[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFBS2RXN6XBRYVWPWSXVZ6":3,"skill-same:01M6AFBS2RXN6XBRYVWPWSXVZ6":125},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":29,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":69,"repositoryHtmlUrl":70,"repositoryHomepageUrl":71,"ownerHtmlUrl":72,"ownerBlogUrl":73,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6AFBS2RXN6XBRYVWPWSXVZ6","implementing-rapid7-insightvm-for-scanning",null,"Deploy and configure Rapid7 InsightVM Security Console and Scan Engines, including scan templates, credentialed scanning, and Insight Agent integration, for authenticated and unauthenticated vulnerability scanning across enterprise environments. Use when standing up InsightVM infrastructure, configuring credentialed vulnerability scans, or integrating continuous asset assessment via the Insight Agent.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-rapid7-insightvm-for-scanning\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"implementing rapid7 insightvm for scanning","templates","authenticated-scanning","scan-engine","nexpose","insightvm","rapid7","asset-discovery","vulnerability-scanning","vulnerability-management","security","Enterprise","integration","vulnerability scanning","console","assessment","infrastructure","deploy","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-rapid7-insightvm-for-scanning\ndescription: Deploy and configure Rapid7 InsightVM Security Console and Scan Engines,\n  including scan templates, credentialed scanning, and Insight Agent integration, for\n  authenticated and unauthenticated vulnerability scanning across enterprise environments.\n  Use when standing up InsightVM infrastructure, configuring credentialed vulnerability\n  scans, or integrating continuous asset assessment via the Insight Agent.\ndomain: cybersecurity\nsubdomain: vulnerability-management\ntags:\n- rapid7\n- insightvm\n- vulnerability-scanning\n- nexpose\n- scan-engine\n- asset-discovery\n- authenticated-scanning\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-02\n- ID.IM-02\n- ID.RA-06\nmitre_attack:\n- T1190\n- T1203\n- T1068\n---\n# Implementing Rapid7 InsightVM for Scanning\n\n## Overview\nRapid7 InsightVM (formerly Nexpose) is an enterprise vulnerability management platform that combines on-premises scanning via Security Console and Scan Engines with cloud-based analytics through the Insight Platform. InsightVM leverages Rapid7's vulnerability research library, Metasploit exploit knowledge, global attacker behavior data, internet-wide scanning telemetry, and real-time reporting to provide comprehensive vulnerability visibility. This skill covers deploying the Security Console, configuring Scan Engines, setting up scan templates, credentialed scanning, and integrating with the Insight Agent for continuous assessment.\n\n\n## When to Use\n\n- When deploying or configuring implementing rapid7 insightvm for scanning capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n- Server meeting minimum requirements: 16 GB RAM, 4 CPU cores, 500 GB disk (Security Console)\n- Scan Engine: 8 GB RAM, 4 CPU cores, 100 GB disk\n- Network access to target subnets (ports vary by scan type)\n- Administrative credentials for authenticated scanning (SSH, WMI, SNMP)\n- Rapid7 InsightVM license and Insight Platform account\n- PostgreSQL database (bundled with Security Console)\n\n## Core Concepts\n\n### InsightVM Architecture Components\n\n#### Security Console\nThe central management server that:\n- Hosts the web-based management interface (default port 3780)\n- Stores scan results in an embedded PostgreSQL database\n- Manages Scan Engine deployments and scan schedules\n- Generates reports and dashboards\n- Connects to Rapid7 Insight Platform for cloud analytics\n\nNote: Security Console is NOT supported in containerized environments.\n\n#### Scan Engines\nDistributed scanning components that:\n- Perform active network scanning against target assets\n- Can be deployed across network segments for segmented environments\n- Available as container images on Docker Hub for flexible deployment\n- Report results back to the Security Console\n\n#### Insight Agent\nLightweight endpoint agent providing:\n- Continuous vulnerability assessment without network scans\n- Assessment of remote\u002Froaming endpoints\n- Complement to engine-based scanning for comprehensive coverage\n- Real-time asset inventory updates\n\n### Scan Template Types\n\n| Template | Use Case | Depth |\n|----------|----------|-------|\n| Discovery Scan | Asset inventory, host enumeration | Low |\n| Full Audit without Web Spider | Standard vulnerability assessment | Medium |\n| Full Audit Enhanced Logging | Deep assessment with verbose logging | High |\n| HIPAA Compliance | Healthcare regulatory compliance | High |\n| PCI ASV Audit | PCI DSS external scanning requirement | High |\n| CIS Policy Compliance | Configuration benchmarking | Medium |\n| Web Spider | Web application discovery and assessment | Medium |\n\n## Workflow\n\n### Step 1: Install Security Console\n\n```bash\n# Download InsightVM installer (Linux)\nchmod +x Rapid7Setup-Linux64.bin\n.\u002FRapid7Setup-Linux64.bin -c\n\n# Verify service is running\nsystemctl status nexposeconsole.service\n\n# Access web interface\n# https:\u002F\u002F\u003Cconsole-ip>:3780\n```\n\nInitial configuration:\n1. Navigate to https:\u002F\u002Flocalhost:3780\n2. Complete the setup wizard with license key\n3. Configure database settings (embedded PostgreSQL recommended)\n4. Set administrator credentials\n5. Activate Insight Platform connection for cloud analytics\n\n### Step 2: Deploy Distributed Scan Engines\n\n```bash\n# Install Scan Engine on remote server\n.\u002FRapid7Setup-Linux64.bin -c\n\n# During installation, select \"Scan Engine only\"\n# Pair with Security Console using shared secret\n\n# Docker-based Scan Engine deployment\ndocker pull rapid7\u002Finsightvm-scan-engine\ndocker run -d \\\n  --name scan-engine \\\n  -p 40814:40814 \\\n  -e CONSOLE_HOST=\u003Cconsole-ip> \\\n  -e CONSOLE_PORT=3780 \\\n  -e ENGINE_NAME=DMZ-Scanner \\\n  -e SHARED_SECRET=\u003Cpairing-secret> \\\n  rapid7\u002Finsightvm-scan-engine\n```\n\nPair engines in Security Console:\n1. Administration > Scan Engines > New Scan Engine\n2. Enter engine hostname\u002FIP and port (default 40814)\n3. Use shared secret for authentication\n4. Verify connectivity status shows \"Active\"\n\n### Step 3: Configure Asset Discovery Sites\n\n```\nSite Configuration:\n  Name:           Production-Network\n  Scan Engine:    Primary-Engine-01\n  Scan Template:  Full Audit without Web Spider\n\n  Included Assets:\n    - 10.0.0.0\u002F8     (Internal network)\n    - 172.16.0.0\u002F12   (DMZ network)\n\n  Excluded Assets:\n    - 10.0.0.1        (Core router - fragile)\n    - 10.0.100.0\u002F24   (ICS\u002FSCADA segment)\n\n  Schedule:\n    Frequency:    Weekly\n    Day:          Sunday\n    Time:         02:00 AM\n    Max Duration: 8 hours\n```\n\n### Step 4: Configure Authenticated Scanning\n\n#### Windows Credentials (WMI)\n```\nCredential Type:    Microsoft Windows\u002FSamba (SMB\u002FCIFS)\nDomain:             CORP.EXAMPLE.COM\nUsername:           svc_insightvm_scan\nPassword:           \u003Cservice-account-password>\nAuthentication:     NTLM\n\nPrivilege Elevation:\n  Type:   None (use domain admin or local admin)\n```\n\n#### Linux\u002FUnix Credentials (SSH)\n```\nCredential Type:    Secure Shell (SSH)\nUsername:           insightvm_scan\nAuthentication:     SSH Key (preferred) or Password\nSSH Private Key:    \u002Fopt\u002Frapid7\u002F.ssh\u002Fscan_key\nPort:               22\n\nPrivilege Elevation:\n  Type:             sudo\n  sudo User:        root\n  sudo Password:    \u003Csudo-password>\n```\n\n#### Database Credentials\n```\nCredential Type:    Microsoft SQL Server\nInstance:           MSSQLSERVER\nDomain:             CORP\nUsername:           insightvm_db_scan\nAuthentication:     Windows Authentication\n\nCredential Type:    Oracle\nPort:               1521\nSID:                ORCL\nUsername:           insightvm_scan\n```\n\n### Step 5: Configure Scan Templates\n\nCustom scan template for balanced scanning:\n```\nTemplate Name:      Enterprise-Standard-Scan\n\nService Discovery:\n  TCP Ports:        Well-known (1-1024) + common services\n  UDP Ports:        DNS(53), SNMP(161), NTP(123), TFTP(69)\n  Method:           SYN scan (stealth)\n\nVulnerability Checks:\n  Safe checks only: Enabled\n  Skip potential:   Disabled\n  Web spidering:    Disabled (separate template)\n  Policy checks:    Enabled (CIS benchmarks)\n\nPerformance:\n  Max parallel assets:     10\n  Max requests per second: 100\n  Timeout per asset:       30 minutes\n  Retries:                 2\n```\n\n### Step 6: Set Up Insight Agent Deployment\n\n```powershell\n# Windows Agent Installation (via GPO or SCCM)\nmsiexec \u002Fi agentInstaller-x86_64.msi \u002Fquiet \u002Fnorestart `\n  CUSTOMTOKEN=\u003Cplatform-token> `\n  CUSTOMCONFIG=\u003Cagent-config>\n\n# Linux Agent Installation\nchmod +x agent_installer.sh\n.