Adding a Rapid7 Nexpose scanner remote file import

QRadar® uses remote files to import site vulnerability data from your Rapid7 Nexpose scanner.

Before you begin

Before you add this scanner, make sure that you have a server certificate that supports HTTPS connections. QRadar supports certificates with the following file extensions: .crt, .cert, or .der. To copy a certificate to the /opt/qradar/conf/trusted_certificates directory, choose one of the following options:
  • Manually copy the certificate to the /opt/qradar/conf/trusted_certificates directory by using SCP or SFTP.
  • Use SSH to log in to the Console or managed host and retrieve the certificate by using the following command: /opt/qradar/bin/getcert.sh <IP or Hostname> <optional port - 443 default>. A certificate is then downloaded from the specified host name or IP and placed into /opt/qradar/conf/trusted_certificates directory in the appropriate format.

About this task

Remote file imports collect vulnerabilities for a site from a remote file that is downloaded. The Rapid7 Nexpose XML file that contains the site and vulnerability information must be copied from your Rapid7 Nexpose appliance to the Console or managed host you specify when the scanner is added to QRadar. The destination directory on the managed host or Console must exist before the Rapid7 Nexpose appliance can copy site reports. The site files can be copied to the managed host or Console by using Secure Copy (SCP) or Secure File Transfer Protocol (SFTP).

The import directory that is created on the managed host or QRadar Console must have the appropriate owner and permission set on it for the VIS user within QRadar. For example, chown -R vis:qradar <import_directory_path> and chmod 755 <import_directory_path> set the owner of the import directory path to VIS user with adequate read-write-execute permissions.

Note: Site files that are imported are not deleted from the import folder, but renamed to .processed0. Administrators can create a cron job to delete previously processed site files.

Procedure

  1. Click Admin > System Configuration.
  2. Click the VA Scanners icon, and then click Add.
  3. Type a Scanner Name to identify your Rapid7 Nexpose scanner.
  4. From the Managed Host list, select an option that is based on one of the following platforms:
    • On the QRadar Console, select the managed host that is responsible for communicating with the scanner device.
    • On QRadar on Cloud, if the scanner is hosted in the cloud, the QRadar Console can be used as the managed host. Otherwise, select the data gateway that is responsible for communicating with the scanner device.
  5. From the Type, select Rapid7 Nexpose Scanner.
  6. From the Import Type list, select Import Site Data - Remote File.
  7. Enter the Remote Hostname of the server that has the scan result files and the Remote Port of the remote SSH server.
  8. Enter the user name and password for the remote SSH server.
  9. Optional: Enable key authentication, and then enter the full local path to the SSH private key file.
  10. Indicate the location of the remote directory that contains the scan results on the remote SSH server.
  11. In the File Name Pattern field, type a regular expression (regex) pattern to determine which Rapid7 Nexpose XML files to include in the scan report.
    All file names that match the regex pattern are included when the vulnerability scan report is imported. You must use a valid regex pattern in this field. The default value .*\.xml imports all files from the import folder.
  12. Enter the maximum number of days to use the report file. Files older than this number of days aren't processed. Set the number to 0 if you want to disable report age checking.
  13. Configure a CIDR range for your scanner:
    1. In the field, type the CIDR range that you want this scanner to consider or click Browse to select a CIDR range from the network list.
    2. Click Add.
  14. Click Save.
  15. On the Admin tab, click Deploy Changes.

What to do next

You are now ready to create a scan schedule. See Scheduling a vulnerability scan.