Rapid7 InsightVM — Integration Setup

Prerequisites

• An InsightVM Security Console reachable from CMDash (https://<console-host>:3780)
• A console user account CMDash can authenticate as (read access to assets and vulnerabilities)
• CMDash Essentials tier or above

#496 — console, not cloud. CMDash syncs InsightVM through the Security Console API v3 (/api/3/...), which is served by your own console and authenticates with HTTP Basic. It does not currently sync through the Rapid7 Insight platform cloud ({region}.api.insight.rapid7.com), whose InsightVM surface is /vm/v4/integration/... — a different product with a different path space. A connection configured for the cloud is refused with a message naming the setting to change, rather than silently 404ing on every request, which is what previous releases did.

Step 1: Prepare console access

1. In the InsightVM Security Console, create (or pick) a user account for CMDash with read access to the sites whose assets you want synced.
2. Note the console URL, including the port — by default https://<console-host>:3780.
3. Make sure the console is reachable from CMDash (allow-list CMDash's egress address, or run the connector through a collector inside your own network).

Step 2: Connect in CMDash

1. Navigate to Integrations in your CMDash dashboard.
2. Find Rapid7 InsightVM and click Connect.
3. Enter:
   • Console URL (consoleUrl, e.g. https://insightvm.corp.example:3780)
   • Username (stored as this connection's access token) and Password — sent as HTTP Basic
   • Optionally Deployment (console, the default whenever a console URL is present)
4. Click Save & Test Connection.

What Syncs

Assets are paginated (500/page) and a sweep is capped at 2,000 assets; hitting that cap marks the snapshot incomplete so CMDash does not infer that anything beyond it was remediated, and the sync shows as Partial with a warning. A vulnerability description that cannot be read, or a failed vulnerability-SLA calculation, also marks the sync Partial.

What changed (#496). Until v8.3.0 the vulnerability feed called GET /api/3/vulnerabilities — Rapid7's global definition catalogue, every check Rapid7 ships — and normalised an arbitrary first 2,000 rows of it to status open, as if they were findings in your estate. They were not. CMDash now reads each asset's own findings, so a vulnerability record here means "this host has this problem", and each record's CVSS score is the definition's cvss.v3.score (a number; it used to be assigned the whole CVSS object).

Troubleshooting

• 401 Unauthorized: The console credentials are wrong or the account was disabled; update the connection.
• 403 Forbidden: The console user cannot see the sites you expect — grant read access to them.
• "needs the InsightVM Security Console API": the connection is configured for the Insight platform cloud. Set Console URL (and password) on the connection.
• Connection times out: the console is not reachable from CMDash — see Step 1.3.
• Vulnerability counts don't match InsightVM: a CMDash record is one (asset, vulnerability) pair, so an estate-wide finding on 40 hosts is 40 records, matching InsightVM's own per-asset view.

Rate Limits & Sync Behavior

Credential Rotation

Console passwords do not expire on CMDash's schedule. CMDash recommends rotating quarterly.

To rotate:

1. Change the CMDash service account's password in the Security Console.
2. In CMDash: Settings → Integrations → Rapid7 InsightVM → Edit.
3. Enter the new Password and Save & Test Connection.

Note: the console exposes no credential-expiry metadata to CMDash, so the 30-day expiry warning banner is not shown for this integration.

Multiple Instances / Multi-Site

If you operate more than one Security Console, each needs its own CMDash connection.

To add another instance:

1. In CMDash: Settings → Integrations → Add Integration → Rapid7 InsightVM.
2. Enter the second console's URL and credentials.
3. Give the connection a descriptive name (e.g., Rapid7 - US Console, Rapid7 - EU Console).
4. Click Save & Test Connection.

Compliance Framework Coverage

The Rapid7 InsightVM integration provides evidence for the following controls. Coverage is automatically mapped when data is synced.