False|List of identifiers of the assets scanned| -|data|object|False|Information received about the scan| -|ids|[]string|False|List of identifiers of the scans started| - +|Name|Type|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | +|asset_ids|[]string|False|List of IDs of the scanned assets|["abc978-5678-abc-a5a94a1234b8-asset"]| +|finished|date|False|When the scan was finished|2021-04-15T18:00:33Z| +|name|string|False|User-driven scan name for the scan|testing scan action| +|scan_id|string|False|ID of the scan|a9870dce1234180e202af83b66cd0c4b| +|started|date|False|When the scan was started|2021-04-15T17:56:47Z| +|status|string|False|Current status of the retrieved scan|Stopped| + Example output: ``` { - "scans": [ - { - "engine_id": "c8970d2ee174180e202af83b66cd0c4b", - "finished": null, - "id": "436a59e4-b203-4743-89a9-5b76294f20f4", - "name": "testing scan action", - "asset_ids": [ - "cdc978de-4178-a1d9-d5a94a114b87-example..." - ] - } - ], - "unscanned_assets": [] + "asset_ids": "abc978-5678-abc-a5a94a1234b8-asset", + "finished": "2021-04-15T18:00:33Z", + "name": "testing scan action", + "scan_id": "a9870dce1234180e202af83b66cd0c4b", + "started": "2021-04-15T17:56:47Z", + "status": "Stopped" } ``` -#### Asset Search - -This action is used to search for assets using filtered asset search. +#### Start Scan + +Start an InsightVM scan of previously scanned devices ##### Input |Name|Type|Default|Required|Description|Enum|Example| -|----|----|-------|--------|-----------|----|-------| -|asset_criteria|string|None|False|Filters to apply to the asset search such as IPv4 or IPv6 addresses and hostnames|None|asset.ipv4 = 2001:db8:1:1:1:1:1:1 || asset.name STARTS WITH 'example'| -|comparison_time|date|None|False|The date and time to compare the asset current state against to detect changes|None|2021-04-15T17:56:47Z| -|current_time|date|None|False|The current date and time to compare against the asset state to detect changes|None|2021-04-15T17:56:47Z| -|size|integer|200|False|The number of assets to retrieve. If blank then will default to 200 assets returned, the maximum limit is 500 assets|None|100| -|sort_criteria|object|None|False|JSON object for sorting by criteria. Multiple criteria can be specified with an order of 'asc' (ascending) or 'desc' (descending)|None|{'risk-score': 'asc', 'criticality-tag': 'desc'}| -|vuln_criteria|string|None|False|Vulnerability criteria to filter by|None|vulnerability.categories IN ['example']| - +| :--- | :--- | :--- | :--- | :--- | :--- | :--- | +|asset_ids|[]string|None|False|IDs of the assets to scan|None|["abc978-5678-abc-a5a94a1234b8-asset"]| +|hostnames|[]string|None|False|List of hostnames to scan|None|["rapid7.com"]| +|ips|[]string|None|False|List of IPv4 or IPv6 addresses to scan|None|["2001:db8:1:1:1:1:1:1"]| +|name|string|None|True|The name of the scan|None|test cloud scan| + Example input: ``` { - "asset_criteria": "asset.ipv4 = 2001:db8:1:1:1:1:1:1 || asset.name STARTS WITH 'example'", - "comparison_time": "2021-04-15T17:56:47Z", - "current_time": "2021-04-15T17:56:47Z", - "size": 100, - "sort_criteria": "{'risk-score': 'asc', 'criticality-tag': 'desc'}", - "vuln_criteria": "vulnerability.categories IN ['example']" + "asset_ids": "abc978-5678-abc-a5a94a1234b8-asset", + "hostnames": "rapid7.com", + "ips": "2001:db8:1:1:1:1:1:1", + "name": "test cloud scan" } ``` ##### Output -|Name|Type|Required|Description| -|----|----|--------|-----------| -|assets|[]asset|True|List of asset details returned by the search| - +|Name|Type|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | +|asset_ids|[]string|False|List of identifiers of the assets scanned|None| +|data|object|False|Information received about the scan|None| +|ids|[]string|False|List of identifiers of the scans started|None| + Example output: ``` - { - "assets": [ - { - "assessed_for_policies": false, - "assessed_for_vulnerabilities": true, - "credential_assessments": [], - "critical_vulnerabilities": 12, - "exploits": 5, - "id": "cdc978de-4178-a1d9-d5a94a114b87-example", - "ip": "2001:db8:1:1:1:1:1:1", - "last_assessed_for_vulnerabilities": "2020-06-25T15:19:51.543Z", - "last_scan_end": "2020-10-26T22:35:53.590Z", - "last_scan_start": "2020-10-26T22:35:53.564Z", - "mac": "00:50:56:94:52:04", - "malware_kits": 0, - "moderate_vulnerabilities": 4, - "new": [], - "os_architecture": "", - "os_description": "Linux 2.6.32", - "os_family": "Linux", - "os_name": "Linux", - "os_system_name": "Linux", - "os_type": "General", - "os_vendor": "Linux", - "os_version": "2.6.32", - "remediated": [], - "risk_score": 9304.376953125, - "severe_vulnerabilities": 21, - "tags": [ - { - "name": "integrations discovery", - "type": "SITE" - } - ], - "total_vulnerabilities": 37, - "unique_identifiers": [] - }, - { - "assessed_for_policies": false, - "assessed_for_vulnerabilities": true, - "credential_assessments": [], - "critical_vulnerabilities": 12, - "exploits": 5, - "id": "cdc978de-4178-a1d9-d5a94a114b87-example, - "ip": "2001:db8:1:1:1:1:1:1", - "last_assessed_for_vulnerabilities": "2020-06-25T15:19:51.543Z", - "last_scan_end": "2020-10-26T22:35:53.590Z", - "last_scan_start": "2020-10-26T22:35:53.564Z", - "mac": "00:50:56:94:52:04", - "malware_kits": 0, - "moderate_vulnerabilities": 4, - "new": [], - "os_architecture": "", - "os_description": "Linux 2.6.32", - "os_family": "Linux", - "os_name": "Linux", - "os_system_name": "Linux", - "os_type": "General", - "os_vendor": "Linux", - "os_version": "2.6.32", - "remediated": [], - "risk_score": 9304.376953125, - "severe_vulnerabilities": 21, - "tags": [ - { - "name": "integrations discovery", - "type": "SITE" - } - ], - "total_vulnerabilities": 37, - "unique_identifiers": [] - } - ] - } +{ + "asset_ids": [ + "cdc978de-4178-a1d9-d5a94a114b87-example..." + ], + "data": {}, + "ids": [ + "436a59e4-b203-4743-89a9-5b76294f20f4" + ] +} ``` -#### Get Asset - -This action gets an asset by ID. +#### Stop Scan + +Stop a scan in progress ##### Input |Name|Type|Default|Required|Description|Enum|Example| -|----|----|-------|--------|-----------|----|-------| -|id|string|None|True|Get an asset by ID|None|abc978-5678-abc-a5a94a1234b8-asset| -|include_vulns|boolean|False|False|Whether or not the list of vulnerabilities should be returned|None|True| - +| :--- | :--- | :--- | :--- | :--- | :--- | :--- | +|id|string|None|True|Scan ID|None|abb37782-df95-4cf6-b4c2-8d466ca5734| + Example input: ``` { - "id": "abc978-5678-abc-a5a94a1234b8-asset", - "include_vulns": true + "id": "abb37782-df95-4cf6-b4c2-8d466ca5734" } ``` ##### Output -|Name|Type|Required|Description| -|----|----|--------|-----------| -|asset|asset|True|Asset details| -|vulnerabilities|[]asset_vulnerability|False|Vulnerabilities associated with the asset| - +|Name|Type|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | +|message|string|False|Reason why the action failed|The scan could not be stopped| +|status_code|integer|False|Code returned by API call|400| +|success|boolean|True|Was operation successful|True| + Example output: ``` - "asset": { - "assessed_for_policies": false, - "assessed_for_vulnerabilities": true, - "credential_assessments": [ - { - "port": 22, - "protocol": "TCP", - "status": "NO_CREDS_SUPPLIED" - } - ], - "critical_vulnerabilities": 1, - "exploits": 2, - "host_name": "example.rapid7.com", - "id": "cdc978de-4178-a1d9-d5a94a114b87-example", - "ip": "2001:db8:1:1:1:1:1:1", - "last_assessed_for_vulnerabilities": "2021-04-26T08:04:28.536Z", - "last_scan_end": "2021-04-26T08:04:28.536Z", - "last_scan_start": "2021-04-26T08:00:56.006Z", - "mac": "00:50:56:94:42:6B", - "malware_kits": 0, - "moderate_vulnerabilities": 7, - "new": [], - "remediated": [], - "risk_score": 9006.3388671875, - "severe_vulnerabilities": 19, - "tags": [ - { - "name": "sn_pt_LDAP Admins", - "type": "OWNER" - }, - { - "name": "sn_CAB Approval", - "type": "OWNER" - }, - { - "name": "integrations", - "type": "CUSTOM" - }, - { - "name": "ck_test_site_2", - "type": "SITE" - }, - { - "name": "integrations", - "type": "SITE" - }, - { - "name": "ck_test_site_3", - "type": "SITE" - }, - { - "name": "integrations discovery", - "type": "SITE" - }, - { - "name": "ck_test_site_1", - "type": "SITE" - } - ], - "total_vulnerabilities": 27, - "unique_identifiers": [] - } - } +{ + "message": "The scan could not be stopped", + "status_code": 400, + "success": true +} ``` -#### Get Scan - -This action is used to get the status of a scan. +#### Vulnerability Search + +Search for vulnerabilities using filtered vulnerability search ##### Input |Name|Type|Default|Required|Description|Enum|Example| -|----|----|-------|--------|-----------|----|-------| -|scan_id|string|None|True|ID of the scan to obtain|None|abb37782-df95-4cf6-b4c2-8d466ca57349| - +| :--- | :--- | :--- | :--- | :--- | :--- | :--- | +|size|integer|200|False|The number of vulnerabilities to retrieve. If blank then will default to 200 vulnerabilities returned, the maximum limit is 500 vulnerabilities|None|100| +|sort_criteria|object|None|False|JSON object for sorting by criteria. Multiple criteria can be specified with an order of 'asc' (ascending) or 'desc' (descending)|None|{'risk-score': 'asc', 'criticality-tag': 'desc'}| +|vuln_criteria|string|None|False|Vulnerability criteria to filter by|None|vulnerability.categories IN ['example']| + Example input: ``` { - "scan_id": "abb37782-df95-4cf6-b4c2-8d466ca57349" + "size": 200, + "sort_criteria": "{'risk-score': 'asc', 'criticality-tag': 'desc'}", + "vuln_criteria": "vulnerability.categories IN ['example']" } ``` ##### Output -|Name|Type|Required|Description| -|----|----|--------|-----------| -|asset_ids|[]string|False|List of IDs of the scanned assets| -|finished|date|False|When the scan was finished| -|name|string|False|User-driven scan name for the scan| -|scan_id|string|False|ID of the scan| -|started|date|False|When the scan was started| -|status|string|False|Current status of the retrieved scan| - +|Name|Type|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | +|vulnerabilities|[]vulnerability|True|Vulnerabilities associated with the asset|None| + Example output: ``` +{ + "vulnerabilities": [ { - "scans": [ + "added": "2018-05-16T00:00:00Z", + "categories": "7-Zip", + "cves": "CVE-1234-5678", + "cvss_v2_access_complexity": "low", + "cvss_v2_access_vector": "network", + "cvss_v2_authentication": "none", + "cvss_v2_availability_impact": "complete", + "cvss_v2_confidentiality_impact": "complete", + "cvss_v2_exploit_score": 9.996799945831299, + "cvss_v2_impact_score": 10.000845454680942, + "cvss_v2_integrity_impact": "complete", + "cvss_v2_score": 10.0, + "cvss_v2_vector": "(AV:N/AC:L/Au:N/C:C/I:C/A:C)", + "cvss_v3_attack_complexity": null, + "cvss_v3_attack_vector": null, + "cvss_v3_availability_impact": null, + "cvss_v3_confidentiality_impact": null, + "cvss_v3_exploit_score": 0.0, + "cvss_v3_impact_score": null, + "cvss_v3_integrity_impact": null, + "cvss_v3_privileges_required": null, + "cvss_v3_scope": null, + "cvss_v3_score": 0.0, + "cvss_v3_user_interaction": null, + "cvss_v3_vector": null, + "denial_of_service": false, + "description": "Unspecified vulnerability in 7-zip before 4.5.7 has unknown impact and remote attack vectors, as demonstrated by the PROTOS GENOME test suite for Archive Formats (c10).", + "exploits": [], + "id": "7-zip-cve-1234-5678", + "links": [ { - "asset_ids": [ - "cdc978de-f683-4178-a1d9-d5a94a114b87-default-asset-13" - ], - "engine_id": "c8970d2ee174180e202af83b66cd0c4b", - "finished": null, - "id": "7fc3d8ec-24a7-4835-84f2-8877fe96a29b", - "name": "testing scan action" + "href": "http://www.example.com", + "id": "http://www.example.com", + "source": "url" } ], - "unscanned_assets": [] + "malware_kits": [], + "modified": "2018-06-08T00:00:00Z", + "pci_cvss_score": 10.0, + "pci_fail": true, + "pci_severity_score": 5, + "pci_special_notes": "", + "pci_status": "fail", + "published": "2009-03-29T00:00:00Z", + "references": "http://www.example.com", + "risk_score": 898.76, + "severity": "critical", + "severity_score": 10, + "title": "7-Zip: CVE-1234-5678: Unspecified vulnerability in 7-zip before 4.5.7" + }, + { + "added": "2018-05-16T00:00:00Z", + "categories": "7-Zip,Remote Execution", + "cves": "CVE-1234-5678", + "cvss_v2_access_complexity": "medium", + "cvss_v2_access_vector": "network", + "cvss_v2_authentication": "none", + "cvss_v2_availability_impact": "complete", + "cvss_v2_confidentiality_impact": "complete", + "cvss_v2_exploit_score": 8.588799953460693, + "cvss_v2_impact_score": 10.000845454680942, + "cvss_v2_integrity_impact": "complete", + "cvss_v2_score": 9.3, + "cvss_v2_vector": "(AV:N/AC:M/Au:N/C:C/I:C/A:C)", + "cvss_v3_attack_complexity": "low", + "cvss_v3_attack_vector": "local", + "cvss_v3_availability_impact": "high", + "cvss_v3_confidentiality_impact": "high", + "cvss_v3_exploit_score": 1.8345765900000002, + "cvss_v3_impact_score": 5.873118720000001, + "cvss_v3_integrity_impact": "high", + "cvss_v3_privileges_required": "none", + "cvss_v3_scope": "unchanged", + "cvss_v3_score": 7.8, + "cvss_v3_user_interaction": "required", + "cvss_v3_vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "denial_of_service": false, + "description": "Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to execute arbitrary code via a crafted HFS+ image.", + "exploits": [], + "id": "7-zip-cve-1234-5678", + "links": [ + { + "href": "http://www.example.com", + "id": "http://www.example.com", + "source": "url" + } + ], + "malware_kits": [], + "modified": "2018-06-08T00:00:00Z", + "pci_cvss_score": 9.3, + "pci_fail": true, + "pci_severity_score": 5, + "pci_special_notes": "", + "pci_status": "fail", + "published": "2016-12-13T00:00:00Z", + "references": "http://www.example.com", + "risk_score": 718.8, + "severity": "critical", + "severity_score": 9, + "title": "7-Zip: CVE-1234-5678: Heap-based buffer overflow vulnerability" } + ] +} ``` - ### Triggers + +*This plugin does not contain any triggers.* +### Tasks + +*This plugin does not contain any tasks.