Page Comparison

...

This minimum configuration refers exclusively to those specific parameters of this integration. There are more required parameters related to the generic behavior of the collector. Check running the collector section for details.

Setting	Details
`api_key`	The `API Key`is your unique identifier for Rapid7 InsightVm Cloud.
`region`	The `region` is your region or Rapid7 InsightVm Cloud.
`api_version`	The `API Version` is the version of the api for Rapid7 InsightVm Cloud

Run the collector

Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).

Rw ui tabs macro

Rw tab

title	Cloud collector

We use a piece of software called Collector Server to host and manage all our available collectors.

To enable the collector for a customer:

In the Collector Server GUI, access the domain in which you want this instance to be created
Click Add Collector and find the one you wish to add.
In the Version field, select the latest value.
In the Collector Name field, set the value you prefer (this name must be unique inside the same Collector Server domain).
In the sending method select Direct Send. Direct Send configuration is optional for collectors that create Table events, but mandatory for those that create Lookups.
In the Parameters section, establish the Collector Parameters as follows below:

Editing the JSON configuration

Code Block

{
  "global_overrides": {
    "debug": false
  },
  "inputs": {
    "insightvm_cloud": {
      "id": "<short_unique_id>",
      "enabled": true,
      "credentials": {
        "api_key": "<api_key_value>"
      },
      "region": "<region_value>",
      "api_version": "<api_version_value>",
      "requests_limits": [
        {
          "period": "1d",
          "number_of_requests": -1
        },
        {
          "period": "1h",
          "number_of_requests": -1
        },
        {
          "period": "1m",
          "number_of_requests": -1
        },
        {
          "period": "1s",
          "number_of_requests": -1
        }
      ],
      "services": {
        "vulnerabilities": {
          "request_period_in_seconds": "<request_period_in_seconds_value>",
          "override_devo_tag": "<override_devo_tag_value>",
          "override_page_size": "<override_page_size_value>",
          "sort_by": "<sort_by>"
        },
        "assets": {
          "request_period_in_seconds": "<request_period_in_seconds_value>",
          "override_devo_tag": "<override_devo_tag_value>",
          "override_page_size": "<override_page_size_value>",
          "sort_by": "<sort_by>"
        },
        "sites": {
          "request_period_in_seconds": "<request_period_in_seconds_value>",
          "override_devo_tag": "<override_devo_tag_value>",
          "override_page_size": "<override_page_size_value>",
          "sort_by": "<sort_by>"
        },
        "scans": {
          "request_period_in_seconds": "<request_period_in_seconds_value>",
          "override_devo_tag": "<override_devo_tag_value>",
          "override_page_size": "<override_page_size_value>",
          "sort_by": "<sort_by>"
        }
      }
    }
  }
}

Parameter	Data type	Type	Value range / Format	Details
<short_unique_id>	int	Mandatory	Minimum Length 5	Use this parameter to give a unique ID to this input service. This parameter is used to build the persistence address; do not use the same value for multiple collectors. It could cause a collision.
<input_status>	bool	Mandatory	false / true	Use this param to enable or disable the given input logic when running the collector. If the value is true, the input will be run. If the value is false, it will be ignored.
<api_key_value>	str	Mandatory	Minimum Length 1	The API Key is your unique identifier used as the Authorization:{key}.
<region_value>	str	Mandatory	Minimum Length 1	The region for the insightVM Cloud
<api_version_value>	str	Mandatory	Minimum Length 1	The api version for the insightVM Cloud
requests_limits	array	Optional	Minimum Length 1	This params allows to limit the number of request to be made in a period. For example, if `period: 1d` and number_of_requests is `100` so the api will make 100 requests in 24 hours i.e 1d
<request_period_in_seconds_value>	int	Optional	Minimum Length 1	Period in seconds used between each data pulling, this value will overwrite the default value 60 seconds
<override_devo_tag_value>	str	Optional	A devo tag	This parameter allows defining a custom devo tag . Ex: my.app.devo.tag
<override_page_size_value>	int	Optional	Minimum Length 1	This parameter allows to override the page_size. By default the page size is 500.
<sort_by>	str	Optional	Minimum Length 1	This parameter allows to sort the data based on the sort valuesEx:- 'id, asc'

Rw tab

title	On-premise collector

This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.

Structure

The following directory structure should be created for being used when running the collector:

Code Block

<any_directory>
└── devo-collectors/
    └── <product_name>/
        ├── certs/
        │   ├── chain.crt
        │   ├── <your_domain>.key
        │   └── <your_domain>.crt
        ├── state/
        └── config/ 
            └── config.yaml

Note
Replace `<product_name>` with the proper value.

Devo credentials

In Devo, go to Administration → Credentials → X.509 Certificates, download the Certificate, Private key and Chain CA and save them in <product_name>/certs/. Learn more about security credentials in Devo here.

Note
Replace `<product_name>` with the proper value.

Editing the config.yaml file

Code Block

globals:
  debug: false
  id: not_used
  name: example_collector
  persistence:
    type: filesystem
    config:
      directory_name: state

outputs:
  devo_1:
    type: devo_platform
    config:
      address: <devo_address>
      port: 443
      type: SSL
      chain: <chain_filename>.crt
      cert: <cert_filename>.crt
      key: <key_filename>.key

  console_1:
    type: console

inputs:
  insightvm_cloud:
    id: <short_unique_id>
    enabled: true
    credentials:
      api_key: <api_key_value>
    region: <region_value>
    api_version: <api_version_value>
    requests_limits:
      - period: 1d
        number_of_requests: -1
      - period: 1h
        number_of_requests: -1
      - period: 1m
        number_of_requests: -1
      - period: 1s
        number_of_requests: -1
    services:
      vulnerabilities:
        request_period_in_seconds: <request_period_in_seconds_value>
        override_devo_tag: <override_devo_tag_value>
        override_page_size: <override_page_size_value>
        sort_by: <sort_by>
      assets:
        request_period_in_seconds: <request_period_in_seconds_value>
        override_devo_tag: <override_devo_tag_value>
        override_page_size: <override_page_size_value>
        sort_by: <sort_by>
      sites:
        request_period_in_seconds: <request_period_in_seconds_value>
        override_devo_tag: <override_devo_tag_value>
        override_page_size: <override_page_size_value>
        sort_by: <sort_by>
      scans:
        request_period_in_seconds: <request_period_in_seconds_value>
        override_devo_tag: <override_devo_tag_value>
        override_page_size: <override_page_size_value>
        sort_by: <sort_by>

Info
All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the `services` object.

Replace the placeholders with your required values following the description table below:

Parameter	Data type	Type	Value range / Format	Details
<devo_address>	str	Mandatory	collector-us.devo.io, collector-eu.devo.io	Use this param to identify the Devo Cloud where the events will be sent

<chain_filename>	str	Mandatory	Minimum length: 4, Maximum length: 20	Use this param to identify the chain.cert file downloaded from your Devo domain. Usually this file's name is: chain.crt
<cert_filename>	str	Mandatory	Minimum length: 4, Maximum length: 20	Use this param to identify the file.cert downloaded from your Devo domain.
<key_filename>	str	Mandatory	Minimum length: 4, Maximum length: 20	Use this param to identify the file.key downloaded from your Devo domain.
<short_unique_id>	int	Mandatory	Minimum Length 5	Use this parameter to give a unique ID to this input service. This parameter is used to build the persistence address; do not use the same value for multiple collectors. It could cause a collision.
<input_status>	bool	Mandatory	false / true	Use this param to enable or disable the given input logic when running the collector. If the value is true, the input will be run. If the value is false, it will be ignored.
<api_key_value>	str	Mandatory	Minimum Length 1	The API Key is your unique identifier used as the Authorization:{key}.
<region_value>	str	Mandatory	Minimum Length 1	The region for the insightVM Cloud
<api_version_value>	str	Mandatory	Minimum Length 1	The api version for the insightVM Cloud
<requests_limits &gt	array	Optional	Minimum Length 1	This params allows to limit the number of request to be made in a period. For example, if `period: 1d` and number_of_requests is `100` so the api will make 100 requests in 24 hours i.e 1d
<request_period_in_seconds_value>	int	Optional	Minimum Length 1	Period in seconds used between each data pulling, this value will overwrite the default value 60 seconds
<override_devo_tag_value>	str	Optional	A devo tag	This parameter allows defining a custom devo tag . Ex: my.app.devo.tag
<override_page_size_value>	int	Optional	Minimum Length 1	This parameter allows to override the page_size. By default the page size is 500.
<sort_by>	str	Optional	Minimum Length 1	This parameter allows to sort the data based on the sort valuesEx:- 'id, asc'

Download the Docker image

The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:

Collector Docker image	SHA-256 hash
collector-sendmarcrapid7_insightvm_cloud_if-docker-image-1.1.0	`b78949471f89769634f397fd99ce6f462e46b62e8046a218254984f961e9e2d0`

Use the following command to add the Docker image to the system:

Code Block
gunzip -c <image_file>-<version>.tgz \| docker load

Note
Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace `<image_file>` and `<version>` with a proper value.

The Docker image can be deployed on the following services:

Docker

Execute the following command on the root directory <any_directory>/devo-collectors/<product_name>/

Code Block

docker run 
--name collector-<product_name> 
--volume $PWD/certs:/devo-collector/certs 
--volume $PWD/config:/devo-collector/config 
--volume $PWD/state:/devo-collector/state 
--env CONFIG_FILE=config.yaml 
--rm 
--interactive 
--tty 
<image_name>:<version>

Docker Compose

The following Docker Compose file can be used to execute the Docker container. It must be created in the <any_directory>/devo-collectors/<product_name>/ directory.

Code Block

version: '3'
services:
 collector-<product_name>:
   image: <image_name>:${IMAGE_VERSION:-latest}
   container_name: collector-<product_name>
   restart: always
   volumes:
     - ./certs:/devo-collector/certs
     - ./config:/devo-collector/config
     - ./credentials:/devo-collector/credentials
     - ./state:/devo-collector/state
   environment:
     - CONFIG_FILE=${CONFIG_FILE:-config.yaml}

To run the container using docker-compose, execute the following command from the <any_directory>/devo-collectors/<product_name>/ directory:

Code Block
IMAGE_VERSION=<version> docker-compose up -d

Note
Replace `<product_name>`, `<image_name>` and `<version>` with the proper values.

...

Version	Old Version 1	New Version Current
Changes made by	MD Tausif	MD Tausif
Saved on	Jan 08, 2025	Jan 10, 2025

Page Comparison

Versions Compared

Key

Run the collector

Editing the JSON configuration

Structure

Devo credentials

Editing the config.yaml file

Download the Docker image

Docker

Docker Compose