Prerequisites

User Role and Permissions

To get started with creating a Rapid7 Connector, you must create a user and generate an API key in your Rapid7 account.

Authentication Details

Steps to create Users

1. Login to Rapid7 instance .
2. Navigate to  Settings > Users  > Create New Users.
3. Fill up all the required details user.
   1. Email Address: Enter the email address of user.
   2. First Name: Add First Name of the user.
   3. Last Name: Add Last Name of the user.
   4. Timezone: Select Time zone of the user.
4.  Click Save User Details.
   1. Privileges :Select the role that best defines the permissions required by the token.
   2. Click on save individual Privileges.

Steps to generate API Key.

1. Login to Rapid7 instance.
2. Navigate to Settings > API Keys.
3. Now Click Generate New User Key.
4. Now select the Organization and Add Name.
5. Click Submit.
6. Copy your generated API key. 

Connector Configuration

Basic Details

1. Provide Name and Description.
2. Select findings type (supported: Assets and Vulnerability / Host Asset).
3. Enter Region and API Key.

Data Models

The Rapid7 API Connector offers an out-of-box data model mapping for you to map with Qualys ETM schema. You can view the schema to understand the attributes in the data model.

Transform Maps

Default transform maps are provided. You can create or clone maps and set Transform Map Name, Source Data Model, and Target Data Model.

Profile

Create a profile with Name, Description, Transform Map, Status, and Schedule.

When editing a connector, you can find the Retain Delta checkbox. Select this checkbox to retain delta that has already been set for this connection. Deselecting this resets delta and begins fresh ingestion.

Scoring

Map Rapid7 non-CVE severities/labels to QDS 0–100; set Default Severity for unmatched values.

Select Identification Rules

The Identification Rules are a set of out-of-the-box precedence rules set by Qualys CSAM. The connector discovers findings based on the order set by the selected Identification Rules.

You can proceed to the next step without making any changes to this screen.

If you don't want to choose a specific rule, turn off the toggle next to it. But, ensure that at least one rule is selected.

To learn more about the different rules and options present in this screen, refer to the CSAM Online Help.

How Does a Connection Work?

The connector executes on schedule (or on-demand), pulling asset and vulnerability data into ETM for analysis.

In the Connector screen, you can find your newly configured connector listed and marked in the Processed state.

Connector States

A successfully configured connector goes through 4 states.

1. Registered - The connector is successfully created and registered to fetch data from the vendor.
2. Scheduled - The connector is scheduled to execute a connection with the vendor.
3. Processing - A connection is executed and the connector is fetching the asset and findings data.
4. Processed - The connector has successfully fetched the assets, it may still be under process of fetching the findings. Wait for some more time for the connector to fetch the findings completely.

The Processed state indicates that the Connector is successfully configured but it is under the process of importing all your assets and findings. This process (specifically for findings) may take some time.

This entire process may take up to 2 hours for completion. Once it is done, you can find the imported data in Enterprise TruRisk Management (ETM).

View Assets and Findings in ETM

• Assets: Inventory > Assets > Host. Use the filer tags.name:"Rapid7"

• Findings: Risk Management > Findings > Vulnerability. Use  the filter finding.vendorProductName:"Rapid7"


Additional Resources

API References

Rapid7 Vulnerability Data Model Map

The Rapid7 to Qualys Vulnerability data model mapping.

Rapid7 Asset Data Model Map

The Rapid7 to Qualys Asset data model mapping.