* + +### Custom Types + +**link** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|URL|string|None|False|A hypertext reference, which is either a URI (see RFC 3986) or URI template (see RFC 6570)|None| +|Rel|string|None|False|Link relation type following RFC 5988|None| + +**address** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|IP|string|None|False|IPv4 or IPv6 address|None| +|MAC|string|None|False|Media Access Control (MAC) address, e.g. AF:12:BC:5A:F7:48|None| + +**configuration** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|Name|string|None|False|Name of the configuration value|None| +|Value|string|None|False|Configuration value|None| + +**database** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|Description|string|None|False|Description of the database instance|None| +|ID|integer|None|False|Identifier of the database|None| +|Name|string|None|False|Name of the database instance|None| + +**file** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|Attributes|[]configuration|None|False|Attributes detected on the file|None| +|Contents|bytes|None|False|Contents of the file|None| +|Name|string|None|False|Name of the file|None| +|Size|integer|None|False|Size of the regular file (in bytes). If the file is a directory, no value is returned|None| +|Type|string|None|False|Type of the file, e.g. file or directory|None| + +**history** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|Date|string|None|False|Date the asset information was collected or changed|None| +|Description|string|None|False|Additional information describing the change|None| +|Scan ID|integer|None|False|If a scan-oriented change, the identifier of the corresponding scan the asset was scanned in|None| +|Type|string|None|False|Type, for additional information see the help section of this plugin|None| +|User|string|None|False|User|None| +|Version|integer|None|False|Version|None| +|Vulnerability Exception ID|integer|None|False|Vulnerability exception ID|None| + +**host_name** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|Name|string|None|False|Name|None| +|Source|string|None|False|Source|None| + +**id** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|ID|string|None|False|ID|None| +|Source|string|None|False|Source|None| + +**cpe** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|Edition|string|None|False|Edition-related terms applied by the vendor to the product|None| +|Language|string|None|False|Defines the language supported in the user interface of the product being described. The format of the language tag adheres to RFC 5646|None| +|Other|string|None|False|Captures any other general descriptive or identifying information which is vendor- or product-specific and which does not logically fit in any other attribute value|None| +|Part|string|None|False|A single letter code that designates the particular platform part that is being identified|None| +|Product|string|None|False|Most common and recognizable title or name of the product|None| +|Software Edition|string|None|False|Characterizes how the product is tailored to a particular market or class of end users|None| +|Target Hardware|string|None|False|Characterize the instruction set architecture on which the product operates|None| +|Target Software|string|None|False|Characterizes the software computing environment within which the product operates|None| +|Update|string|None|False|Vendor-specific alphanumeric strings characterizing the particular update, service pack, or point release of the product|None| +|Version 2.2|string|None|False|The full CPE string in the CPE 2.2 format|None| +|Version 2.3|string|None|False|The full CPE string in the CPE 2.3 format|None| +|Vendor|string|None|False|The person or organization that manufactured or created the product|None| +|Version|string|None|False|Vendor-specific alphanumeric strings characterizing the particular release version of the product|None| + +**os_fingerprint** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|Architecture|string|None|False|The architecture of the operating system|None| +|Configuration|[]configuration|None|False|Configuration key-values pairs enumerated on the operating system|None| +|CPE|cpe|None|False|Common Platform Enumeration|None| +|Description|string|None|False|The description of the operating system (containing vendor, family, product, version and architecture in a single string)|None| +|Family|string|None|False|Family of the operating system|None| +|ID|integer|None|False|Identifier of the operating system|None| +|Product|string|None|False|Name of the operating system|None| +|System Name|string|None|False|A combination of vendor and family (with redundancies removed), suitable for grouping|None| +|Type|string|None|False|Type of operating system|None| +|Vendor|string|None|False|Vendor of the operating system|None| +|Version|string|None|False|Version of the operating system|None| + +**user_group** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|ID|integer|None|False|Identifier of the user group|None| +|Name|string|None|False|Name of the user group|None| + +**user** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|Full Name|string|None|False|Full name of the user account|None| +|ID|integer|None|False|Identifier of the user account|None| +|Name|string|None|False|Name of the user account|None| + +**page** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|Link Type|string|None|False|Type of link used to traverse or detect the page|None| +|Path|string|None|False|Path to the page (URI)|None| +|Response|integer|None|False|HTTP response code observed with retrieving the page|None| + +**web_application** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|ID|integer|None|False|Identifier of the web application|None| +|Pages|[]page|None|False|Pages|None| +|Root|string|None|False|Web root of the web application|None| +|Virtual Host|string|None|False|Virtual host of the web application|None| + +**service** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|Configurations|[]configuration|None|False|Configuration key-values pairs enumerated on the service|None| +|Databases|[]database|None|False|Databases enumerated on the service|None| +|Family|string|None|False|Family of the service|None| +|Links|[]link|None|False|Hypermedia links to corresponding or related resources|None| +|Name|string|None|False|Name of the service|None| +|Port|integer|None|False|Port of the service|None| +|Product|string|None|False|Product running the service|None| +|Protocol|string|None|False|Protocol of the service|None| +|User Groups|[]user_group|None|False|User groups|None| +|Users|[]user|None|False|Users|None| +|Vendor|string|None|False|Vendor of the service|None| +|Version|string|None|False|Version of the service|None| +|Web Applications|[]web_application|None|False|Web applications found on the service|None| + +**asset_vulnerability** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|First Found|date|None|False|Date the vulnerability was first found in InsightVM|None| +|Vulnerability Key|string|None|False|The key to identify a specific instance if the type is Instance|None| +|Last Found|date|None|False|Date the vulnerability was last found in InsightVM|None| +|Proof|string|None|False|Proof of the vulnerability, i.e.

OpenBSD OpenSSH 4.3 on Linux

|None| +|Fix|string|None|False|The steps that are part of the fix this solution prescribes|None| +|Solution ID|string|None|False|The identifier of the solution|None| +|Solution Summary|string|None|False|Remediation summary|None| +|Solution Type|string|None|True|Remediation type|None| +|Status|string|None|False|Status, i.e. vulnerable|None| +|Vulnerability ID|string|None|False|The identifier of the vulnerability|None| + +**software** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|Configurations|[]configuration|None|False|Configurations|None| +|CPE|cpe|None|False|CPE|None| +|Description|string|None|False|Description of the software|None| +|Family|string|None|False|Family of the software|None| +|ID|integer|None|False|ID|None| +|Product|string|None|False|Product of the software|None| +|Type|string|None|False|Type of the software|None| +|Vendor|string|None|False|Vendor of the software|None| +|Version|string|None|False|Version of the software|None| + +**vulnerability_description** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|HTML|string|None|None|Vulnerability description HTML|None| +|Text|string|None|None|Vulnerability description raw text|None| + +**pci** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|Adjusted CVSS score|integer|None|None|PCI adjusted CVSS score|None| +|Adjusted severity score|integer|None|None|PCI adjusted severity score|None| +|Fail|boolean|None|None|Whether this vulnerability results in a PCI assessment failure|None| +|Special Notes|string|None|None|PCI special notes|None| +|Status|string|None|None|PCI status|None| + +**cvss_v2** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|Access Complexity|string|None|None|CVSSv2 access complexity metric|None| +|Access Vector|string|None|None|CVSSv2 access vector metric|None| +|Authentication|string|None|None|CVSSv2 authentication metric|None| +|Availability Impact|string|None|None|CVSSv2 availability impact metric|None| +|Confidentiality Impact|string|None|None|CVSSv2 confidentiality impact metric|None| +|Exploit Score|float|None|None|CVSSv2 combined exploit metric score (Access Complexity/Access Vector/Authentication)|None| +|Impact Score|float|None|None|CVSSv2 combined impact metric score (Confidentiality/Integrity/Availability)|None| +|Integrity Impact|string|None|None|CVSSv2 integrity impact metric|None| +|Score|float|None|None|CVSSv2 score|None| +|Vector|string|None|None|CVSSv2 combined vector string|None| + +**cvss_v3** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|Attack Complexity|string|None|None|CVSSv3 attack complexity metric|None| +|Attack Vector|string|None|None|CVSSv3 attack vector metric|None| +|Availability Impact|string|None|None|CVSSv3 availability impact metric|None| +|Confidentiality Impact|string|None|None|CVSSv3 confidentiality impact metric|None| +|Exploit Score|float|None|None|CVSSv3 combined exploit metric score (Attack Complexity/Attack Vector/Privilege Required/Scope/User Interaction)|None| +|Impact Score|float|None|None|CVSSv3 combined impact metric score (Confidentiality/Integrity/Availability)|None| +|Integrity Impact|string|None|None|CVSSv3 integrity impact metric|None| +|Privilege Required|string|None|None|CVSSv3 privilege required metric|None| +|Scope|string|None|None|CVSSv3 scope metric|None| +|Score|float|None|None|CVSSv3 score|None| +|User Interaction|string|None|None|CVSSv3 user interaction metric|None| +|Vector|string|None|None|CVSSv3 combined vector string|None| + +**cvss** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|Links|[]link|None|None|List of hypermedia links to corresponding resources|None| +|V2|cvss_v2|None|None|CVSSv2 details|None| +|V3|cvss_v3|None|None|CVSSv3 details|None| + +**creds** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|Port|integer|None|False|The port that is used|None| +|Protocol|string|None|False|TCP or other|None| +|Status|string|None|False|Which creds apply|None| + +**identifiers** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|ID|string|None|False|The ID|None| +|Source|string|None|False|The source|None| + +**asset_tag** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|Name|string|None|False|The name|None| +|Type|string|None|False|The type|None| + +**asset** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|Assessed for Policies|boolean|None|False|Whether the asset has been assessed for policies at least once|None| +|Assessed for Vulnerabilities|boolean|None|False|Whether the asset has been assessed for vulnerabilities at least once|None| +|Credential Assessments|[]creds|None|False|Assessments from the credentials|None| +|Critical Vulnerabilities|integer|None|False|Number of critical vulnerabilities|None| +|Exploits|integer|None|False|Number of exploits|None| +|Hostname|string|None|False|Primary host name (local or FQDN) of the asset|None| +|ID|string|None|True|Identifier of the asset|None| +|IP|string|None|False|Primary IPv4 or IPv6 address of the asset|None| +|Last Assessed For Vulnerabilities|string|None|False|Date of last scan|None| +|Last Scan End|string|None|False|When the last scan was ended|None| +|Last Scan Start|string|None|False|When the last scan was started|None| +|MAC|string|None|False|Media Access Control (MAC) address, e.g. AF:12:BC:5A:F7:48|None| +|Malware Kits|integer|None|False|Number of malware kits|None| +|Moderate Vulnerabilities|integer|None|False|Number of moderate vulnerabilities|None| +|New Vulnerabilities|[]string|None|False|Vulnerabilities that are the new between current and comparison time for the asset|None| +|OS Architecture|string|None|False|The srchitecture of the os|None| +|OS Description|string|None|False|Description of the os|None| +|OS Family|string|None|False|Family of the os|None| +|OS Name|string|None|False|Name of the os|None| +|OS System Name|string|None|False|Name of the system os|None| +|OS Type|string|None|False|Type of os|None| +|OS Vendor|string|None|False|Vendor of the os|None| +|Remediated Vulnerabilities|[]string|None|False|Vulnerabilities that were remediated in the latest version at current time for the asset|None| +|Risk Score|float|None|False|Risk score (with criticality adjustments) of the asset|None| +|Severe Vulnerabilities|integer|None|False|Number of sever vulns|None| +|Source|string|None|False|Source of the asset|None| +|Tags|[]asset_tag|None|False|Asset tags|None| +|Total Vulnerabilities|integer|None|False|Total number of vulns|None| +|Unique Identifiers|[]identifiers|None|False|Uniqure aspects of the asset|None| + +**exploit** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|Description|string|None|True|A verbose description of the exploit|None| +|ID|string|None|True|The identifier of the exploit|None| +|Name|string|None|True|The name of the exploit|None| +|Rank|string|None|True|The exploit rank|None| +|Skill level|string|None|True|The level of skill required to use the exploit|None| +|Source|string|None|True|Details about where the exploit is defined|None| + +**vulnerability** + +|Name|Type|Default|Required|Description|Example| +| :--- | :--- | :--- | :--- | :--- | :--- | +|Added|date|None|False|Date the vulnerability was last added to an asset|None| +|Categories|string|None|True|Labels this vulnerability falls under|None| +|CVES|string|None|False|CVES ID|None| +|CVSSv2|cvss_v2|None|False|information regarding CVSSv2|None| +|CVSSv3|cvss_v3|None|False|information regarding CVSSv3|None| +|Denial of Service|boolean|None|False|Whether or not this vulnerability is a denial of service attack|None| +|Description|string|None|False|Description of the vulnerability|None| +|Exploits|[]exploit|None|False|List of exploits related to the vulnerability|None| +|ID|string|None|True|ID of the vulnerability|None| +|Links|[]link|None|False|List of links related to the vulnerability|None| +|Malware Kits|[]object|None|False|List of malware kits related to the vulnerability|None| +|Modified|date|None|False|Date the vulnerability was last modified|None| +|PCI|pci|None|False|information regarding PCI|None| +|Published|date|None|True|Date the vulnerability was added to InsightVM|None| +|References|string|None|False|Links to information related to the vulnerability|None| +|Risk Score|float|None|True|Risk score (with criticality adjustments) of the vulnerability|None| +|Severity|string|None|True|Severity of the vulnerability|None| +|Severity Score|integer|None|True|Severity score of the vulnerability|None| +|Title|string|None|False|Name of the vulnerability|None| -_This plugin does not contain any triggers._ - -### Custom Output Types - -#### address - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|IP|string|False|IPv4 or IPv6 address| -|MAC|string|False|Media Access Control (MAC) address, e.g. AF:12:BC:5A:F7:48| - -#### asset - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Addresses|[]address|False|All addresses discovered on the asset| -|Assessed for Policies|boolean|False|Whether the asset has been assessed for policies at least once| -|Assessed for Vulnerabilities|boolean|False|Whether the asset has been assessed for vulnerabilities at least once| -|Configurations|[]configuration|False|Configuration key-values pairs enumerated on the asset| -|Databases|[]database|False|Databases enumerated on the asset| -|Files|[]file|False|Files discovered with searching on the asset| -|History|[]history|False|History of changes to the asset over time| -|Hostname|string|False|Primary host name (local or FQDN) of the asset| -|Hostnames|[]hostName|False|All hostnames or aliases discovered on the asset| -|ID|integer|False|Identifier of the asset| -|IDs|[]id|False|Unique identifiers found on the asset, such as hardware or operating system identifiers| -|IP|string|False|Primary IPv4 or IPv6 address of the asset| -|Links|[]link|False|Hypermedia links to corresponding or related resources| -|MAC|string|False|Media Access Control (MAC) address, e.g. AF:12:BC:5A:F7:48| -|OS|string|False|Full description of the operating system of the asset| -|OS Fingerprint|osFingerprint|False|Details of the operating system of the asset| -|Raw Risk Score|float|False|Base risk score of the asset| -|Risk Score|float|False|Risk score (with criticality adjustments) of the asset| -|Services|[]service|False|Services discovered on the asset| -|Software|[]software|False|Software discovered on the asset| -|Type|string|False|Type of asset e.g. unknown, guest, hypervisor, physical, mobile| -|User Groups|[]userGroup|False|User group accounts enumerated on the asset| -|Users|[]user|False|User accounts enumerated on the asset| -|Vulnerabilities|vulnerabilities|False| Summary information for vulnerabilities on the asset| - -#### asset_group - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Assets|integer|True|Site asset count| -|Description|string|False|Asset group description| -|ID|integer|True|Site ID| -|Links|[]link|True|Hypermedia links to corresponding or related resources| -|Name|string|True|Asset group name| -|Risk Score|float|True|Site risk score| -|Search Criteria|object|False|Asset group search criteria| -|Type|string|True|Asset group type| -|Vulnerabilities|vulnerabilities_count|True|Asset group vulnerability counts| - -#### asset_vulnerability - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|ID|string|False|Vulnerability ID, ie. ssh-openssh-x11uselocalhost-x11-forwarding-session-hijack| -|Instances|integer|False|Identifier of the report instance| -|Links|[]link|False|Hypermedia links to corresponding or related resources| -|Results|[]asset_vulnerability_result|False|The vulnerability check results for the finding. Multiple instances may be present if one or more checks fired, or a check has multiple independent results| -|Risk Score|float|False|The risk score for the vulnerability| -|Since|string|False|The date when this vulnerability was first detected| -|Status|string|False|Status, ie. vulnerable| - -#### asset_vulnerability_result - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Check ID|string|False|Check ID, ie. ssh-openssh-x11uselocalhost-x11-forwarding-session-hijack| -|Exceptions|[]integer|False|If the result is vulnerable with exceptions applied, the identifier(s) of the exceptions actively applied to the result| -|Key|string|False|An additional discriminating key used to uniquely identify between multiple instances of results on the same finding| -|Links|[]link|False|Hypermedia links to corresponding or related resources| -|Port|integer|False|Port of the service the result was discovered on e.g. 22| -|Proof|string|False|Proof of the vulnerability, ie.

OpenBSD OpenSSH 4.3 on Linux

| -|Protocol|string|False|Protocol of the service the result was discovered on, ie. TCP| -|Status|string|False|Status of the vulnerability check result, ie. vulnerable-version| - -#### authentication_source - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|External|boolean|True|Whether the authentication source is external (true) or internal (false)| -|ID|integer|True|Authentication source identifier| -|Links|[]link|True|List of hypermedia links to corresponding or related resources| -|Name|string|True|Authentication source name| -|Type|string|True|Authentication source type| - -#### configuration - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Name|string|False|Name of the configuration value| -|Value|string|False|Configuration value| - -#### cpe - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Edition|string|False|Edition-related terms applied by the vendor to the product| -|Language|string|False|Defines the language supported in the user interface of the product being described. The format of the language tag adheres to RFC 5646| -|Other|string|False|Captures any other general descriptive or identifying information which is vendor- or product-specific and which does not logically fit in any other attribute value| -|Part|string|False|A single letter code that designates the particular platform part that is being identified| -|Product|string|False|Most common and recognizable title or name of the product| -|Software Edition|string|False|Characterizes how the product is tailored to a particular market or class of end users| -|Target Hardware|string|False|Characterize the instruction set architecture on which the product operates| -|Target Software|string|False|Characterizes the software computing environment within which the product operates| -|Update|string|False|Vendor-specific alphanumeric strings characterizing the particular update, service pack, or point release of the product| -|Version 2.2|string|False|The full CPE string in the CPE 2.2 format| -|Version 2.3|string|False|The full CPE string in the CPE 2.3 format| -|Vendor|string|False|The person or organization that manufactured or created the product| -|Version|string|False|Vendor-specific alphanumeric strings characterizing the particular release version of the product| - -#### CVSS - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Links|[]link|False|List of hypermedia links to corresponding resources| -|V2|cvss_v2|False|CVSSv2 details| -|V3|cvss_v3|False|CVSSv3 details| - -#### CVSS_v2 - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Access Complexity|string|False|CVSSv2 access complexity metric| -|Access Vector|string|False|CVSSv2 access vector metric| -|Authentication|string|False|CVSSv2 authentication metric| -|Availability Impact|string|False|CVSSv2 availability impact metric| -|Confidentiality Impact|string|False|CVSSv2 confidentiality impact metric| -|Exploit Score|float|False|CVSSv2 combined exploit metric score (Access Complexity/Access Vector/Authentication)| -|Impact Score|float|False|CVSSv2 combined impact metric score (Confidentiality/Integrity/Availability)| -|Integrity Impact|string|False|CVSSv2 integrity impact metric| -|Score|float|False|CVSSv2 score| -|Vector|string|False|CVSSv2 combined vector string| - -#### CVSS_v3 - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Attack Complexity|string|False|CVSSv3 attack complexity metric| -|Attack Vector|string|False|CVSSv3 attack vector metric| -|Availability Impact|string|False|CVSSv3 availability impact metric| -|Confidentiality Impact|string|False|CVSSv3 confidentiality impact metric| -|Exploit Score|float|False|CVSSv3 combined exploit metric score (Attack Complexity/Attack Vector/Privilege Required/Scope/User Interaction)| -|Impact Score|float|False|CVSSv3 combined impact metric score (Confidentiality/Integrity/Availability)| -|Integrity Impact|string|False|CVSSv3 integrity impact metric| -|Privilege Required|string|False|CVSSv3 privilege required metric| -|Scope|string|False|CVSSv3 scope metric| -|Score|float|False|CVSSv3 score| -|User Interaction|string|False|CVSSv3 user interaction metric| -|Vector|string|False|CVSSv3 combined vector string| - -#### database - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Description|string|False|Description of the database instance| -|ID|integer|False|Identifier of the database| -|Name|string|False|Name of the database instance| - -#### exception_review - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Review Comment|string|False|The comment from the reviewer detailing the review| -|Review Date|date|False|The date and time the review took place| -|Links|[]link|False|Hypermedia links to corresponding or related resources| -|Reviewer Name|string|False|The login name of the user that reviewed the vulnerability exception| -|Reviewer ID|integer|False|The identifier of the user that reviewed the vulnerability exception| - -#### exception_scope - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Vulnerability Scope ID|integer|True|The identifer of the scope (asset, group, site) the vulnerability exception applies to| -|Exception Scope Key|string|False|Optional key to discriminate the instance when the scope type is Instance| -|Links|[]link|False|Hypermedia links to corresponding or related resources| -|Port|integer|False|If the scope type is Instance, the port the exception applies to| -|Exception Scope Type|string|True|The type of vulnerability exception - Global, Site, Asset, Asset Group, Instance| -|Vulnerability|string|True|The vulnerability the exception applies to| - -#### exception_submit - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Submit Comment|string|False|The comment from the submit detailing the exception| -|Submit Date|date|False|The date and time the exception request took place| -|Links|[]link|False|Hypermedia links to corresponding or related resources| -|Submitter Name|string|False|The login name of the user that submitted the vulnerability exception| -|Submitter ID|integer|False|The identifier of the user that submitted the vulnerability exception| - -#### file - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Attributes|[]configuration|False|Attributes detected on the file| -|Contents|bytes|False|Contents of the file| -|Name|string|False|Name of the file| -|Size|integer|False|Size of the regular file (in bytes). If the file is a directory, no value is returned| -|Type|string|False|Type of the file, e.g. file or directory| - -#### fingerprint - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Description|string|False|None| -|Family|string|False|None| -|Product|string|False|None| -|Vendor|string|False|None| -|Version|string|False|None| - -#### history - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Date|string|False|Date the asset information was collected or changed| -|Description|string|False|Additional information describing the change| -|Scan ID|integer|False|If a scan-oriented change, the identifier of the corresponding scan the asset was scanned in| -|Type|string|False|Type, for additional information see the help section of this plugin| -|User|string|False|User| -|Version|integer|False|Version| -|Vulnerability Exception ID|integer|False|Vulnerability exception ID| - -#### hostName - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Name|string|False|Name| -|Source|string|False|Source| - -#### id - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|ID|string|False|ID| -|Source|string|False|Source| - -#### link - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|URL|string|False|A hypertext reference, which is either a URI (see RFC 3986) or URI template (see RFC 6570)| -|Rel|string|False|Link relation type following RFC 5988| - -#### match - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Confidence|string|False|None| -|Fingerprint|fingerprint|False|None| - -#### osFingerprint - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Architecture|string|False|The architecture of the operating system| -|Configuration|[]configuration|False|Configuration key-values pairs enumerated on the operating system| -|CPE|cpe|False|Common Platform Enumeration| -|Description|string|False|The description of the operating system (containing vendor, family, product, version and architecture in a single string)| -|Family|string|False|Family of the operating system| -|ID|integer|False|Identifier of the operating system| -|Product|string|False|Name of the operating system| -|System Name|string|False|A combination of vendor and family (with redundancies removed), suitable for grouping| -|Type|string|False|Type of operating system| -|Vendor|string|False|Vendor