feat(rapid7-insightvm): new Rapid7 InsightVM vulnerability integration

InsightVM/Nexpose Console API v3, 9 commands: list/get assets, asset vulnerabilities, list/get vulnerabilities, list sites, start site scan, get scan. HTTP Basic auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-11 23:59:39 +02:00
parent fcf30da5fc
commit f34363b450
10 changed files with 677 additions and 0 deletions
@@ -0,0 +1,115 @@
+id: rapid7_insightvm
+name: Rapid7 InsightVM
+version: 1.0.0
+description: "Rapid7 InsightVM / Nexpose (Console API v3) — asset and vulnerability context: list and read assets and their vulnerabilities, list and read vulnerability definitions, list sites, start a site scan, and read scan status. HTTP Basic authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: list/get assets, asset vulnerabilities, list/get vulnerabilities, list sites, start site scan, get scan."
+category: vulnerability
+
+# Per-instance configuration. HTTP Basic auth against the InsightVM/Nexpose
+# console API v3 (typically port 3780). Set insecure for the console's default
+# self-signed certificate.
+config_schema:
+  properties:
+    base_url:
+      type: string
+      description: "Console base URL (e.g. https://console.example.com:3780)"
+    username:
+      type: string
+      description: "Console username"
+    password:
+      type: string
+      description: "Console password"
+      x-soar-sensitive: true
+    insecure:
+      type: boolean
+      description: "Trust any TLS certificate (not secure)"
+      default: false
+  required:
+    - base_url
+    - username
+    - password
+
+commands:
+  - id: list_assets
+    name: insightvm-list-assets
+    description: "List assets."
+    risk: read
+    inputs_schema:
+      properties:
+        page: { type: number, description: "Page number (default 0)" }
+        size: { type: number, description: "Page size (default 100)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_asset
+    name: insightvm-get-asset
+    description: "Get a single asset by ID."
+    risk: read
+    inputs_schema:
+      properties:
+        asset_id: { type: string, description: "Asset ID" }
+      required: [asset_id]
+    outputs_schema: { properties: {} }
+  - id: asset_vulnerabilities
+    name: insightvm-asset-vulnerabilities
+    description: "List the vulnerabilities found on an asset."
+    risk: read
+    inputs_schema:
+      properties:
+        asset_id: { type: string, description: "Asset ID" }
+      required: [asset_id]
+    outputs_schema: { properties: {} }
+  - id: list_vulnerabilities
+    name: insightvm-list-vulnerabilities
+    description: "List vulnerability definitions."
+    risk: read
+    inputs_schema:
+      properties:
+        page: { type: number, description: "Page number (default 0)" }
+        size: { type: number, description: "Page size (default 100)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_vulnerability
+    name: insightvm-get-vulnerability
+    description: "Get a vulnerability definition by ID (e.g. a CVE-linked vuln)."
+    risk: read
+    inputs_schema:
+      properties:
+        vulnerability_id: { type: string, description: "Vulnerability ID" }
+      required: [vulnerability_id]
+    outputs_schema: { properties: {} }
+  - id: list_sites
+    name: insightvm-list-sites
+    description: "List sites."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+  - id: start_site_scan
+    name: insightvm-start-site-scan
+    description: "Start a scan of a site."
+    inputs_schema:
+      properties:
+        site_id: { type: string, description: "Site ID" }
+        scan_name: { type: string, description: "Optional scan name" }
+        hosts: { type: string, description: "Optional comma-separated hosts to scan (subset of the site)" }
+      required: [site_id]
+    outputs_schema: { properties: {} }
+  - id: get_scan
+    name: insightvm-get-scan
+    description: "Get the status and details of a scan."
+    risk: read
+    inputs_schema:
+      properties:
+        scan_id: { type: string, description: "Scan ID" }
+      required: [scan_id]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: insightvm-test-connection
+    description: "Verify connectivity and credentials (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }