Implementing Rapid7 InsightVM for Scanning

Overview

Rapid7 InsightVM (formerly Nexpose) is an enterprise vulnerability management platform that combines on-premises scanning via Security Console and Scan Engines with cloud-based analytics through the Insight Platform. InsightVM leverages Rapid7's vulnerability research library, Metasploit exploit knowledge, global attacker behavior data, internet-wide scanning telemetry, and real-time reporting to provide comprehensive vulnerability visibility. This skill covers deploying the Security Console, configuring Scan Engines, setting up scan templates, credentialed scanning, and integrating with the Insight Agent for continuous assessment.

When to Use

• When deploying or configuring implementing rapid7 insightvm for scanning capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Server meeting minimum requirements: 16 GB RAM, 4 CPU cores, 500 GB disk (Security Console)
• Scan Engine: 8 GB RAM, 4 CPU cores, 100 GB disk
• Network access to target subnets (ports vary by scan type)
• Administrative credentials for authenticated scanning (SSH, WMI, SNMP)
• Rapid7 InsightVM license and Insight Platform account
• PostgreSQL database (bundled with Security Console)

Core Concepts

InsightVM Architecture Components

Security Console

The central management server that:

• Hosts the web-based management interface (default port 3780)
• Stores scan results in an embedded PostgreSQL database
• Manages Scan Engine deployments and scan schedules
• Generates reports and dashboards
• Connects to Rapid7 Insight Platform for cloud analytics

Note: Security Console is NOT supported in containerized environments.

Scan Engines

Distributed scanning components that:

• Perform active network scanning against target assets
• Can be deployed across network segments for segmented environments
• Available as container images on Docker Hub for flexible deployment
• Report results back to the Security Console

Insight Agent

Lightweight endpoint agent providing:

• Continuous vulnerability assessment without network scans
• Assessment of remote/roaming endpoints
• Complement to engine-based scanning for comprehensive coverage
• Real-time asset inventory updates

Scan Template Types

Workflow

Step 1: Install Security Console

# Download InsightVM installer (Linux)
chmod +x Rapid7Setup-Linux64.bin
./Rapid7Setup-Linux64.bin -c

# Verify service is running
systemctl status nexposeconsole.service

# Access web interface
# https://<console-ip>:3780

Initial configuration:

1. Navigate to https://localhost:3780
2. Complete the setup wizard with license key
3. Configure database settings (embedded PostgreSQL recommended)
4. Set administrator credentials
5. Activate Insight Platform connection for cloud analytics

Step 2: Deploy Distributed Scan Engines

# Install Scan Engine on remote server
./Rapid7Setup-Linux64.bin -c

# During installation, select "Scan Engine only"
# Pair with Security Console using shared secret

# Docker-based Scan Engine deployment
docker pull rapid7/insightvm-scan-engine
docker run -d \
  --name scan-engine \
  -p 40814:40814 \
  -e CONSOLE_HOST=<console-ip> \
  -e CONSOLE_PORT=3780 \
  -e ENGINE_NAME=DMZ-Scanner \
  -e SHARED_SECRET=<pairing-secret> \
  rapid7/insightvm-scan-engine

Pair engines in Security Console:

1. Administration > Scan Engines > New Scan Engine
2. Enter engine hostname/IP and port (default 40814)
3. Use shared secret for authentication
4. Verify connectivity status shows "Active"

Step 3: Configure Asset Discovery Sites

Site Configuration:
  Name:           Production-Network
  Scan Engine:    Primary-Engine-01

…