SmartConnector for Rapid7 NeXpose XML File

1 Likes
over 9 years ago

Labels:

SmartConnector Configuration Guides - File (XML)
Comment List
Anonymous
  • Did anyone got this Connector to work with big XML-Files? We run weekly Nexpose Scans in a big environment resulting in 500MB+ Nexpose XML-Logfiles. The Connector cannot handle those and is "working" with only 1-1.4 EPS which means not even half of the Logfile is processed when a new Logfile is created a week later. It is neither the network nor the server performance which is limiting the EPS, just the broken Arcsight Connector. Unfortunataly you can't split XML Reports in Nexpose and the Arcsight support isn't helping either. Splitting the report by hand is tricky, since it destroys XML integrity and the connection between vulnerabilities and affected assets. Any ideas? 

  • Hi,

    Is there a new config guide for Rapid7 nexpose version 6.4?  Seems like the config guide is outdated. Can someone help me do the integration?

     

    Thanks!

    Aqui

  • The XML output file format has not changed through the versions.  This is compatible.

  • Currently 5.9 is supported and I don't see any feature requests for version 6.3.  Suggest you contact Support and open a request for new version support for 6.3.

    Ingrid

  • Hi,

    Is Nexpose version 6.3.2 supported by Arcsight. I went through the Arcsight config guide, it shows it supports versions 4.0 through 4.12 and versions 5.5 through 5.9. I have Nexpose 6.3.2 in my environment, can someone help me with this.?

    Thanks.

  • I got the following answer from the connector developers.

    Q: Does the connector have to be installed in the same server where NeXpose is running?

    A: The folder must be visible to the machine where the connector is installed, so either on the same machine or mounted device.

    Q: How do you save the file to be 'report.xml_done' -- do you just rename it?

    A: If report.xml is what you get from the NeXpose device, you need to have ANOTHER file presejnt (could be empty), with the name report.done.  It is called a trigger file and is removed after report.xml is processed.  This is usually done by an outside script or manually.

    Q: When trying to set the folder for the connector to scan the files, it does not display any file, even when they were stored there. Is that usual?

    A: If you are talking about interactive mode and the connector's GUI does not display any jobs, you have to be sure that a folder has an 'absolute path name; formj, is visible from the connector's location, and file names satisfy the wildcard pattern you provide. For example, if you use report.xml, wildcard (or filter) should sat '*.xml'.  If you use compressed file report.xml_gz, filter should say '*.xml_gz.

  • The comment from Mark Ulmer regarding trigger files has been addressed.  I am following up with development on the status of your questions.  As for NeXpose having a connector for Linux, I don't completely understand the question.  The SmartConnector for Rapid7 NeXpose File is installable on Windows or Linux platforms; there wouldn't be a separate connector for Linux.

  • Hi Ingrid,

    Is there any news about this connector? does nexpose have a smartconnector for linux?

    Best Regards

  • Mark, this is being addressed and will be in the next SmartConnector release.

  • As development input is required for these issues, I have opened a feature request to track resolution of both of these comments (from Mark Ulmer and from Jhosemar Lopez. 

Related Discussions
Recommended