of the operating system| -|Version|string|False|Version of the operating system| - -#### page - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Link Type|string|False|Type of link used to traverse or detect the page| -|Path|string|False|Path to the page (URI)| -|Response|integer|False|HTTP response code observed with retrieving the page| - -#### PCI - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Adjusted CVSS score|integer|False|PCI adjusted CVSS score| -|Adjusted severity score|integer|False|PCI adjusted severity score| -|Fail|boolean|False|Whether this vulnerability results in a PCI assessment failure| -|Special Notes|string|False|PCI special notes| -|Status|string|False|PCI status| - -#### remediation - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Asset Count|integer|True|The number of assets that require the solution to be applied| -|Assets|[]remediation_asset|True|The assets that require the solution to be applied| -|Fix|string|False|The steps that are part of the fix this solution prescribes| -|Rapid7 Solution ID|string|True|The identifier of the solution within InsightVM/Nexpose| -|Risk Score|integer|True|The risk score that is reduced by performing the solution| -|Solution ID|integer|True|The identifier of the solution| -|Summary|string|True|Remediation summary| -|Vulnerabilities|[]remediation_vulnerability|True|The vulnerabilities that would be remediated| -|Vulnerability Count|integer|True|The number of vulnerabilities that would be remediated| - -#### remediation_asset - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Criticality Tag|string|False|The criticality tag assigned to the asset| -|Hostname|string|False|Primary host name (local or FQDN) of the asset| -|ID|integer|True|Identifier of the asset| -|IP|string|True|Primary IPv4 or IPv6 address of the asset| -|MAC|string|False|Media Access Control (MAC) address, e.g. AF:12:BC:5A:F7:48| -|OS|string|False|Full description of the operating system of the asset| -|Risk Score|float|False|Risk score (with criticality adjustments) of the asset| - -#### remediation_vulnerability - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|CVSS Score|string|True|The CVSS score of the vulnerability| -|Description|string|True|The description of the vulnerability| -|ID|integer|True|Identifier of the vulnerability| -|Risk Score|integer|True|The risk score of the vulnerability| -|Severity|integer|True|The severity of the vulnerability| -|Title|string|True|The title of the vulnerability| - -#### report_id - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Report ID|integer|False|Identifer| -|Report Name|string|False|Name of report| - -#### resources - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Applies To|string|False|None| -|Confidence|string|False|None| -|Estimate|string|False|None| -|ID|string|False|None| -|links|[]link|False|None| -|Matches|[]match|False|None| -|Steps|step|False|None| -|Summary|summary|False|None| -|Type|string|False|None| - -#### role - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Description|string|True|The description of the role| -|Id|string|True|ID of the role, e.g 'global-admin'| -|Links|[]link|True|List of hypermedia links to corresponding or related resources| -|Name|string|True|Name of the role| -|Privileges|[]string|True|List of privileges assigned to the role| - -#### scan - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Assets|integer|False|Count of assets identified during the scan| -|Duration|date|False|Duration of the scan| -|End Time|date|False|End time of the scan| -|Engine ID|integer|False|ID for the scan engine/scan engine pool used for the scan| -|Engine Name|string|False|Name of the scan engine/scan engine pool used for the scan| -|ID|integer|False|ID of the scan| -|Links|[]link|False|List of hypermedia links to corresponding resources| -|Message|string|False|Scan status message| -|Scan Name|string|False|Name of the scan| -|Scan Type|string|False|Type of scan (automated, manual, scheduled)| -|Site ID|integer|False|ID of the site scanned| -|Site Name|string|False|Name of the site scanned| -|Start Time|date|False|Start time for the scan| -|Started By|string|False|User that started the scan| -|Status|string|False|Scan status (aborted, unknown, running, finished, stopped, error, paused, dispatched, integrating)| -|Vulnerabilities|vulnerabilities_count|False|Counts of vulnerabilities identified during the scan| - -#### scan_engine - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Address|string|True|Scan engine address (IP/hostname)| -|Content Version|string|False|Scan engine content version| -|Engine Pools|[]integer|True|Engine pool IDs with which the scan engine is associated| -|ID|integer|True|Scan engine identifier| -|Last Refreshed Date|date|False|Date and time when the engine last communicated with the console| -|Last Updated Date|date|False|Date and time when the engine was last updated| -|Links|[]link|True|List of hypermedia links to corresponding resources| -|Name|string|True|Scan engine name| -|Port|integer|True|Scan engine communication port| -|Product Version|string|False|Scan engine product version| -|Sites|[]integer|False|Sites with which the scan engine is associated| - -#### scan_engine_pool - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Engines|[]integer|True|List of scan engine IDs associated with the scan engine pool| -|ID|integer|True|Scan engine pool identifier| -|Links|[]link|True|List of hypermedia links to corresponding resources| -|Name|string|True|Scan engine pool name| - -#### service - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Configurations|[]configuration|False|Configuration key-values pairs enumerated on the service| -|Databases|[]database|False|Databases enumerated on the service| -|Family|string|False|Family of the service| -|Links|[]link|False|Hypermedia links to corresponding or related resources| -|Name|string|False|Name of the service| -|Port|integer|False|Port of the service| -|Product|string|False|Product running the service| -|Protocol|string|False|Protocol of the service| -|User Groups|[]userGroup|False|User groups| -|Users|[]user|False|Users| -|Vendor|string|False|Vendor of the service| -|Version|string|False|Version of the service| -|Web Applications|[]webApplication|False|Web applications found on the service| - -#### site - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Assets|integer|True|Site asset count| -|Connection Type|string|False|Site discovery connection type (if applicable)| -|Description|string|False|Site description| -|ID|integer|True|Identifier of the site| -|Importance|string|True|Site importance, used with the 'weighted' risk scoring strategy| -|Last Scan Time|date|False|Site last scan time| -|Links|[]link|True|Hypermedia links to corresponding or related resources| -|Name|string|True|Site name| -|Risk Score|float|True|Site risk score| -|Scan Engine|integer|True|Site default scan engine ID| -|Scan Template|string|True|Site default scan template| -|Type|string|True|Site type| -|Vulnerabilities|vulnerabilities_count|True|Site vulnerability counts| - -#### software - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Configurations|[]configuration|False|Configurations| -|CPE|cpe|False|CPE| -|Description|string|False|Description of the software| -|Family|string|False|Family of the software| -|ID|integer|False|ID| -|Product|string|False|Product of the software| -|Type|string|False|Type of the software| -|Vendor|string|False|Vendor of the software| -|Version|string|False|Version of the software| - -#### step - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|HTML|string|False|None| -|text|string|False|None| - -#### summary - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|HTML|string|False|None| -|text|string|False|None| - -#### tag - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Color|string|False|Tag color| -|Created|date|False|Tag creation date| -|ID|integer|True|Tag ID| -|Links|[]link|False|Hypermedia links to corresponding or related resources| -|Name|string|True|Tag name| -|Risk Modifier|string|False|Tag risk score modifier| -|Search Criteria|object|False|Tag search criteria| -|Source|string|False|Tag source| -|Type|string|True|Tag type| - -#### tag_asset - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|ID|integer|True|Asset ID| -|Sources|[]string|True|Tag association sources| - -#### user - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Full Name|string|False|Full name of the user account| -|ID|integer|False|Identifier of the user account| -|Name|string|False|Name of the user account| - -#### userGroup - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|ID|integer|False|Identifier of the user group| -|Name|string|False|Name of the user group| - -#### user_account - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Authentication|authentication_source|False|The authentication source used to authenticate the user| -|Email|string|False|The email address of the user| -|Enabled|boolean|False|Whether the user account is enabled| -|ID|integer|False|The identifier of the user| -|Links|[]link|False|List of hypermedia links to corresponding or related resources| -|Locale|user_account_locale|False|The locale and language preferences for the user| -|Locked|boolean|True|Whether the user account is locked (exceeded maximum password retry attempts)| -|Login|string|True|The login name of the user| -|Name|string|True|The full name of the user| -|Role|user_account_role|False|The privileges and role the user is assigned| - -#### user_account_locale - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Default|string|True|Default locale| -|Reports|string|True|Reports locale| - -#### user_account_role - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|All Asset Groups|boolean|False|Whether the user has access to all asset groups| -|All Sites|boolean|False|Whether the user has access to all sites| -|ID|string|False|The identifier of the role the user is assigned to| -|Privileges|[]string|False|None| -|Superuser|boolean|False|Whether the user is a superuser| - -#### vulnerabilities - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Critical|integer|False|Number of critical vulnerabilities| -|Exploits|integer|False|Number of distinct exploits that can exploit any of the vulnerabilities on the asset| -|Malware Kits|integer|False|Number of distinct malware kits that vulnerabilities on the asset are susceptible to| -|Moderate|integer|False|Number of moderate vulnerabilities| -|Severe|integer|False|Number of severe vulnerabilities| -|Total|integer|False|Total number of vulnerabilities| - -#### vulnerabilities_count - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Critical|integer|False|Number of critical vulnerabilities| -|Moderate|integer|False|Number of moderate vulnerabilities| -|Severe|integer|False|Number of severe vulnerabilities| -|Total number of vulnerabilities|integer|False|Total| - -#### vulnerability - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Added|date|False|Date that the vulnerability was added to InsightVM| -|Categories|[]string|False|List of vulnerabilities categories with which this vulnerability is affiliated| -|CVEs|[]string|False|List of CVE identifiers associated with this vulnerability| -|CVSS|CVSS|False|Vulnerability CVSS details| -|Denial of Service|boolean|False|Whether the vulnerability is a denial of service vulnerability| -|Description|vulnerability_description|False|Vulnerability description| -|Exploits|integer|False|Exploit count| -|ID|string|False|Vulnerability ID| -|Links|[]link|False|List of hypermedia links to corresponding resources| -|Malware Kits|integer|False|Malware kit count| -|Modified|date|False|Date the vulnerability was last modified in InsightVM| -|PCI|PCI|False|Vulnerability PCI details| -|Published|date|False|Date the vulnerability was published| -|Risk Score|float|False|Vulnerability risk score using the configured risk scoring strategy (RealRisk by default)| -|Severity|string|False|Vulnerability severity string (Moderate/Severe/Critical)| -|Severity Score|integer|False|Vulnerability severity score| -|Title|string|False|Vulnerability title| - -#### vulnerability_description - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|HTML|string|False|Vulnerability description HTML| -|Text|string|False|Vulnerability description raw text| - -#### vulnerability_exception - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Expires|date|False|The date and time the vulnerability exception is set to expire| -|Vulnerability Exception ID|integer|True|The ID uniquely identifying the vulnerability exception| -|Links|[]link|False|Hypermedia links to corresponding or related resources| -|Review Details|object|False|Details of the exception review| -|Exception Scope|object|True|Details of the scope of the exception| -|State|string|True|The state of the vulnerability exception| -|Submission Details|object|True|Details of the exception submission| - -#### vulnerability_solution - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|Links|[]link|False|Hypermedia links to corresponding or related resources| -|Solutions|[]resources|False|Solutions to vulnerabilities| - -#### webApplication - -|Name|Type|Required|Description| -|----|----|--------|-----------| -|ID|integer|False|Identifier of the web application| -|Pages|[]page|False|Pages| -|Root|string|False|Web root of the web application| -|Virtual Host|string|False|Virtual host of the web application| ## Troubleshooting @@ -1148,6 +856,7 @@ _This plugin does not contain any troubleshooting information._ # Version History +* 5.0.0 - Vulnerability Search: fix `malware_kits` output and remove `Asset Criteria` input * 4.0.0 - Vulnerability Search: fix schema validation problem for exploits field * 3.3.0 - Asset Search: add filter fields: `current_time`, `comparison_time` * 3.2.0 - Add vulnerability search action @@ -1159,9 +868,9 @@ _This plugin does not contain any troubleshooting information._ * 1.0.0 - Initial plugin # Links +* [InsightVM Cloud API](https://help.rapid7.com/insightvm/en-us/api/integrations.html) ## References -* [InsightVM Cloud API](https://help.rapid7.com/insightvm/en-us/api/integrations.html) * [Managing Platform API Keys](https://docs.rapid7.com/insight/managing-platform-api-keys) * [Scan Engine Pairing](https://docs.rapid7.com/insightvm/scan-engine-management-on-the-insight-platform/#how-to-pair-your-scan-engines-to-the-insight-platform) diff --git a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/__init__.py b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/__init__.py index cd1ae73fb8..b38595d559 100755 --- a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/__init__.py +++ b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/__init__.py @@ -1,7 +1,14 @@ -# GENERATED BY KOMAND SDK - DO NOT EDIT +# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT + +from .start_scan.action import StartScan + +from .get_scan.action import GetScan + from .asset_search.action import AssetSearch + from .get_asset.action import GetAsset -from .get_scan.action import GetScan -from .start_scan.action import StartScan + from .stop_scan.action import StopScan + from .vuln_search.action import VulnSearch + diff --git a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/asset_search/__init__.py b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/asset_search/__init__.py index f16996f6c6..21cb5323e7 100755 --- a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/asset_search/__init__.py +++ b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/asset_search/__init__.py @@ -1,2 +1,2 @@ -# GENERATED BY KOMAND SDK - DO NOT EDIT +# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT from .action import AssetSearch diff --git a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/asset_search/schema.py b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/asset_search/schema.py index 7ce702c4ee..6ea9bec848 100755 --- a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/asset_search/schema.py +++ b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/asset_search/schema.py @@ -1,4 +1,4 @@ -# GENERATED BY KOMAND SDK - DO NOT EDIT +# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT import insightconnect_plugin_runtime import json @@ -14,14 +14,14 @@ class Input: SIZE = "size" SORT_CRITERIA = "sort_criteria" VULN_CRITERIA = "vuln_criteria" - + class Output: ASSETS = "assets" - + class AssetSearchInput(insightconnect_plugin_runtime.Input): - schema = json.loads(""" + schema = json.loads(r""" { "type": "object", "title": "Variables", @@ -34,18 +34,18 @@ class AssetSearchInput(insightconnect_plugin_runtime.Input): }, "comparison_time": { "type": "string", - "title": "Comparison Time", + "format": "date-time", "displayType": "date", + "title": "Comparison Time", "description": "The date and time to compare the asset current state against to detect changes", - "format": "date-time", "order": 6 }, "current_time": { "type": "string", - "title": "Current Time", + "format": "date-time", "displayType": "date", + "title": "Current Time", "description": "The current date and time to compare against the asset state to detect changes", - "format": "date-time", "order": 5 }, "size": { @@ -67,7 +67,8 @@ class AssetSearchInput(insightconnect_plugin_runtime.Input): "description": "Vulnerability criteria to filter by", "order": 4 } - } + }, + "definitions": {} } """) @@ -76,7 +77,7 @@ def __init__(self): class AssetSearchOutput(insightconnect_plugin_runtime.Output): - schema = json.loads(""" + schema = json.loads(r""" { "type": "object", "title": "Variables", @@ -186,15 +187,6 @@ class AssetSearchOutput(insightconnect_plugin_runtime.Output): "description": "Number of moderate vulnerabilities", "order": 14 }, - "new": { - "type": "array", - "title": "New Vulnerabilities", - "description": "Vulnerabilities that are the new between current and comparison time for the asset", - "items": { - "type": "string" - }, - "order": 28 - }, "os_architecture": { "type": "string", "title": "OS Architecture", @@ -237,15 +229,6 @@ class AssetSearchOutput(insightconnect_plugin_runtime.Output): "description": "Vendor of the os", "order": 21 }, - "remediated": { - "type": "array", - "title": "Remediated Vulnerabilities", - "description": "Vulnerabilities that were remediated in the latest version at current time for the asset", - "items": { - "type": "string" - }, - "order": 29 - }, "risk_score": { "type": "number", "title": "Risk Score", @@ -258,12 +241,6 @@ class AssetSearchOutput(insightconnect_plugin_runtime.Output): "description": "Number of sever vulns", "order": 23 }, - "source": { - "type": "string", - "title": "Source", - "description": "Source of the asset", - "order": 26 - }, "tags": { "type": "array", "title": "Tags", @@ -279,6 +256,12 @@ class AssetSearchOutput(insightconnect_plugin_runtime.Output): "description": "Total number of vulns", "order": 25 }, + "source": { + "type": "string", + "title": "Source", + "description": "Source of the asset", + "order": 26 + }, "unique_identifiers": { "type": "array", "title": "Unique Identifiers", @@ -287,91 +270,29 @@ class AssetSearchOutput(insightconnect_plugin_runtime.Output): "$ref": "#/definitions/identifiers" }, "order": 27 + }, + "new": { + "type": "array", + "title": "New Vulnerabilities", + "description": "Vulnerabilities that are the new between current and comparison time for the asset", + "items": { + "type": "string" + }, + "order": 28 + }, + "remediated": { + "type": "array", + "title": "Remediated Vulnerabilities", + "description": "Vulnerabilities that were remediated in the latest version at current time for the asset", + "items": { + "type": "string" + }, + "order": 29 } }, "required": [ "id" - ], - "definitions": { - "asset_tag": { - "type": "object", - "title": "asset_tag", - "properties": { - "name": { - "type": "string", - "title": "Name", - "description": "The name", - "order": 1 - }, - "type": { - "type": "string", - "title": "Type", - "description": "The type", - "order": 2 - } - } - }, - "creds": { - "type": "object", - "title": "creds", - "properties": { - "port": { - "type": "integer", - "title": "Port", - "description": "The port that is used", - "order": 1 - }, - "protocol": { - "type": "string", - "title": "Protocol", - "description": "TCP or other", - "order": 2 - }, - "status": { - "type": "string", - "title": "Status", - "description": "Which creds apply", - "order": 3 - } - } - }, - "identifiers": { - "type": "object", - "title": "identifiers", - "properties": { - "id": { - "type": "string", - "title": "ID", - "description": "The ID", - "order": 2 - }, - "source": { - "type": "string", - "title": "Source", - "description": "The source", - "order": 1 - } - } - } - } - }, - "asset_tag": { - "type": "object", - "title": "asset_tag", - "properties": { - "name": { - "type": "string", - "title": "Name", - "description": "The name", - "order": 1 - }, - "type": { - "type": "string", - "title": "Type", - "description": "The type", - "order": 2 - } - } + ] }, "creds": { "type": "object", @@ -397,21 +318,39 @@ class AssetSearchOutput(insightconnect_plugin_runtime.Output): } } }, - "identifiers": { + "asset_tag": { "type": "object", - "title": "identifiers", + "title": "asset_tag", "properties": { - "id": { + "name": { "type": "string", - "title": "ID", - "description": "The ID", - "order": 2 + "title": "Name", + "description": "The name", + "order": 1 }, + "type": { + "type": "string", + "title": "Type", + "description": "The type", + "order": 2 + } + } + }, + "identifiers": { + "type": "object", + "title": "identifiers", + "properties": { "source": { "type": "string", "title": "Source", "description": "The source", "order": 1 + }, + "id": { + "type": "string", + "title": "ID", + "description": "The ID", + "order": 2 } } } diff --git a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/get_asset/__init__.py b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/get_asset/__init__.py index 8847331b93..edd2ecb236 100755 --- a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/get_asset/__init__.py +++ b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/get_asset/__init__.py @@ -1,2 +1,2 @@ -# GENERATED BY KOMAND SDK - DO NOT EDIT +# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT from .action import GetAsset diff --git a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/get_asset/schema.py b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/get_asset/schema.py index 97d5ebc015..d28a24970c 100755 --- a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/get_asset/schema.py +++ b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/get_asset/schema.py @@ -1,4 +1,4 @@ -# GENERATED BY KOMAND SDK - DO NOT EDIT +# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT import insightconnect_plugin_runtime import json @@ -10,15 +10,15 @@ class Component: class Input: ID = "id" INCLUDE_VULNS = "include_vulns" - + class Output: ASSET = "asset" VULNERABILITIES = "vulnerabilities" - + class GetAssetInput(insightconnect_plugin_runtime.Input): - schema = json.loads(""" + schema = json.loads(r""" { "type": "object", "title": "Variables", @@ -39,7 +39,8 @@ class GetAssetInput(insightconnect_plugin_runtime.Input): }, "required": [ "id" - ] + ], + "definitions": {} } """) @@ -48,7 +49,7 @@ def __init__(self): class GetAssetOutput(insightconnect_plugin_runtime.Output): - schema = json.loads(""" + schema = json.loads(r""" { "type": "object", "title": "Variables", @@ -164,15 +165,6 @@ class GetAssetOutput(insightconnect_plugin_runtime.Output): "description": "Number of moderate vulnerabilities", "order": 14 }, - "new": { - "type": "array", - "title": "New Vulnerabilities", - "description": "Vulnerabilities that are the new between current and comparison time for the asset", - "items": { - "type": "string" - }, - "order": 28 - }, "os_architecture": { "type": "string", "title": "OS Architecture", @@ -215,15 +207,6 @@ class GetAssetOutput(insightconnect_plugin_runtime.Output): "description": "Vendor of the os", "order": 21 }, - "remediated": { - "type": "array", - "title": "Remediated Vulnerabilities", - "description": "Vulnerabilities that were remediated in the latest version at current time for the asset", - "items": { - "type": "string" - }, - "order": 29 - }, "risk_score": { "type": "number", "title": "Risk Score", @@ -236,12 +219,6 @@ class GetAssetOutput(insightconnect_plugin_runtime.Output): "description": "Number of sever vulns", "order": 23 }, - "source": { - "type": "string", - "title": "Source", - "description": "Source of the asset", - "order": 26 - }, "tags": { "type": "array", "title": "Tags", @@ -257,6 +234,12 @@ class GetAssetOutput(insightconnect_plugin_runtime.Output): "description": "Total number of vulns", "order": 25 }, + "source": { + "type": "string", + "title": "Source", + "description": "Source of the asset", + "order": 26 + }, "unique_identifiers": { "type": "array", "title": "Unique Identifiers", @@ -265,71 +248,51 @@ class GetAssetOutput(insightconnect_plugin_runtime.Output): "$ref": "#/definitions/identifiers" }, "order": 27 + }, + "new": { + "type": "array", + "title": "New Vulnerabilities", + "description": "Vulnerabilities that are the new between current and comparison time for the asset", + "items": { + "type": "string" + }, + "order": 28 + }, + "remediated": { + "type": "array", + "title": "Remediated Vulnerabilities", + "description": "Vulnerabilities that were remediated in the latest version at current time for the asset", + "items": { + "type": "string" + }, + "order": 29 } }, "required": [ "id" - ], - "definitions": { - "asset_tag": { - "type": "object", - "title": "asset_tag", - "properties": { - "name": { - "type": "string", - "title": "Name", - "description": "The name", - "order": 1 - }, - "type": { - "type": "string", - "title": "Type", - "description": "The type", - "order": 2 - } - } - }, - "creds": { - "type": "object", - "title": "creds", - "properties": { - "port": { - "type": "integer", - "title": "Port", - "description": "The port that is used", - "order": 1 - }, - "protocol": { - "type": "string", - "title": "Protocol", - "description": "TCP or other", - "order": 2 - }, - "status": { - "type": "string", - "title": "Status", - "description": "Which creds apply", - "order": 3 - } - } - }, - "identifiers": { - "type": "object", - "title": "identifiers", - "properties": { - "id": { - "type": "string", - "title": "ID", - "description": "The ID", - "order": 2 - }, - "source": { - "type": "string", - "title": "Source", - "description": "The source", - "order": 1 - } - } + ] + }, + "creds": { + "type": "object", + "title": "creds", + "properties": { + "port": { + "type": "integer", + "title": "Port", + "description": "The port that is used", + "order": 1 + }, + "protocol": { + "type": "string", + "title": "Protocol", + "description": "TCP or other", + "order": 2 + }, + "status": { + "type": "string", + "title": "Status", + "description": "Which creds apply", + "order": 3 } } }, @@ -351,16 +314,34 @@ class GetAssetOutput(insightconnect_plugin_runtime.Output): } } }, + "identifiers": { + "type": "object", + "title": "identifiers", + "properties": { + "source": { + "type": "string", + "title": "Source", + "description": "The source", + "order": 1 + }, + "id": { + "type": "string", + "title": "ID", + "description": "The ID", + "order": 2 + } + } + }, "asset_vulnerability": { "type": "object", "title": "asset_vulnerability", "properties": { "first_found": { "type": "string", - "title": "First Found", + "format": "date-time", "displayType": "date", + "title": "First Found", "description": "Date the vulnerability was first found in InsightVM", - "format": "date-time", "order": 1 }, "key": { @@ -371,16 +352,16 @@ class GetAssetOutput(insightconnect_plugin_runtime.Output): }, "last_found": { "type": "string", - "title": "Last Found", + "format": "date-time", "displayType": "date", + "title": "Last Found", "description": "Date the vulnerability was last found in InsightVM", - "format": "date-time", "order": 3 }, "proof": { "type": "string", "title": "Proof", - "description": "Proof of the vulnerability, i.e. \\u003cp\\u003e\\u003cp\\u003eOpenBSD OpenSSH 4.3 on Linux\\u003c/p\\u003e\\u003c/p\\u003e", + "description": "Proof of the vulnerability, i.e.

OpenBSD OpenSSH 4.3 on Linux

", "order": 4 }, "solution_fix": { @@ -423,48 +404,6 @@ class GetAssetOutput(insightconnect_plugin_runtime.Output): "required": [ "solution_type" ] - }, - "creds": { - "type": "object", - "title": "creds", - "properties": { - "port": { - "type": "integer", - "title": "Port", - "description": "The port that is used", - "order": 1 - }, - "protocol": { - "type": "string", - "title": "Protocol", - "description": "TCP or other", - "order": 2 - }, - "status": { - "type": "string", - "title": "Status", - "description": "Which creds apply", - "order": 3 - } - } - }, - "identifiers": { - "type": "object", - "title": "identifiers", - "properties": { - "id": { - "type": "string", - "title": "ID", - "description": "The ID", - "order": 2 - }, - "source": { - "type": "string", - "title": "Source", - "description": "The source", - "order": 1 - } - } } } } diff --git a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/get_scan/__init__.py b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/get_scan/__init__.py index 514534c165..22ae2edb3f 100755 --- a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/get_scan/__init__.py +++ b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/get_scan/__init__.py @@ -1,2 +1,2 @@ -# GENERATED BY KOMAND SDK - DO NOT EDIT +# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT from .action import GetScan diff --git a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/get_scan/schema.py b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/get_scan/schema.py index 22342b7f91..182f68ed0f 100755 --- a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/get_scan/schema.py +++ b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/get_scan/schema.py @@ -1,4 +1,4 @@ -# GENERATED BY KOMAND SDK - DO NOT EDIT +# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT import insightconnect_plugin_runtime import json @@ -9,7 +9,7 @@ class Component: class Input: SCAN_ID = "scan_id" - + class Output: ASSET_IDS = "asset_ids" @@ -18,10 +18,10 @@ class Output: SCAN_ID = "scan_id" STARTED = "started" STATUS = "status" - + class GetScanInput(insightconnect_plugin_runtime.Input): - schema = json.loads(""" + schema = json.loads(r""" { "type": "object", "title": "Variables", @@ -35,7 +35,8 @@ class GetScanInput(insightconnect_plugin_runtime.Input): }, "required": [ "scan_id" - ] + ], + "definitions": {} } """) @@ -44,7 +45,7 @@ def __init__(self): class GetScanOutput(insightconnect_plugin_runtime.Output): - schema = json.loads(""" + schema = json.loads(r""" { "type": "object", "title": "Variables", @@ -60,10 +61,10 @@ class GetScanOutput(insightconnect_plugin_runtime.Output): }, "finished": { "type": "string", - "title": "Finished", + "format": "date-time", "displayType": "date", + "title": "Finished", "description": "When the scan was finished", - "format": "date-time", "order": 6 }, "name": { @@ -80,10 +81,10 @@ class GetScanOutput(insightconnect_plugin_runtime.Output): }, "started": { "type": "string", - "title": "Started", + "format": "date-time", "displayType": "date", + "title": "Started", "description": "When the scan was started", - "format": "date-time", "order": 5 }, "status": { @@ -92,7 +93,8 @@ class GetScanOutput(insightconnect_plugin_runtime.Output): "description": "Current status of the retrieved scan", "order": 4 } - } + }, + "definitions": {} } """) diff --git a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/start_scan/__init__.py b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/start_scan/__init__.py index 829d3b05cd..10f2b5c34f 100755 --- a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/start_scan/__init__.py +++ b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/start_scan/__init__.py @@ -1,2 +1,2 @@ -# GENERATED BY KOMAND SDK - DO NOT EDIT +# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT from .action import StartScan diff --git a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/start_scan/schema.py b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/start_scan/schema.py index b87f68a9fb..b5b000b4fe 100755 --- a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/start_scan/schema.py +++ b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/start_scan/schema.py @@ -1,4 +1,4 @@ -# GENERATED BY KOMAND SDK - DO NOT EDIT +# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT import insightconnect_plugin_runtime import json @@ -12,16 +12,16 @@ class Input: HOSTNAMES = "hostnames" IPS = "ips" NAME = "name" - + class Output: ASSET_IDS = "asset_ids" DATA = "data" IDS = "ids" - + class StartScanInput(insightconnect_plugin_runtime.Input): - schema = json.loads(""" + schema = json.loads(r""" { "type": "object", "title": "Variables", @@ -62,7 +62,8 @@ class StartScanInput(insightconnect_plugin_runtime.Input): }, "required": [ "name" - ] + ], + "definitions": {} } """) @@ -71,7 +72,7 @@ def __init__(self): class StartScanOutput(insightconnect_plugin_runtime.Output): - schema = json.loads(""" + schema = json.loads(r""" { "type": "object", "title": "Variables", @@ -100,7 +101,8 @@ class StartScanOutput(insightconnect_plugin_runtime.Output): }, "order": 1 } - } + }, + "definitions": {} } """) diff --git a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/stop_scan/__init__.py b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/stop_scan/__init__.py index ee79682c8a..6cc965c6f7 100755 --- a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/stop_scan/__init__.py +++ b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/stop_scan/__init__.py @@ -1,2 +1,2 @@ -# GENERATED BY KOMAND SDK - DO NOT EDIT +# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT from .action import StopScan diff --git a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/stop_scan/schema.py b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/stop_scan/schema.py index f20a9673bc..e178b3ff3d 100755 --- a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/stop_scan/schema.py +++ b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/stop_scan/schema.py @@ -1,4 +1,4 @@ -# GENERATED BY KOMAND SDK - DO NOT EDIT +# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT import insightconnect_plugin_runtime import json @@ -9,16 +9,16 @@ class Component: class Input: ID = "id" - + class Output: MESSAGE = "message" STATUS_CODE = "status_code" SUCCESS = "success" - + class StopScanInput(insightconnect_plugin_runtime.Input): - schema = json.loads(""" + schema = json.loads(r""" { "type": "object", "title": "Variables", @@ -32,7 +32,8 @@ class StopScanInput(insightconnect_plugin_runtime.Input): }, "required": [ "id" - ] + ], + "definitions": {} } """) @@ -41,7 +42,7 @@ def __init__(self): class StopScanOutput(insightconnect_plugin_runtime.Output): - schema = json.loads(""" + schema = json.loads(r""" { "type": "object", "title": "Variables", @@ -67,7 +68,8 @@ class StopScanOutput(insightconnect_plugin_runtime.Output): }, "required": [ "success" - ] + ], + "definitions": {} } """) diff --git a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/vuln_search/__init__.py b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/vuln_search/__init__.py index 328b3ca2da..9e1abf96be 100755 --- a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/vuln_search/__init__.py +++ b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/vuln_search/__init__.py @@ -1,2 +1,2 @@ -# GENERATED BY KOMAND SDK - DO NOT EDIT +# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT from .action import VulnSearch diff --git a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/vuln_search/action.py b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/vuln_search/action.py index 8f63f1e39a..0e1b79a9e2 100755 --- a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/vuln_search/action.py +++ b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/vuln_search/action.py @@ -1,5 +1,6 @@ import insightconnect_plugin_runtime from .schema import VulnSearchInput, VulnSearchOutput, Input, Output, Component +import logging # Constants below MAX_SIZE = 500 @@ -13,7 +14,6 @@ def __init__(self): ) def run(self, params={}): - asset_crit = params.get(Input.ASSET_CRITERIA) vuln_crit = params.get(Input.VULN_CRITERIA) size = params.get(Input.SIZE, AVG_SIZE) sort_criteria = params.get(Input.SORT_CRITERIA, {}) @@ -29,9 +29,9 @@ def run(self, params={}): self.logger.info(f"'{size}' must be greater than zero, set to average size of 200.") size = AVG_SIZE parameters.append(("size", size)) - if asset_crit or vuln_crit: - body = {"asset": asset_crit, "vulnerability": vuln_crit} - resources = self.connection.ivm_cloud_api.call_api("vulnerabilities", "POST", params, body) + if vuln_crit: + body = {"vulnerability": vuln_crit} + resources = self.connection.ivm_cloud_api.call_api("vulnerabilities", "POST", parameters, body) else: resources = self.connection.ivm_cloud_api.call_api("vulnerabilities", "POST", parameters) diff --git a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/vuln_search/schema.py b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/vuln_search/schema.py index 34f8cc0f59..4fa7851615 100644 --- a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/vuln_search/schema.py +++ b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/actions/vuln_search/schema.py @@ -1,4 +1,4 @@ -# GENERATED BY KOMAND SDK - DO NOT EDIT +# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT import insightconnect_plugin_runtime import json @@ -8,28 +8,21 @@ class Component: class Input: - ASSET_CRITERIA = "asset_criteria" SIZE = "size" SORT_CRITERIA = "sort_criteria" VULN_CRITERIA = "vuln_criteria" - + class Output: VULNERABILITIES = "vulnerabilities" - + class VulnSearchInput(insightconnect_plugin_runtime.Input): - schema = json.loads(""" + schema = json.loads(r""" { "type": "object", "title": "Variables", "properties": { - "asset_criteria": { - "type": "string", - "title": "Asset Criteria", - "description": "Filters to apply to the asset search such as IPv4 or IPv6 addresses and hostnames", - "order": 3 - }, "size": { "type": "integer", "title": "Size", @@ -47,9 +40,10 @@ class VulnSearchInput(insightconnect_plugin_runtime.Input): "type": "string", "title": "Vulnerability Criteria", "description": "Vulnerability criteria to filter by", - "order": 4 + "order": 3 } - } + }, + "definitions": {} } """) @@ -58,7 +52,7 @@ def __init__(self): class VulnSearchOutput(insightconnect_plugin_runtime.Output): - schema = json.loads(""" + schema = json.loads(r""" { "type": "object", "title": "Variables", @@ -77,6 +71,149 @@ class VulnSearchOutput(insightconnect_plugin_runtime.Output): "vulnerabilities" ], "definitions": { + "vulnerability": { + "type": "object", + "title": "vulnerability", + "properties": { + "title": { + "type": "string", + "title": "Title", + "description": "Name of the vulnerability", + "order": 1 + }, + "description": { + "type": "string", + "title": "Description", + "description": "Description of the vulnerability", + "order": 2 + }, + "added": { + "type": "string", + "format": "date-time", + "displayType": "date", + "title": "Added", + "description": "Date the vulnerability was last added to an asset", + "order": 3 + }, + "modified": { + "type": "string", + "format": "date-time", + "displayType": "date", + "title": "Modified", + "description": "Date the vulnerability was last modified", + "order": 4 + }, + "published": { + "type": "string", + "format": "date-time", + "displayType": "date", + "title": "Published", + "description": "Date the vulnerability was added to InsightVM", + "order": 5 + }, + "categories": { + "type": "string", + "title": "Categories", + "description": "Labels this vulnerability falls under", + "order": 6 + }, + "cves": { + "type": "string", + "title": "CVES", + "description": "CVES ID", + "order": 7 + }, + "cvss_v2": { + "$ref": "#/definitions/cvss_v2", + "title": "CVSSv2", + "description": "information regarding CVSSv2", + "order": 8 + }, + "cvss_v3": { + "$ref": "#/definitions/cvss_v3", + "title": "CVSSv3", + "description": "information regarding CVSSv3", + "order": 9 + }, + "denial_of_service": { + "type": "boolean", + "title": "Denial of Service", + "description": "Whether or not this vulnerability is a denial of service attack", + "order": 10 + }, + "exploits": { + "type": "array", + "title": "Exploits", + "description": "List of exploits related to the vulnerability", + "items": { + "$ref": "#/definitions/exploit" + }, + "order": 11 + }, + "id": { + "type": "string", + "title": "ID", + "description": "ID of the vulnerability", + "order": 12 + }, + "links": { + "type": "array", + "title": "Links", + "description": "List of links related to the vulnerability", + "items": { + "$ref": "#/definitions/link" + }, + "order": 13 + }, + "malware_kits": { + "type": "array", + "title": "Malware Kits", + "description": "List of malware kits related to the vulnerability", + "items": { + "type": "object" + }, + "order": 14 + }, + "pci": { + "$ref": "#/definitions/pci", + "title": "PCI", + "description": "information regarding PCI", + "order": 15 + }, + "references": { + "type": "string", + "title": "References", + "description": "Links to information related to the vulnerability", + "order": 16 + }, + "risk_score": { + "type": "number", + "title": "Risk Score", + "description": "Risk score (with criticality adjustments) of the vulnerability", + "order": 17 + }, + "severity": { + "type": "string", + "title": "Severity", + "description": "Severity of the vulnerability", + "order": 18 + }, + "severity_score": { + "type": "integer", + "title": "Severity Score", + "description": "Severity score of the vulnerability", + "order": 19 + } + }, + "required": [ + "categories", + "id", + "published", + "risk_score", + "severity", + "severity_score" + ] + }, "cvss_v2": { "type": "object", "title": "cvss_v2", @@ -324,399 +461,6 @@ class VulnSearchOutput(insightconnect_plugin_runtime.Output): "order": 5 } } - }, - "vulnerability": { - "type": "object", - "title": "vulnerability", - "properties": { - "added": { - "type": "string", - "title": "Added", - "displayType": "date", - "description": "Date the vulnerability was last added to an asset", - "format": "date-time", - "order": 3 - }, - "categories": { - "type": "string", - "title": "Categories", - "description": "Labels this vulnerability falls under", - "order": 6 - }, - "cves": { - "type": "string", - "title": "CVES", - "description": "CVES ID", - "order": 7 - }, - "cvss_v2": { - "$ref": "#/definitions/cvss_v2", - "title": "CVSSv2", - "description": "information regarding CVSSv2", - "order": 8 - }, - "cvss_v3": { - "$ref": "#/definitions/cvss_v3", - "title": "CVSSv3", - "description": "information regarding CVSSv3", - "order": 9 - }, - "denial_of_service": { - "type": "boolean", - "title": "Denial of Service", - "description": "Whether or not this vulnerability is a denial of service attack", - "order": 10 - }, - "description": { - "type": "string", - "title": "Description", - "description": "Description of the vulnerability", - "order": 2 - }, - "exploits": { - "type": "array", - "title": "Exploits", - "description": "List of exploits related to the vulnerability", - "items": { - "$ref": "#/definitions/exploit" - }, - "order": 11 - }, - "id": { - "type": "string", - "title": "ID", - "description": "ID of the vulnerability", - "order": 12 - }, - "links": { - "type": "array", - "title": "Links", - "description": "List of links related to the vulnerability", - "items": { - "$ref": "#/definitions/link" - }, - "order": 13 - }, - "malware_kits": { - "type": "array", - "title": "Malware Kits", - "description": "List of malware kits related to the vulnerability", - "items": { - "type": "string" - }, - "order": 14 - }, - "modified": { - "type": "string", - "title": "Modified", - "displayType": "date", - "description": "Date the vulnerability was last modified", - "format": "date-time", - "order": 4 - }, - "pci": { - "$ref": "#/definitions/pci", - "title": "PCI", - "description": "information regarding PCI", - "order": 15 - }, - "published": { - "type": "string", - "title": "Published", - "displayType": "date", - "description": "Date the vulnerability was added to InsightVM", - "format": "date-time", - "order": 5 - }, - "references": { - "type": "string", - "title": "References", - "description": "Links to information related to the vulnerability", - "order": 16 - }, - "risk_score": { - "type": "number", - "title": "Risk Score", - "description": "Risk score (with criticality adjustments) of the vulnerability", - "order": 17 - }, - "severity": { - "type": "string", - "title": "Severity", - "description": "Severity of the vulnerability", - "order": 18 - }, - "severity_score": { - "type": "integer", - "title": "Severity Score", - "description": "Severity score of the vulnerability", - "order": 19 - }, - "title": { - "type": "string", - "title": "Title", - "description": "Name of the vulnerability", - "order": 1 - } - }, - "required": [ - "categories", - "id", - "published", - "risk_score", - "severity", - "severity_score" - ], - "definitions": { - "cvss_v2": { - "type": "object", - "title": "cvss_v2", - "properties": { - "access_complexity": { - "type": "string", - "title": "Access Complexity", - "description": "CVSSv2 access complexity metric", - "order": 1 - }, - "access_vector": { - "type": "string", - "title": "Access Vector", - "description": "CVSSv2 access vector metric", - "order": 2 - }, - "authentication": { - "type": "string", - "title": "Authentication", - "description": "CVSSv2 authentication metric", - "order": 3 - }, - "availability_impact": { - "type": "string", - "title": "Availability Impact", - "description": "CVSSv2 availability impact metric", - "order": 4 - }, - "confidentiality_impact": { - "type": "string", - "title": "Confidentiality Impact", - "description": "CVSSv2 confidentiality impact metric", - "order": 5 - }, - "exploit_score": { - "type": "number", - "title": "Exploit Score", - "description": "CVSSv2 combined exploit metric score (Access Complexity/Access Vector/Authentication)", - "order": 6 - }, - "impact_score": { - "type": "number", - "title": "Impact Score", - "description": "CVSSv2 combined impact metric score (Confidentiality/Integrity/Availability)", - "order": 7 - }, - "integrity_impact": { - "type": "string", - "title": "Integrity Impact", - "description": "CVSSv2 integrity impact metric", - "order": 8 - }, - "score": { - "type": "number", - "title": "Score", - "description": "CVSSv2 score", - "order": 9 - }, - "vector": { - "type": "string", - "title": "Vector", - "description": "CVSSv2 combined vector string", - "order": 10 - } - } - }, - "cvss_v3": { - "type": "object", - "title": "cvss_v3", - "properties": { - "attack_complexity": { - "type": "string", - "title": "Attack Complexity", - "description": "CVSSv3 attack complexity metric", - "order": 1 - }, - "attack_vector": { - "type": "string", - "title": "Attack Vector", - "description": "CVSSv3 attack vector metric", - "order": 2 - }, - "availability_impact": { - "type": "string", - "title": "Availability Impact", - "description": "CVSSv3 availability impact metric", - "order": 3 - }, - "confidentiality_impact": { - "type": "string", - "title": "Confidentiality Impact", - "description": "CVSSv3 confidentiality impact metric", - "order": 4 - }, - "exploit_score": { - "type": "number", - "title": "Exploit Score", - "description": "CVSSv3 combined exploit metric score (Attack Complexity/Attack Vector/Privilege Required/Scope/User Interaction)", - "order": 5 - }, - "impact_score": { - "type": "number", - "title": "Impact Score", - "description": "CVSSv3 combined impact metric score (Confidentiality/Integrity/Availability)", - "order": 6 - }, - "integrity_impact": { - "type": "string", - "title": "Integrity Impact", - "description": "CVSSv3 integrity impact metric", - "order": 7 - }, - "privilege_required": { - "type": "string", - "title": "Privilege Required", - "description": "CVSSv3 privilege required metric", - "order": 8 - }, - "scope": { - "type": "string", - "title": "Scope", - "description": "CVSSv3 scope metric", - "order": 9 - }, - "score": { - "type": "number", - "title": "Score", - "description": "CVSSv3 score", - "order": 10 - }, - "user_interaction": { - "type": "string", - "title": "User Interaction", - "description": "CVSSv3 user interaction metric", - "order": 11 - }, - "vector": { - "type": "string", - "title": "Vector", - "description": "CVSSv3 combined vector string", - "order": 12 - } - } - }, - "exploit": { - "type": "object", - "title": "exploit", - "properties": { - "description": { - "type": "string", - "title": "Description", - "description": "A verbose description of the exploit", - "order": 1 - }, - "id": { - "type": "string", - "title": "ID", - "description": "The identifier of the exploit", - "order": 2 - }, - "name": { - "type": "string", - "title": "Name", - "description": "The name of the exploit", - "order": 3 - }, - "rank": { - "type": "string", - "title": "Rank", - "description": "The exploit rank", - "order": 4 - }, - "skill_level": { - "type": "string", - "title": "Skill level", - "description": "The level of skill required to use the exploit", - "order": 5 - }, - "source": { - "type": "string", - "title": "Source", - "description": "Details about where the exploit is defined", - "order": 6 - } - }, - "required": [ - "description", - "id", - "name", - "rank", - "skill_level", - "source" - ] - }, - "link": { - "type": "object", - "title": "link", - "properties": { - "href": { - "type": "string", - "title": "URL", - "description": "A hypertext reference, which is either a URI (see RFC 3986) or URI template (see RFC 6570)", - "order": 1 - }, - "rel": { - "type": "string", - "title": "Rel", - "description": "Link relation type following RFC 5988", - "order": 2 - } - } - }, - "pci": { - "type": "object", - "title": "pci", - "properties": { - "adjusted_CVSS_score": { - "type": "integer", - "title": "Adjusted CVSS score", - "description": "PCI adjusted CVSS score", - "order": 1 - }, - "adjusted_severity_score": { - "type": "integer", - "title": "Adjusted severity score", - "description": "PCI adjusted severity score", - "order": 2 - }, - "fail": { - "type": "boolean", - "title": "Fail", - "description": "Whether this vulnerability results in a PCI assessment failure", - "order": 3 - }, - "special_notes": { - "type": "string", - "title": "Special Notes", - "description": "PCI special notes", - "order": 4 - }, - "status": { - "type": "string", - "title": "Status", - "description": "PCI status", - "order": 5 - } - } - } - } } } } diff --git a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/connection/__init__.py b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/connection/__init__.py index a515dcf6b0..c78d3356be 100755 --- a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/connection/__init__.py +++ b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/connection/__init__.py @@ -1,2 +1,2 @@ -# GENERATED BY KOMAND SDK - DO NOT EDIT +# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT from .connection import Connection diff --git a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/connection/schema.py b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/connection/schema.py index 52d9344719..382fa05d50 100755 --- a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/connection/schema.py +++ b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/connection/schema.py @@ -1,4 +1,4 @@ -# GENERATED BY KOMAND SDK - DO NOT EDIT +# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT import insightconnect_plugin_runtime import json @@ -6,10 +6,10 @@ class Input: CREDENTIALS = "credentials" REGION = "region" - + class ConnectionSchema(insightconnect_plugin_runtime.Input): - schema = json.loads(""" + schema = json.loads(r""" { "type": "object", "title": "Variables", @@ -46,18 +46,18 @@ class ConnectionSchema(insightconnect_plugin_runtime.Input): "type": "object", "title": "Credential: Secret Key", "description": "A shared secret key", + "required": [ + "secretKey" + ], "properties": { "secretKey": { "type": "string", "title": "Secret Key", - "displayType": "password", "description": "The shared secret key", - "format": "password" + "format": "password", + "displayType": "password" } - }, - "required": [ - "secretKey" - ] + } } } } diff --git a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/tasks/__init__.py b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/tasks/__init__.py new file mode 100644 index 0000000000..7020c9a4ad --- /dev/null +++ b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/tasks/__init__.py @@ -0,0 +1,2 @@ +# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT + diff --git a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/triggers/__init__.py b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/triggers/__init__.py index bace8db897..7020c9a4ad 100755 --- a/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/triggers/__init__.py +++ b/plugins/rapid7_insightvm_cloud/icon_rapid7_insightvm_cloud/triggers/__init__.py @@ -1 +1,2 @@ -# GENERATED BY KOMAND SDK - DO NOT EDIT +# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT + diff --git a/plugins/rapid7_insightvm_cloud/plugin.spec.yaml b/plugins/rapid7_insightvm_cloud/plugin.spec.yaml index e60ae2d9b2..6350e8a58e 100644 --- a/plugins/rapid7_insightvm_cloud/plugin.spec.yaml +++ b/plugins/rapid7_insightvm_cloud/plugin.spec.yaml @@ -4,10 +4,10 @@ products: [insightconnect] name: rapid7_insightvm_cloud title: Rapid7 InsightVM Cloud description: InsightVM is a powerful vulnerability management tool which finds, prioritizes, and remediates vulnerabilities. This plugin uses the InsightVM Cloud Integrations API to view assets and start scans -version: 4.0.0 +version: 5.0.0 vendor: rapid7 support: rapid7 -supported_versions: ["InsightVM Cloud Integration API v4", "2022-08-10"] +supported_versions: ["InsightVM Cloud Integration API v4", "2023-11-24"] status: [] cloud_ready: true resources: @@ -940,7 +940,7 @@ types: malware_kits: title: Malware Kits description: List of malware kits related to the vulnerability - type: '[]string' + type: '[]object' required: false pci: title: PCI @@ -1202,12 +1202,6 @@ actions: type: object required: false example: "{'risk-score': 'asc', 'criticality-tag': 'desc'}" - asset_criteria: - title: Asset Criteria - description: Filters to apply to the asset search such as IPv4 or IPv6 addresses and hostnames - type: string - example: "asset.ipv4 = 2001:db8:1:1:1:1:1:1 || asset.name STARTS WITH 'example'" - required: false vuln_criteria: title: Vulnerability Criteria description: Vulnerability criteria to filter by diff --git a/plugins/rapid7_insightvm_cloud/setup.py b/plugins/rapid7_insightvm_cloud/setup.py index b8538a0365..001c277f8d 100755 --- a/plugins/rapid7_insightvm_cloud/setup.py +++ b/plugins/rapid7_insightvm_cloud/setup.py @@ -1,9 +1,9 @@ -# GENERATED BY KOMAND SDK - DO NOT EDIT +# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT from setuptools import setup, find_packages setup(name="rapid7_insightvm_cloud-rapid7-plugin", - version="4.0.0", + version="5.0.0", description="InsightVM is a powerful vulnerability management tool which finds, prioritizes, and remediates vulnerabilities. This plugin uses the InsightVM Cloud Integrations API to view assets and start scans", author="rapid7", author_email="", diff --git a/plugins/rapid7_insightvm_cloud/unit_test/test_asset_search.py b/plugins/rapid7_insightvm_cloud/unit_test/test_asset_search.py index 9a5ba495d0..017290f232 100644 --- a/plugins/rapid7_insightvm_cloud/unit_test/test_asset_search.py +++ b/plugins/rapid7_insightvm_cloud/unit_test/test_asset_search.py @@ -6,12 +6,13 @@ sys.path.append(os.path.abspath("../")) from unittest import TestCase +from jsonschema import validate from icon_rapid7_insightvm_cloud.actions.asset_search import AssetSearch -from icon_rapid7_insightvm_cloud.actions.asset_search.schema import Input +from icon_rapid7_insightvm_cloud.actions.asset_search.schema import Input, AssetSearchOutput from icon_rapid7_insightvm_cloud.connection.schema import Input as ConnectionInput from unittest.mock import patch -from unit_test.utils import Utils -from unit_test.mock import ( +from utils import Utils +from mock import ( mock_request, ) @@ -46,6 +47,7 @@ def test_asset_search_all_inputs(self, _mock_req): ) expected = Utils.read_file_to_dict("expected_responses/asset_search.json.resp") self.assertEqual(expected, actual) + validate(actual, AssetSearchOutput.schema) # test finding event via all inputs @patch("requests.request", side_effect=mock_request) @@ -53,6 +55,7 @@ def test_asset_search_no_input(self, _mock_req): actual = self.action.run() expected = Utils.read_file_to_dict("expected_responses/asset_search.json.resp") self.assertEqual(expected, actual) + validate(actual, AssetSearchOutput.schema) # test finding event via all inputs @patch("requests.request", side_effect=mock_request) diff --git a/plugins/rapid7_insightvm_cloud/unit_test/test_get_asset.py b/plugins/rapid7_insightvm_cloud/unit_test/test_get_asset.py index 5f0de325d2..62856f0aee 100644 --- a/plugins/rapid7_insightvm_cloud/unit_test/test_get_asset.py +++ b/plugins/rapid7_insightvm_cloud/unit_test/test_get_asset.py @@ -6,12 +6,13 @@ sys.path.append(os.path.abspath("../")) from unittest import TestCase +from jsonschema import validate from icon_rapid7_insightvm_cloud.actions.get_asset import GetAsset -from icon_rapid7_insightvm_cloud.actions.get_asset.schema import Input +from icon_rapid7_insightvm_cloud.actions.get_asset.schema import Input, GetAssetOutput from icon_rapid7_insightvm_cloud.connection.schema import Input as ConnectionInput from unittest.mock import patch -from unit_test.utils import Utils -from unit_test.mock import ( +from utils import Utils +from mock import ( mock_request, ) @@ -37,6 +38,7 @@ def test_get_asset_include_vulns_false(self, _mock_req): ) expected = Utils.read_file_to_dict("expected_responses/get_asset.json.resp") self.assertEqual(expected, actual) + validate(actual, GetAssetOutput.schema) # test finding event via all inputs @patch("requests.request", side_effect=mock_request) @@ -46,6 +48,7 @@ def test_get_asset_include_vulns_true(self, _mock_req): ) expected = Utils.read_file_to_dict("expected_responses/get_asset_include_vulns.json.resp") self.assertEqual(expected, actual) + validate(actual, GetAssetOutput.schema) # test finding event via all inputs @patch("requests.request", side_effect=mock_request) diff --git a/plugins/rapid7_insightvm_cloud/unit_test/test_get_scan.py b/plugins/rapid7_insightvm_cloud/unit_test/test_get_scan.py index 151157c4ae..b6b952a098 100644 --- a/plugins/rapid7_insightvm_cloud/unit_test/test_get_scan.py +++ b/plugins/rapid7_insightvm_cloud/unit_test/test_get_scan.py @@ -6,12 +6,13 @@ sys.path.append(os.path.abspath("../")) from unittest import TestCase +from jsonschema import validate from icon_rapid7_insightvm_cloud.actions.get_scan import GetScan -from icon_rapid7_insightvm_cloud.actions.get_scan.schema import Input +from icon_rapid7_insightvm_cloud.actions.get_scan.schema import Input, GetScanOutput from icon_rapid7_insightvm_cloud.connection.schema import Input as ConnectionInput from unittest.mock import patch -from unit_test.utils import Utils -from unit_test.mock import ( +from utils import Utils +from mock import ( mock_request, ) @@ -33,6 +34,7 @@ def test_get_scan(self, _mock_req): actual = self.action.run({Input.SCAN_ID: self.params.get("scan_id")}) expected = Utils.read_file_to_dict("expected_responses/get_scan.json.resp") self.assertEqual(expected, actual) + validate(actual, GetScanOutput.schema) # test finding event via all inputs @patch("requests.request", side_effect=mock_request) diff --git a/plugins/rapid7_insightvm_cloud/unit_test/test_start_scan.py b/plugins/rapid7_insightvm_cloud/unit_test/test_start_scan.py index 45b570df8a..81150f3c60 100644 --- a/plugins/rapid7_insightvm_cloud/unit_test/test_start_scan.py +++ b/plugins/rapid7_insightvm_cloud/unit_test/test_start_scan.py @@ -6,12 +6,13 @@ sys.path.append(os.path.abspath("../")) from unittest import TestCase +from jsonschema import validate from icon_rapid7_insightvm_cloud.connection.schema import Input as ConnectionInput from icon_rapid7_insightvm_cloud.actions.start_scan import StartScan -from icon_rapid7_insightvm_cloud.actions.start_scan.schema import Input +from icon_rapid7_insightvm_cloud.actions.start_scan.schema import Input, StartScanOutput from unittest.mock import patch -from unit_test.utils import Utils -from unit_test.mock import ( +from utils import Utils +from mock import ( mock_request, ) @@ -49,6 +50,7 @@ def test_start_scan(self, _mock_req): ) expected = Utils.read_file_to_dict("expected_responses/start_scan.json.resp") self.assertEqual(expected, actual) + validate(actual, StartScanOutput.schema) @patch("requests.request", side_effect=mock_request) def test_start_scan_invalid_asset_ids(self, _mock_req): diff --git a/plugins/rapid7_insightvm_cloud/unit_test/test_stop_scan.py b/plugins/rapid7_insightvm_cloud/unit_test/test_stop_scan.py index 09101165b0..fa22c25510 100644 --- a/plugins/rapid7_insightvm_cloud/unit_test/test_stop_scan.py +++ b/plugins/rapid7_insightvm_cloud/unit_test/test_stop_scan.py @@ -6,13 +6,14 @@ sys.path.append(os.path.abspath("../")) from unittest import TestCase +from jsonschema import validate from icon_rapid7_insightvm_cloud.connection.schema import Input as ConnectionInput from icon_rapid7_insightvm_cloud.actions.stop_scan import StopScan -from icon_rapid7_insightvm_cloud.actions.stop_scan.schema import Input +from icon_rapid7_insightvm_cloud.actions.stop_scan.schema import Input, StopScanOutput from unittest.mock import patch -from unit_test.utils import Utils -from unit_test.mock import ( +from utils import Utils +from mock import ( mock_request, ) @@ -34,6 +35,7 @@ def test_stop_scan(self, _mock_req): actual = self.action.run({Input.ID: self.params.get("scan_id")}) expected = Utils.read_file_to_dict("expected_responses/stop_scan.json.resp") self.assertEqual(expected, actual) + validate(actual, StopScanOutput.schema) # test finding event via all inputs @patch("requests.request", side_effect=mock_request) @@ -41,6 +43,7 @@ def test_stop_scan_invalid_scan_id(self, _mock_req): actual = self.action.run({Input.ID: self.params.get("scan_id_invalid")}) expected = Utils.read_file_to_dict("expected_responses/stop_scan_invalid_scan_id.json.resp") self.assertEqual(expected, actual) + validate(actual, StopScanOutput.schema) @patch("requests.request", side_effect=mock_request) def test_stop_scan_invalid_secret_key(self, _mock_req): diff --git a/plugins/rapid7_insightvm_cloud/unit_test/test_vuln_search.py b/plugins/rapid7_insightvm_cloud/unit_test/test_vuln_search.py index 8b34af01f1..14aff51fd0 100644 --- a/plugins/rapid7_insightvm_cloud/unit_test/test_vuln_search.py +++ b/plugins/rapid7_insightvm_cloud/unit_test/test_vuln_search.py @@ -6,12 +6,13 @@ sys.path.append(os.path.abspath("../")) from unittest import TestCase +from jsonschema import validate from icon_rapid7_insightvm_cloud.actions.vuln_search import VulnSearch -from icon_rapid7_insightvm_cloud.actions.vuln_search.schema import Input +from icon_rapid7_insightvm_cloud.actions.vuln_search.schema import Input, VulnSearchOutput from icon_rapid7_insightvm_cloud.connection.schema import Input as ConnectionInput from unittest.mock import patch -from unit_test.utils import Utils -from unit_test.mock import ( +from utils import Utils +from mock import ( mock_request, ) @@ -20,8 +21,6 @@ class TestVulnSearch(TestCase): @classmethod def setUpClass(self) -> None: self.params = { - "asset_criteria": "last_scan_end > 2000-01-01T00:00:00.000Z", - "asset_criteria_invalid": "invalid asset criteria", "size": 10, "sort_criteria": {"risk-score": "asc", "criticality-tag": "desc"}, "vuln_criteria": "severity IN ['Critical', 'Severe']", @@ -36,7 +35,6 @@ def setUp(self) -> None: def test_vuln_search_all_inputs(self, _mock_req): actual = self.action.run( { - Input.ASSET_CRITERIA: self.params.get("asset_criteria"), Input.SIZE: self.params.get("size"), Input.SORT_CRITERIA: self.params.get("sort_criteria"), Input.VULN_CRITERIA: self.params.get("vuln_criteria"), @@ -44,6 +42,7 @@ def test_vuln_search_all_inputs(self, _mock_req): ) expected = Utils.read_file_to_dict("expected_responses/vuln_search.json.resp") self.assertEqual(expected, actual) + validate(actual, VulnSearchOutput.schema) # test finding event with no inputs @patch("requests.request", side_effect=mock_request) @@ -51,25 +50,7 @@ def test_vuln_search_no_input(self, _mock_req): actual = self.action.run() expected = Utils.read_file_to_dict("expected_responses/vuln_search.json.resp") self.assertEqual(expected, actual) - - # test finding event with bad asset criteria - @patch("requests.request", side_effect=mock_request) - def test_vuln_invalid_asset_criteria(self, _mock_req): - with self.assertRaises(PluginException) as context: - self.action.run( - { - Input.ASSET_CRITERIA: self.params.get("asset_criteria_invalid"), - Input.SIZE: self.params.get("size"), - Input.SORT_CRITERIA: self.params.get("sort_criteria"), - Input.VULN_CRITERIA: self.params.get("vuln_criteria"), - } - ) - cause = "The server is unable to process the request." - assistance = "Verify your plugin input is correct and not malformed and try again. If the issue persists, please contact support." - data = Utils.read_file_to_dict("expected_responses/asset_search_invalid_asset_criteria.json.resp") - self.assertEqual(cause, context.exception.cause) - self.assertEqual(assistance, context.exception.assistance) - self.assertEqual(str(data), context.exception.data) + validate(actual, VulnSearchOutput.schema) # test finding event with bad vuln criteria @patch("requests.request", side_effect=mock_request) @@ -77,7 +58,6 @@ def test_asset_vuln_criteria_invalid(self, _mock_req): with self.assertRaises(PluginException) as context: self.action.run( { - Input.ASSET_CRITERIA: self.params.get("asset_criteria"), Input.SIZE: self.params.get("size"), Input.SORT_CRITERIA: self.params.get("sort_criteria"), Input.VULN_CRITERIA: self.params.get("vuln_criteria_invalid"),