Page Comparison

<any_directory>
└── devo-collectors/
    └── rapid7_insightvm/
        ├── certs/
        │   ├── chain.crt
        │   ├── <your_domain>.key
        │   └── <your_domain>.crt
        └── config/ 
            └── config-insightvm.yaml

globals:
  debug: false
  id: not_used
  name: rapid7_insightvm
  persistence:
    type: filesystem                                               # File system persistence ON
    config:
      directory_name: state                                        # Directory where the persistence will be saved in case of using filesystem
outputs:
  devo_1:                                                          # Cloud Devo config EU (for US use collector-us.devo.io)
    type: devo_platform                                            
    config:
      address: collector-us.devo.io
      port: 443
      type: SSL
      chain: chain.crt
      cert: your_domain.crt
      key: your_domain.key
inputs:
  rapid7:
    id: <short_unique_identifier>                                  # The value of this field will be used internally for having independent persistence areas
    enabled: true
    requests_per_second: 5                                         # Setup how many request API por second
    credentials:
      user: <user>                                                 # InsightVM on-premises user used to retrieve the data
      password: <password>                                         # InsightVM on-premises user's password
    server: <server_ip or name>                                    # InsightVM on-premises server ip or name
    port: <insightvm port, default 3780>                           # InsightVM on-premises server port
    services:                                                      # Services available for this collector are vulnerabilities, assets, sites and scans
      vulnerabilities:
        request_period_in_seconds: 60                              # Setting up time interval between API requests. 60 sec is recommended for vulnerabilities. 86400 or more for the other services.
        page_size: 100                                             # OPTIONAL, retrieving pagination size, only used to improve performance
        custom_tag: "my.app.insightvm.vulnerabilities"            # OPTIONAL, devo custom tag
      assets:
        request_period_in_seconds: 86400
        page_size: 100
        custom_tag: "my.app.insightvm.assets"
      sites:
        request_period_in_seconds: 86400
        page_size: 100
        custom_tag: "my.app.insightvm.sites"
      scans:
        request_period_in_seconds: 86400
        page_size: 100
        custom_tag: "my.app.insightvm.scans"

Optional fields

• custom_tag:Used to send retrieved data to a custom table (my.app). Use it only if you want to define your own synthesis, or send data to a custom parser. If this field is not present, events are sent to the default tables vuln.rapid7.insightvm.<>

• page_size: Size of the batch that is retrieved in every iteration of the collector. Use it if you need to improve your bandwidth usage.

gunzip -c <image_file>-<version>.tgz | docker load

Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace <version> with a proper value.

docker run 
--name collector-<product_name> 
--volume $PWD/certs:/devo-collector/certs 
--volume $PWD/config:/devo-collector/config 
--volume $PWD/state:/devo-collector/state 
--env CONFIG_FILE=config.yaml 
--rm 
--interactive 
--tty 
<image_name>:<version>

Replace <version> with a proper value.

version: '3'
services:
  collector-<product_name>:
    image: <image_name>:${IMAGE_VERSION:-latest}
    container_name: collector-<product_name>
    volumes:
      - ./certs:/devo-collector/certs
      - ./config:/devo-collector/config
      - ./credentials:/devo-collector/credentials
      - ./state:/devo-collector/state
    environment:
      - CONFIG_FILE=${CONFIG_FILE:-config.yaml}

IMAGE_VERSION=<version> docker-compose up -d

Replace <product_name>, <image_name> and <version> with the proper values.