Rapid7 Nexpose
Overview
The Rapid7 Nexpose integration connects the Praetorian Guard Platform (PGP) with your on-premises Nexpose vulnerability scanner, importing discovered assets, open services, and vulnerability scan results into a unified attack surface view. Nexpose (also known as InsightVM when deployed via the Rapid7 Insight platform) is an on-premises vulnerability management solution that scans your internal and external network infrastructure for known vulnerabilities.
By connecting Nexpose to PGP, you gain continuous visibility into the assets and vulnerabilities that Nexpose discovers during its scans. PGP correlates this internal vulnerability data with your broader attack surface context, enabling you to trace exposure from the internet to vulnerable internal hosts and prioritize remediation based on real-world reachability.
This integration operates in a read-only capacity. PGP queries the Nexpose Security Console API to retrieve asset and vulnerability data but never modifies scan configurations, policies, or remediation states in your Nexpose environment.
---
What the Integration Does
When enabled, PGP connects to your Nexpose Security Console's REST API (v3) and performs the following:
Asset discovery -- Paginates through all assets in your Nexpose console, extracting IP addresses, hostnames, and open services (protocol and port).
Vulnerability ingestion -- For each asset with known vulnerabilities, PGP retrieves the full list of vulnerability findings at both the asset level and the per-service level.
Severity mapping -- Each vulnerability's severity score (0--10) from Nexpose is mapped to a PGP severity level (Info, Low, Medium, High, Critical).
Proof artifacts -- Raw vulnerability result data from Nexpose is attached to each risk as proof, preserving the original scan evidence.
All data flows one direction: from Nexpose into PGP. Assets become PGP assets, open services become PGP attributes, and vulnerabilities become PGP risks with associated proof artifacts.
---
Prerequisites
Before setting up the integration, ensure you have:
A running Rapid7 Nexpose Security Console (or InsightVM console) with API access enabled
A Nexpose user account with at least read-only permissions to view assets, sites, and vulnerabilities
Network connectivity from PGP to your Nexpose console on the API port (default: TCP 3780)
The base URL of your Nexpose console (e.g.,
https://nexpose.yourcompany.com:3780)
Creating a Nexpose API User
Log in to your Nexpose Security Console
Navigate to Administration > Users
Click Create to add a new user
Set the Authentication method to Normal
Assign the Security Manager or Global Reader role (read-only access is sufficient)
Save the user and note the username and password
---
Setup
In PGP, go to Integrations and locate Rapid7 Nexpose (under Vulnerability Management)
Enter the required credentials
Click Connect -- PGP will validate the credentials by querying the Nexpose API before saving
Field Reference
Once connected, PGP will begin syncing asset and vulnerability data on its regular integration schedule.
---
What Data Is Synced
Assets
Each asset discovered by Nexpose is imported into PGP. An asset is created for every combination of hostname and IP address reported by the scanner.
Assets that lack either a hostname or IP address are skipped.
Attributes (Services)
Open services detected on each asset are imported as PGP attributes.
Risks (Vulnerabilities)
Vulnerabilities are imported at both the asset level and the per-service level.
---
API Endpoints Used
PGP uses the Nexpose Security Console REST API v3. All requests use Basic authentication and are read-only (GET).
PGP limits concurrent API requests to 10 parallel calls to avoid overloading your Nexpose console.
---
Troubleshooting
---
Security and Data Handling
Read-only access -- PGP only performs GET requests against the Nexpose API. It never creates, modifies, or deletes any data in your Nexpose environment.
Credential storage -- Your Nexpose username and password are encrypted at rest and never exposed in logs or API responses.
Basic authentication -- Credentials are sent as a Base64-encoded
Authorization: Basicheader over HTTPS. Ensure your Nexpose console is configured with a valid TLS certificate.Data residency -- Imported asset and vulnerability data is stored within your PGP tenant and subject to your organization's data retention policies.
Minimal permissions -- Only read-level access is required. We recommend creating a dedicated service account with the least privileges necessary.