\u002Fagent_installer.sh install_start \\\n  --token \u003Cplatform-token>\n\n# Verify agent connectivity\n# Check InsightVM console: Assets > Agent Management\n```\n\n### Step 7: Configure Remediation Workflows\n\n```\nRemediation Project:\n  Name:             Q1-2025-Critical-Remediation\n\n  Scope:\n    Severity:       Critical + High\n    CVSS Score:     >= 7.0\n    Assets:         Production-Network site\n\n  Assignment:\n    Team:           Infrastructure-Ops\n    Due Date:       2025-03-31\n\n  Tracking:\n    Auto-verify:    Enabled (re-scan on next scheduled scan)\n    Notification:   Email on overdue items\n    Escalation:     Manager notification at 75% SLA\n```\n\n### Step 8: API Integration for Automation\n\n```python\nimport requests\nimport json\n\nclass InsightVMClient:\n    \"\"\"Rapid7 InsightVM API v3 client for automation.\"\"\"\n\n    def __init__(self, console_url, api_key):\n        self.base_url = f\"{console_url}\u002Fapi\u002F3\"\n        self.session = requests.Session()\n        self.session.headers.update({\n            \"Content-Type\": \"application\u002Fjson\",\n            \"Authorization\": f\"Bearer {api_key}\"\n        })\n        self.session.verify = not os.environ.get(\"SKIP_TLS_VERIFY\", \"\").lower() == \"true\"  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments\n\n    def get_sites(self):\n        \"\"\"List all configured scan sites.\"\"\"\n        response = self.session.get(f\"{self.base_url}\u002Fsites\")\n        response.raise_for_status()\n        return response.json().get(\"resources\", [])\n\n    def start_scan(self, site_id, engine_id=None, template_id=None):\n        \"\"\"Trigger an ad-hoc scan for a site.\"\"\"\n        payload = {}\n        if engine_id:\n            payload[\"engineId\"] = engine_id\n        if template_id:\n            payload[\"templateId\"] = template_id\n\n        response = self.session.post(\n            f\"{self.base_url}\u002Fsites\u002F{site_id}\u002Fscans\",\n            json=payload\n        )\n        response.raise_for_status()\n        return response.json()\n\n    def get_asset_vulnerabilities(self, asset_id):\n        \"\"\"Retrieve vulnerabilities for a specific asset.\"\"\"\n        response = self.session.get(\n            f\"{self.base_url}\u002Fassets\u002F{asset_id}\u002Fvulnerabilities\"\n        )\n        response.raise_for_status()\n        return response.json().get(\"resources\", [])\n\n    def get_scan_status(self, scan_id):\n        \"\"\"Check the status of a running scan.\"\"\"\n        response = self.session.get(f\"{self.base_url}\u002Fscans\u002F{scan_id}\")\n        response.raise_for_status()\n        return response.json()\n\n    def create_remediation_project(self, name, description, assets, vulns):\n        \"\"\"Create a remediation tracking project.\"\"\"\n        payload = {\n            \"name\": name,\n            \"description\": description,\n            \"assets\": {\"includedTargets\": {\"addresses\": assets}},\n            \"vulnerabilities\": {\"includedVulnerabilities\": vulns}\n        }\n        response = self.session.post(\n            f\"{self.base_url}\u002Fremediations\",\n            json=payload\n        )\n        response.raise_for_status()\n        return response.json()\n\n\n# Usage\nclient = InsightVMClient(\"https:\u002F\u002Finsightvm-console:3780\", \"api-key-here\")\nsites = client.get_sites()\nfor site in sites:\n    print(f\"Site: {site['name']} - Assets: {site.get('assets', 0)}\")\n```\n\n## Best Practices\n1. Deploy Scan Engines close to target networks to minimize scan traffic traversing firewalls\n2. Use Insight Agents for roaming laptops and remote workers that are not always reachable by network scans\n3. Combine agent-based and engine-based scanning for the most accurate vulnerability view\n4. Configure scan blackout windows during business-critical hours to avoid operational impact\n5. Use credential testing before full scans to validate authentication works\n6. Enable safe checks to prevent accidental denial of service on production systems\n7. Separate scan sites by network segment, business unit, or compliance scope\n8. Leverage tag-based asset groups for dynamic reporting and remediation tracking\n\n## Common Pitfalls\n- Running full scans during business hours causing network congestion or service degradation\n- Using unauthenticated scans only, missing 60-80% of local vulnerabilities\n- Not excluding fragile devices (printers, ICS\u002FSCADA, medical devices) from aggressive scan templates\n- Failing to distribute Scan Engines across network segments, causing firewall bottlenecks\n- Ignoring scan engine resource utilization leading to incomplete scans\n- Not configuring scan duration limits, allowing runaway scans to consume resources indefinitely\n\n## Related Skills\n- performing-agentless-vulnerability-scanning\n- building-vulnerability-data-pipeline-with-api\n- implementing-wazuh-for-vulnerability-detection\n- performing-remediation-validation-scanning\n","# Implementing Rapid7 InsightVM for Scanning\n\n## Overview\nRapid7 InsightVM (formerly Nexpose) is an enterprise vulnerability management platform that combines on-premises scanning via Security Console and Scan Engines with cloud-based analytics through the Insight Platform. InsightVM leverages Rapid7's vulnerability research library, Metasploit exploit knowledge, global attacker behavior data, internet-wide scanning telemetry, and real-time reporting to provide comprehensive vulnerability visibility. This skill covers deploying the Security Console, configuring Scan Engines, setting up scan templates, credentialed scanning, and integrating with the Insight Agent for continuous assessment.\n\n\n## When to Use\n\n- When deploying or configuring implementing rapid7 insightvm for scanning capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n- Server meeting minimum requirements: 16 GB RAM, 4 CPU cores, 500 GB disk (Security Console)\n- Scan Engine: 8 GB RAM, 4 CPU cores, 100 GB disk\n- Network access to target subnets (ports vary by scan type)\n- Administrative credentials for authenticated scanning (SSH, WMI, SNMP)\n- Rapid7 InsightVM license and Insight Platform account\n- PostgreSQL database (bundled with Security Console)\n\n## Core Concepts\n\n### InsightVM Architecture Components\n\n#### Security Console\nThe central management server that:\n- Hosts the web-based management interface (default port 3780)\n- Stores scan results in an embedded PostgreSQL database\n- Manages Scan Engine deployments and scan schedules\n- Generates reports and dashboards\n- Connects to Rapid7 Insight Platform for cloud analytics\n\nNote: Security Console is NOT supported in containerized environments.\n\n#### Scan Engines\nDistributed scanning components that:\n- Perform active network scanning against target assets\n- Can be deployed across network segments for segmented environments\n- Available as container images on Docker Hub for flexible deployment\n- Report results back to the Security Console\n\n#### Insight Agent\nLightweight endpoint agent providing:\n- Continuous vulnerability assessment without network scans\n- Assessment of remote\u002Froaming endpoints\n- Complement to engine-based scanning for comprehensive coverage\n- Real-time asset inventory updates\n\n### Scan Template Types\n\n| Template | Use Case | Depth |\n|----------|----------|-------|\n| Discovery Scan | Asset inventory, host enumeration | Low |\n| Full Audit without Web Spider | Standard vulnerability assessment | Medium |\n| Full Audit Enhanced Logging | Deep assessment with verbose logging | High |\n| HIPAA Compliance | Healthcare regulatory compliance | High |\n| PCI ASV Audit | PCI DSS external scanning requirement | High |\n| CIS Policy Compliance | Configuration benchmarking | Medium |\n| Web Spider | Web application discovery and assessment | Medium |\n\n## Workflow\n\n### Step 1: Install Security Console\n\n```bash\n# Download InsightVM installer (Linux)\nchmod +x Rapid7Setup-Linux64.bin\n.\u002FRapid7Setup-Linux64.bin -c\n\n# Verify service is running\nsystemctl status nexposeconsole.service\n\n# Access web interface\n# https:\u002F\u002F\u003Cconsole-ip>:3780\n```\n\nInitial configuration:\n1. Navigate to https:\u002F\u002Flocalhost:3780\n2. Complete the setup wizard with license key\n3. Configure database settings (embedded PostgreSQL recommended)\n4. Set administrator credentials\n5. Activate Insight Platform connection for cloud analytics\n\n### Step 2: Deploy Distributed Scan Engines\n\n```bash\n# Install Scan Engine on remote server\n.\u002FRapid7Setup-Linux64.bin -c\n\n# During installation, select \"Scan Engine only\"\n# Pair with Security Console using shared secret\n\n# Docker-based Scan Engine deployment\ndocker pull rapid7\u002Finsightvm-scan-engine\ndocker run -d \\\n  --name scan-engine \\\n  -p 40814:40814 \\\n  -e CONSOLE_HOST=\u003Cconsole-ip> \\\n  -e CONSOLE_PORT=3780 \\\n  -e ENGINE_NAME=DMZ-Scanner \\\n  -e SHARED_SECRET=\u003Cpairing-secret> \\\n  rapid7\u002Finsightvm-scan-engine\n```\n\nPair engines in Security Console:\n1. Administration > Scan Engines > New Scan Engine\n2. Enter engine hostname\u002FIP and port (default 40814)\n3. Use shared secret for authentication\n4. Verify connectivity status shows \"Active\"\n\n### Step 3: Configure Asset Discovery Sites\n\n```\nSite Configuration:\n  Name:           Production-Network\n  Scan Engine:    Primary-Engine-01\n  Scan Template:  Full Audit without Web Spider\n\n  Included Assets:\n    - 10.0.0.0\u002F8     (Internal network)\n    - 172.16.0.0\u002F12   (DMZ network)\n\n  Excluded Assets:\n    - 10.0.0.1        (Core router - fragile)\n    - 10.0.100.0\u002F24   (ICS\u002FSCADA segment)\n\n  Schedule:\n    Frequency:    Weekly\n    Day:          Sunday\n    Time:         02:00 AM\n    Max Duration: 8 hours\n```\n\n### Step 4: Configure Authenticated Scanning\n\n#### Windows Credentials (WMI)\n```\nCredential Type:    Microsoft Windows\u002FSamba (SMB\u002FCIFS)\nDomain:             CORP.EXAMPLE.COM\nUsername:           svc_insightvm_scan\nPassword:           \u003Cservice-account-password>\nAuthentication:     NTLM\n\nPrivilege Elevation:\n  Type:   None (use domain admin or local admin)\n```\n\n#### Linux\u002FUnix Credentials (SSH)\n```\nCredential Type:    Secure Shell (SSH)\nUsername:           insightvm_scan\nAuthentication:     SSH Key (preferred) or Password\nSSH Private Key:    \u002Fopt\u002Frapid7\u002F.ssh\u002Fscan_key\nPort:               22\n\nPrivilege Elevation:\n  Type:             sudo\n  sudo User:        root\n  sudo Password:    \u003Csudo-password>\n```\n\n#### Database Credentials\n```\nCredential Type:    Microsoft SQL Server\nInstance:           MSSQLSERVER\nDomain:             CORP\nUsername:           insightvm_db_scan\nAuthentication:     Windows Authentication\n\nCredential Type:    Oracle\nPort:               1521\nSID:                ORCL\nUsername:           insightvm_scan\n```\n\n### Step 5: Configure Scan Templates\n\nCustom scan template for balanced scanning:\n```\nTemplate Name:      Enterprise-Standard-Scan\n\nService Discovery:\n  TCP Ports:        Well-known (1-1024) + common services\n  UDP Ports:        DNS(53), SNMP(161), NTP(123), TFTP(69)\n  Method:           SYN scan (stealth)\n\nVulnerability Checks:\n  Safe checks only: Enabled\n  Skip potential:   Disabled\n  Web spidering:    Disabled (separate template)\n  Policy checks:    Enabled (CIS benchmarks)\n\nPerformance:\n  Max parallel assets:     10\n  Max requests per second: 100\n  Timeout per asset:       30 minutes\n  Retries:                 2\n```\n\n### Step 6: Set Up Insight Agent Deployment\n\n```powershell\n# Windows Agent Installation (via GPO or SCCM)\nmsiexec \u002Fi agentInstaller-x86_64.msi \u002Fquiet \u002Fnorestart `\n  CUSTOMTOKEN=\u003Cplatform-token> `\n  CUSTOMCONFIG=\u003Cagent-config>\n\n# Linux Agent Installation\nchmod +x agent_installer.sh\n.\u002Fagent_installer.sh install_start \\\n  --token \u003Cplatform-token>\n\n# Verify agent connectivity\n# Check InsightVM console: Assets > Agent Management\n```\n\n### Step 7: Configure Remediation Workflows\n\n```\nRemediation Project:\n  Name:             Q1-2025-Critical-Remediation\n\n  Scope:\n    Severity:       Critical + High\n    CVSS Score:     >= 7.0\n    Assets:         Production-Network site\n\n  Assignment:\n    Team:           Infrastructure-Ops\n    Due Date:       2025-03-31\n\n  Tracking:\n    Auto-verify:    Enabled (re-scan on next scheduled scan)\n    Notification:   Email on overdue items\n    Escalation:     Manager notification at 75% SLA\n```\n\n### Step 8: API Integration for Automation\n\n```python\nimport requests\nimport json\n\nclass InsightVMClient:\n    \"\"\"Rapid7 InsightVM API v3 client for automation.\"\"\"\n\n    def __init__(self, console_url, api_key):\n        self.base_url = f\"{console_url}\u002Fapi\u002F3\"\n        self.session = requests.Session()\n        self.session.headers.update({\n            \"Content-Type\": \"application\u002Fjson\",\n            \"Authorization\": f\"Bearer {api_key}\"\n        })\n        self.session.verify = not os.environ.get(\"SKIP_TLS_VERIFY\", \"\").lower() == \"true\"  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments\n\n    def get_sites(self):\n        \"\"\"List all configured scan sites.\"\"\"\n        response = self.session.get(f\"{self.base_url}\u002Fsites\")\n        response.raise_for_status()\n        return response.json().get(\"resources\", [])\n\n    def start_scan(self, site_id, engine_id=None, template_id=None):\n        \"\"\"Trigger an ad-hoc scan for a site.\"\"\"\n        payload = {}\n        if engine_id:\n            payload[\"engineId\"] = engine_id\n        if template_id:\n            payload[\"templateId\"] = template_id\n\n        response = self.session.post(\n            f\"{self.base_url}\u002Fsites\u002F{site_id}\u002Fscans\",\n            json=payload\n        )\n        response.raise_for_status()\n        return response.json()\n\n    def get_asset_vulnerabilities(self, asset_id):\n        \"\"\"Retrieve vulnerabilities for a specific asset.\"\"\"\n        response = self.session.get(\n            f\"{self.base_url}\u002Fassets\u002F{asset_id}\u002Fvulnerabilities\"\n        )\n        response.raise_for_status()\n        return response.json().get(\"resources\", [])\n\n    def get_scan_status(self, scan_id):\n        \"\"\"Check the status of a running scan.\"\"\"\n        response = self.session.get(f\"{self.base_url}\u002Fscans\u002F{scan_id}\")\n        response.raise_for_status()\n        return response.json()\n\n    def create_remediation_project(self, name, description, assets, vulns):\n        \"\"\"Create a remediation tracking project.\"\"\"\n        payload = {\n            \"name\": name,\n            \"description\": description,\n            \"assets\": {\"includedTargets\": {\"addresses\": assets}},\n            \"vulnerabilities\": {\"includedVulnerabilities\": vulns}\n        }\n        response = self.session.post(\n            f\"{self.base_url}\u002Fremediations\",\n            json=payload\n        )\n        response.raise_for_status()\n        return response.json()\n\n\n# Usage\nclient = InsightVMClient(\"https:\u002F\u002Finsightvm-console:3780\", \"api-key-here\")\nsites = client.get_sites()\nfor site in sites:\n    print(f\"Site: {site['name']} - Assets: {site.get('assets', 0)}\")\n```\n\n## Best Practices\n1. Deploy Scan Engines close to target networks to minimize scan traffic traversing firewalls\n2. Use Insight Agents for roaming laptops and remote workers that are not always reachable by network scans\n3. Combine agent-based and engine-based scanning for the most accurate vulnerability view\n4. Configure scan blackout windows during business-critical hours to avoid operational impact\n5. Use credential testing before full scans to validate authentication works\n6. Enable safe checks to prevent accidental denial of service on production systems\n7. Separate scan sites by network segment, business unit, or compliance scope\n8. Leverage tag-based asset groups for dynamic reporting and remediation tracking\n\n## Common Pitfalls\n- Running full scans during business hours causing network congestion or service degradation\n- Using unauthenticated scans only, missing 60-80% of local vulnerabilities\n- Not excluding fragile devices (printers, ICS\u002FSCADA, medical devices) from aggressive scan templates\n- Failing to distribute Scan Engines across network segments, causing firewall bottlenecks\n- Ignoring scan engine resource utilization leading to incomplete scans\n- Not configuring scan duration limits, allowing runaway scans to consume resources indefinitely\n\n## Related Skills\n- performing-agentless-vulnerability-scanning\n- building-vulnerability-data-pipeline-with-api\n- implementing-wazuh-for-vulnerability-detection\n- performing-remediation-validation-scanning\n",{"name":5,"tags":54,"author":55,"domain":48,"license":15,"version":56,"nist_csf":57,"subdomain":39,"description":7,"mitre_attack":62},[36,35,38,34,33,37,32],"mahipal","1.0",[58,59,60,61],"ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06",[63,64,65],"T1190","T1203","T1068","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-rapid7-insightvm-for-scanning",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-rapid7-insightvm-for-scanning",{"tool":82,"command":83},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-rapid7-insightvm-for-scanning",{"tool":85,"command":86},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-rapid7-insightvm-for-scanning","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-rapid7-insightvm-for-scanning\u002FSKILL.md",true,[90,96,101,107,111,115,121],{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"assets\u002Ftemplate.md","ASSET","资产文件",1456,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-rapid7-insightvm-for-scanning\u002Fassets\u002Ftemplate.md",{"path":97,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-rapid7-insightvm-for-scanning\u002FLICENSE",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fapi-reference.md","REFERENCE","参考文档",4697,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-rapid7-insightvm-for-scanning\u002Freferences\u002Fapi-reference.md",{"path":108,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fstandards.md",1566,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-rapid7-insightvm-for-scanning\u002Freferences\u002Fstandards.md",{"path":112,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fworkflows.md",5850,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-rapid7-insightvm-for-scanning\u002Freferences\u002Fworkflows.md",{"path":116,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":119,"sourceHtmlUrl":120},"scripts\u002Fagent.py","SCRIPT","脚本",9367,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-rapid7-insightvm-for-scanning\u002Fscripts\u002Fagent.py",{"path":122,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":123,"sourceHtmlUrl":124},"scripts\u002Fprocess.py",11991,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-rapid7-insightvm-for-scanning\u002Fscripts\u002Fprocess.py",[126,152,176,203,229,255],{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":133,"publishedAt":49},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[132],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[134,135,136,137,40,48,138,139,140,141,142,143,144,145,146,147,148,149,150,151],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":159,"publishedAt":49},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[158],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[160,148,161,162,40,163,48,140,164,165,166,167,168,169,170,171,172,173,174,175],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":186,"publishedAt":49},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[182,185],{"categoryNo":183,"categoryName":184,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[170,187,188,189,190,48,46,191,164,192,193,194,195,196,197,198,199,200,201,202],"backup","recovery","validating backup integrity for recovery","testing","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":210,"publishedAt":49},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[209],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[211,212,213,48,214,215,216,217,218,219,220,221,222,223,224,225,167,226,227,228],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":230,"name":231,"nameZh":6,"description":232,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":233,"categories":234,"keywords":236,"publishedAt":49},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[235],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[237,238,239,48,240,241,242,39,243,244,245,246,247,248,249,250,251,252,253,254],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":256,"name":257,"nameZh":6,"description":258,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":259,"categories":260,"keywords":262,"publishedAt":49},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[261],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[40,263,48,264,265,266,267,268,269,270,271,198,272,199,273,274,275,276,277,278],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]