id: rapid7_insightvm
name: Rapid7 InsightVM
version: 1.0.0
description: "Rapid7 InsightVM / Nexpose (Console API v3) — asset and vulnerability context: list and read assets and their vulnerabilities, list and read vulnerability definitions, list sites, start a site scan, and read scan status. HTTP Basic authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: list/get assets, asset vulnerabilities, list/get vulnerabilities, list sites, start site scan, get scan."
category: vulnerability

# Per-instance configuration. HTTP Basic auth against the InsightVM/Nexpose
# console API v3 (typically port 3780). Set insecure for the console's default
# self-signed certificate.
config_schema:
  properties:
    base_url:
      type: string
      description: "Console base URL (e.g. https://console.example.com:3780)"
    username:
      type: string
      description: "Console username"
    password:
      type: string
      description: "Console password"
      x-soar-sensitive: true
    insecure:
      type: boolean
      description: "Trust any TLS certificate (not secure)"
      default: false
  required:
    - base_url
    - username
    - password

commands:
  - id: list_assets
    name: insightvm-list-assets
    description: "List assets."
    risk: read
    inputs_schema:
      properties:
        page: { type: number, description: "Page number (default 0)" }
        size: { type: number, description: "Page size (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_asset
    name: insightvm-get-asset
    description: "Get a single asset by ID."
    risk: read
    inputs_schema:
      properties:
        asset_id: { type: string, description: "Asset ID" }
      required: [asset_id]
    outputs_schema: { properties: {} }
  - id: asset_vulnerabilities
    name: insightvm-asset-vulnerabilities
    description: "List the vulnerabilities found on an asset."
    risk: read
    inputs_schema:
      properties:
        asset_id: { type: string, description: "Asset ID" }
      required: [asset_id]
    outputs_schema: { properties: {} }
  - id: list_vulnerabilities
    name: insightvm-list-vulnerabilities
    description: "List vulnerability definitions."
    risk: read
    inputs_schema:
      properties:
        page: { type: number, description: "Page number (default 0)" }
        size: { type: number, description: "Page size (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_vulnerability
    name: insightvm-get-vulnerability
    description: "Get a vulnerability definition by ID (e.g. a CVE-linked vuln)."
    risk: read
    inputs_schema:
      properties:
        vulnerability_id: { type: string, description: "Vulnerability ID" }
      required: [vulnerability_id]
    outputs_schema: { properties: {} }
  - id: list_sites
    name: insightvm-list-sites
    description: "List sites."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
  - id: start_site_scan
    name: insightvm-start-site-scan
    description: "Start a scan of a site."
    inputs_schema:
      properties:
        site_id: { type: string, description: "Site ID" }
        scan_name: { type: string, description: "Optional scan name" }
        hosts: { type: string, description: "Optional comma-separated hosts to scan (subset of the site)" }
      required: [site_id]
    outputs_schema: { properties: {} }
  - id: get_scan
    name: insightvm-get-scan
    description: "Get the status and details of a scan."
    risk: read
    inputs_schema:
      properties:
        scan_id: { type: string, description: "Scan ID" }
      required: [scan_id]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: insightvm-test-connection
    description: "Verify connectivity and credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }