Deploy Vulnerability Management (InsightVM) in InsightGovCloud

What is Vulnerability Management (InsightVM)?

Vulnerability Management (InsightVM) is a data-rich resource that can amplify the other solutions in your tech stack, from SIEMs and firewalls to ticketing systems.

Vulnerability Management (InsightVM) brings together Rapid7's library of vulnerability research knowledge from Nexpose, exploit knowledge from Metasploit, global attacker behavior, internet-wide scanning data, exposure analytics, and real-time reporting.

A Vulnerability Management (InsightVM) installation has these components:

Before you begin the deployment, ensure you have read and completed any outstanding tasks in the deployment overview.

Network architecture of Vulnerability Management (InsightVM) in InsightGovCloud

This architecture diagram identifies the components that reside inside the customer network and those that are hosted within the Rapid7 InsightGovCloud FedRAMP boundary.

Security Console system requirements

The complete hardware and software requirements are provided in the system requirements section of the Vulnerability Management (InsightVM) quick start guide.

The Security Console requires significantly more system resources than a Scan Engine, as it includes a web interface, PostgreSQL database, and reporting capabilities.

Deploying on a virtual machine

There are some requirements to consider before you deploy the Security Console on a virtual machine (VM):

• The memory reservation must match the allocation. For example, if you allocate 32 GB of RAM, you must also reserve 32 GB.

• Avoid using shared memory configurations, which can lead to degraded performance and out-of-memory (OOM) errors.

Security Console minimum specifications

Scan Engine minimum specifications

Several factors can affect memory consumption during scans, including the type of scan being conducted (for example, Policy, Vulnerability, or Discovery), the number of ports detected that require fingerprinting, and the configured Maximum assets scanned simultaneously per Scan Engine.

Operating systems

Microsoft Windows and Linux servers are supported. Specific server information is available in the Vulnerability Management (InsightVM) Quick Start Guide.

User access and security

Whether you are a new or an existing Rapid7 customer, an essential part of the deployment is to enable FIPS mode.

FIPS stands for the Federal Information Processing Standard and is required to ensure compliance with the InsightGovCloud environment.

The Security Console and Scan Engine can store and interact with sensitive data and should therefore be installed on a FIPS-compliant encrypted partition and a FIPS-compliant operating system. Access to the file system and operating system should be monitored and restricted to users who are authorized for the highest security classification within your organization.

Deploy as a new or existing customer

A Rapid7 Engineer will be assigned to help you with the initial deployment of the Security Console. When you are ready to begin the deployment, contact your Rapid7 Federal Customer Success Manager.

Here is an overview of the deployment process:

1. If you haven't yet activated your InsightGovCloud account, do so now by following the instructions in Phase 2, Task 1: Activate your new account of the deployment overview.

2. Enable Multi-Factor Authentication as explained in Phase 2, Task 4: Configure security policies of the deployment overview.

3. Complete Prerequisite 1: Update the firewall rules for external, internal, and Rapid7 Agent connectivity.

4. Complete Prerequisite 2: License and system requirements.

5. Follow the Vulnerability Management (InsightVM) for InsightGovCloud installation procedure according to your operating system:

   • Linux installation

   • Windows installation

6. Enable FIPS mode.

7. Start the Security Console.

Prerequisite 1: Update the firewall rules

Firewall rules for external network connectivity

The InsightGovCloud environment uses a different set of network endpoints for communication with Vulnerability Management and Exposure Analytics (EA). Update your firewall rules as follows:

Firewall rules for internal network connectivity (host level firewall)

Scan Engines and Security Consoles must be able to communicate with each other in order to initiate scans and integrate scan data. Distributed Scan Engines can communicate with a Security Console in two ways:

• Standard (Console-to-Engine) – This is the most common communication method for a distributed Scan Engine. When the Security Console determines that a scan needs to take place on your target assets, it initiates the connection to communicate with the Scan Engine. Scan Engines must allow inbound traffic on the default port of 40814 in order to create this connection.

• Reverse (Engine-to-Console) – This method is useful in cases where your security policies restrict inbound connections to the network hosting the scan engine. The Scan Engine routinely pings the Security Console to see if a scan job needs to be run. Security Consoles must allow inbound traffic on the default port of 40815 in order to create this connection.

Firewall rules for Rapid7 Agent connectivity

The InsightGovCloud environment uses a different set of network endpoints for agent communication. To maintain full agent functionality:

• Review and update your firewall rules to allow outbound access to FedRAMP-specific URLs and IP addresses.

• Ensure connectivity for critical agent functions, including data transmission, update delivery, and vulnerability assessments.

Internal ports for Scan Engine connectivity

The Security Console requires specific internal ports to be opened to allow communication with the console and between the Scan Engines.

Rapid7 Agent (Insight Agent) requirements

To use the Rapid7 Agent (Insight Agent) with Vulnerability Management, read the requirements in Deploy Rapid7 Agent (Insight Agent) in InsightGovCloud. This section also contains information about asset correlation in the Security Console and how to use the Universally Unique Identifier (UUID) retrieval feature.

Operating systems that support the Scan Assistant

Information about the supported operating systems and installation instructions for the Scan Assistant is available in the Scan Assistant documentation.

Benefits of using the Scan Assistant and Rapid7 Agent

The value of having both the Rapid7 Agent (Insight Agent) and the Scan Assistant on the same system is multifaceted:

• Complementary functionality – The Rapid7 Agent and Scan Assistant are designed to complement each other. The Agent performs local checks, while the Scan Assistant allows for immediate authenticated vulnerability scans, which are useful for remediation scans.

• Efficient remediation – If a vulnerability is discovered by the Agent, the Scan Assistant can be used to immediately verify remediation by initiating an authenticated scan, rather than waiting for the Agent to conduct another assessment.

• Expanded policy scanning – The Scan Assistant provides access to a broader range of policy scans beyond what the Agent can assess. It supports all categories of policy scans, including CIS, DISA, FDCC, and USGCB, and allows for custom policy building.

• Resource efficiency and security – The Scan Assistant consumes fewer resources and provides a more secure scanning method by removing the need for administrative credential management. It also decreases the time required to complete policy scans.

Prerequisite 2: License and system requirements

In order to complete the installation, you will need this information from your account team:

• A Security Console license key, in the format: MOCK-KEY0-L8ET-CHRD.

• An email with the subject line Rapid7 Insight: Activate Your Account.

You will also need a server to be used as the Security Console. Specifically, you will require:

• Hardware as outlined in the Vulnerability Management (InsightVM) system requirements: 24 GB RAM, 8 CPU, fast SSD, and a network connection.

• A dedicated IP address.

• Administrator privileges.

Install Vulnerability Management for InsightGovCloud (Linux)

Linux software packages

These packages will be installed when you run the installation commands or the quick install script:

• rng-tools – Required for FIPS mode. Provides hardware and kernel random number generator (RNG) utilities to ensure the system has sufficient entropy for cryptographic operations.

• policycoreutils – Core administrative utilities for SELinux (Security-Enhanced Linux), used to manage and apply SELinux security policies.

• policycoreutils-python-utils – Adds extra SELinux management tools written in Python, such as semanage, for managing ports, file contexts, booleans, and users.

How to perform the installation

Choose one of the following methods:

• Review and run the quick install script for your environment (recommended).

• Manually install the prerequisites, install the Security Console and Scan Engine, and configure for FIPS mode.

Run the Linux quick install script (recommended)

The quick install script has been tested on these versions:

• Red Hat Enterprise Linux (RHEL) 10.0 (Coughlan)

• Ubuntu 24.04.3 LTS

• Rocky Linux 10.0 (Red Quartz)

As the quick install script runs, it performs these actions:

1. Installs the required Linux packages, such as rng-tools, policycoreutils, and policycoreutils-python-utils.

2. Ensures the random number generator (rngd) is installed and running, which is a FIPS requirement.

3. If needed, configures SELinux rules for file/folder/process access.

4. Downloads and runs the Rapid7 installer. Use all default settings unless your installation requires advanced configuration, such as separate Scan Engines.

5. Enables Federal and FIPS mode.

6. Starts the Security Console service and enables startup on boot.

7. Ensures the Security Console service is running in FIPS mode.

Create, review, and run the script

1. Log in to the new server with administrator access (sudo privileges), for example: SSH: <YourConsoleIPaddress>.

2. Make a directory called insightgovcloud_vm_install.

3. Copy and paste the quick install script into a file named install_fedramp_insightvm.sh.

4. Review and run the script:

   Copy

   # Example command. Adjust for version number.
   cat ./install_fedramp_insightvm.sh
   chmod +x ./install_fedramp_insightvm.sh
   ./install_fedramp_insightvm.sh

Perform the Linux installation manually

The following provides sample commands for Ubuntu, RHEL, and Rocky for the prerequisite, Security Console, and InsightGovCloud configuration steps. The comments specify the distribution.

# Update system packages
# for RHEL
sudo dnf -y update
# for Ubuntu
sudo apt-get update -y

# Install prerequisite packages (RNG, SELinux tools when available, curl)
# for RHEL
sudo dnf -y install rng-tools policycoreutils policycoreutils-python-utils curl
# for Ubuntu
apt-get install -y rng-tools5 rng-tools

# Enable and start RNG daemon
# For RHEL/Rocky
sudo systemctl enable --now rngd.service
# For Ubuntu, varies by version
sudo systemctl enable --now rngd.service

# Create /opt/rapid7/nexpose directory
sudo install -d -m 755 /opt/rapid7/nexpose
sudo chown -R root:root /opt/rapid7

# For RHEL/SELinux: label Rapid7 directories and open TCP 3780
sudo semanage fcontext -a -t usr_t '/opt/rapid7(/.*)?' || true
sudo semanage fcontext -a -t bin_t '/opt/rapid7/nexpose(/.*)?' || true
sudo semanage fcontext -a -t var_log_t '/opt/rapid7/nexpose/nsc/logs(/.*)?' || true
sudo semanage port -a -t http_port_t -p tcp 3780 2>/dev/null || sudo semanage port -m -t http_port_t -p tcp 3780 || true
sudo restorecon -RF /opt/rapid7 || true

# Download Rapid7 InsightVM installer
sudo curl -fL https://download2.rapid7.com/download/InsightVM/Rapid7Setup-Linux64.bin -o Rapid7Setup-Linux64.bin
sudo chmod +x Rapid7Setup-Linux64.bin

# Run Rapid7 installer - USE ALL DEFAULTS. DO NOT START AUTOMATICALLY
sudo ./Rapid7Setup-Linux64.bin

# Enable FedRAMP and FIPS mode
sudo bash -lc cat > /opt/rapid7/nexpose/nsc/CustomEnvironment.properties <<'EOF'
fipsMode=1
com.rapid7.federal=true
EOF

# Re-apply SELinux labels
sudo restorecon -RF /opt/rapid7/nexpose || true

# Reload systemd and enable Nexpose Console
sudo systemctl daemon-reload || true
sudo systemctl enable --now nexposeconsole.service || true

# Verify FIPS/Federal mode in logs
sudo grep -q "Console is a " /opt/rapid7/nexpose/nsc/logs/nsc.log
sudo grep -q "Console FIPS " /opt/rapid7/nexpose/nsc/logs/nsc.log

Install Vulnerability Management for InsightGovCloud (Windows)

1. Log in to the new server as an administrator, for example via RDP: <yourConsoleIPaddress>.

2. Install one of the supported Windows versions as described in the Vulnerability Management (InsightVM) documentation.

3. Download and install the Rapid7 InsightVM Install Package from https://download2.rapid7.com/download/InsightVM/Rapid7Setup-Windows64.exe.

4. Open a text editor, paste the following code, and save the file with the name CustomEnvironment.properties:

   Copy

   fipsMode=1
   com.rapid7.federal=true

5. Save the file to the nsc directory within your install location. The nsc directory is usually located at c:\Program Files\rapid7\nexpose\nsc\.

6. Reboot the server.

7. Ensure that FIPS mode is enabled by searching the log for the line Console FIPS Mode switched on = true. The log is usually located at c:\Program Files\rapid7\nexpose\nsc\logs\nsc.log.

Once this procedure is complete, you can proceed to pair the Security Console with InsightGovCloud.

Pair the Security Console with InsightGovCloud

Now that you have your Security Console set up, you can license and pair it to the InsightGovCloud Platform.

Prerequisites

Before you start the pairing process:

• Ensure you have your Security Console license key, in the format: MOCK-KEY0-L8ET-CHRD.

• Locate your activation email with the subject line Rapid7 Insight: Activate Your Account.

• Enable Multi-Factor Authentication (MFA) and enforce one of the FedRAMP-authorized MFA methods: WebAuthn or Okta Verify. For instructions, go to Multi-factor authentication.

Task 1: Activate your license on the Security Console

1. Log in to your Security Console at https://<yourConsoleIPaddress>:3780.

2. Navigate to Administration.

3. Under the Console area, click Licensing > Activate A New License.

4. Enter the license key provided by the Rapid7 Onboarding team or your account manager and click Activate with Key. If a pop-up window appears, close it to continue.

5. Navigate to Administration > User Management > Add User.

6. Create a new user with the same email address as the recipient of the Rapid7 Insight: Activate Your Account email.

7. Select InsightVM Users as the authentication method.

8. Enter a password and save it to a password manager application if desired.

9. On the User Role tab, select Global Admin and click Next.

10. On the Site Permissions tab, click Next without making a selection.

11. On the Asset Group Permissions tab, click Next without making a selection.

12. When you receive a success message, log out of the Security Console from the menu at the top right of the screen.

Task 2: Activate and reset your password on the InsightGovCloud Command Platform

1. If you did not already do so in Phase 2, Task 1, locate the email with the subject line Rapid7 Insight: Activate Your Account.

2. Click Set My Password from within the email.

3. Set your new password and specify your security questions.

4. Log in to the Command Platform with your new password.

5. The welcome message is displayed with an activation key for the Security Console. Click Copy and paste the key into a temporary text file. The key must be used within 1 hour.

6. Navigate to the settings menu at the top-right of the screen and select Company Settings.

7. On the Multi-Factor Authentication tab, switch the Enabled toggle ON.

8. Select either Okta Verify or WebAuthn and click Save. The next time you log in, you'll be required to use your chosen MFA method.

Task 3: Pair the Security Console to the Command Platform

During this procedure, you are prompted to log in to the Command Platform. Ensure you navigate to insight.rapid7-gov.com, not insight.rapid7.com.

1. Log in to your Security Console with the newly created user account that you set up in Task 1.

2. Navigate to Administration > Platform Data Synchronization and click Activate Console.

3. When prompted with a welcome message, click Activate Now.

4. Select I have an insight.rapid7.com account and click Next.

5. On the next screen, click X to close the window.

6. On the Security Console Configuration page, the VM Platform tab displays a field to enter the pairing key. Copy the key from the temporary text file, paste it into the field, then click Activate Console. A banner message appears to indicate that the pairing was successful.

7. Click Save.

Allow some time for the Security Console to synchronize with the Command Platform. Data will soon appear in the Vulnerability Management application.

Transitioning from an existing customer environment

If you are transitioning to InsightGovCloud from an existing commercial environment, there are some important considerations to note:

• Historical data and configured experiences from your commercial Vulnerability Management (InsightVM) account can't be migrated to InsightGovCloud. These include agent policies, dashboards, goals and SLAs, and remediation projects in Exposure Analytics (EA).

• Your commercial EA environment will expire 7 days after the new Security Console instance is deployed for InsightGovCloud. Follow the guidance in the customer update guide, which is available after you log in to your Rapid7 environment.

Install FedRAMP-compliant Rapid7 Agents

To ensure that your Rapid7 Agents (Insight Agents) appear in Data Collection Management (DCM) and your Policy assessment results appear in Vulnerability Management (InsightVM), you will need to install new Agents that are compatible with InsightGovCloud.

Follow the instructions in Deploy Rapid7 Agent (Insight Agent) in InsightGovCloud.