Rapid7 Insight Platform

No entries match these filters. Clear filters

1. changelog Oct 27, 2026 · issue 123

   Rapid7 Command Platform adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. support for automated user provisioning and deprovisioning via identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. such as Okta.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Enable SCIM to automate employee onboarding and offboarding so accounts are created and deactivated in Command Platform when changes occur in your IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
   📍In Command Platform, go to SSO Settings, locate the SCIM section, and enable SCIM integration — then follow the identity provider configuration steps (e.g. in Okta) to connect your IdP.
   • SCIM is disabled by default and is configured through Command Platform's SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. settings by a platform administrator.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

2. docs update Oct 6, 2026 · issue 096

   Rapid7 Command Platform adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. identity provisioning support for Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., Okta, Duo, Google, and OneLogin.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Verify that your IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. can reach the SCIM Users endpoint after enabling SCIM provisioning — useful for smoke-testing the integration with a Platform Admin APIAdmin APIA dedicated HTTP interface that exposes management and configuration operations separately from the data plane, letting cyber tools automate provisioning, policy changes, or monitoring without touching the main user-facing service. key.
   copy

   $ curl -s -H 'Authorization: Bearer <your-platform-admin-api-key>' https://eu.api.insight.rapid7.com/scim/v2/Users

   Enable SCIM on the Command Platform so your IdP can begin managing accounts automatically.
   📍1. From Command Home, go to Administration › Settings › SSO Settings. 2. Select Modify Settings. 3. Select the SCIM provisioning is active radio button. 4. Select Submit and turn on SSO.
   • Adds a SCIM provisioning is active toggle under Administration > Settings > SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. Settings on the Command Platform, activated via the Submit and turn on SSO action, to enable SCIM endpoints for IdP communication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports SCIM integration with Microsoft Entra ID, Okta, Duo, Google, and OneLogin as identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. for automated user provisioning on the Command Platform.

   2 details in Everything

3. Nexpose Release Notes (2026-10-05) Oct 5, 2026 · release notes

   Nexpose v8.62 adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. SQL Server 2025 policy content

4. Vulnerability Management Release Notes (2026-10-05) Oct 5, 2026 · release notes

   Rapid7 Insight VM 8.62.0 adds Oracle HTTP/JRE coverage, CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. SQL Server 2025 policy content, and NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. auth improvements

   • Expands vulnerability coverage for Oracle HTTP Server and Oracle JRE
   • Improves NTLM scan engine authentication

   2 details in Everything

5. changelog Oct 2, 2026 · issue 093

   Rapid7 Intelligence unifies threat intel, vulnerability research, and Rapid7 Labs into one engine feeding MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. and Exposure Management with behavioral, expert-validated insights.

   • Introduces Rapid7 Intelligence, a unified engine combining threat intelligence, vulnerability research, and Rapid7 Labs to convert real-time attacker behavior into protective action across Rapid7 products, MDR, and Exposure Management.
   • Delivers frontline intelligence that flows directly into existing Rapid7 products and MDR to neutralize adversary infrastructure before attacks execute, bypassing traditional research lag.
   • Provides behavioral correlation capability that links disparate campaigns by shared attacker behaviors rather than static indicators.

   3 details in Everything

   • New detection Modular Linux malware ecosystem detection — BPFDoor variants, BPF Rekoobe, droppers, AVERAT implants
6. Cloud Security (InsightCloudSec) Release Notes (2026-09-28) Sep 28, 2026 · release notes

   New CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. compliance packs, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. harvesting improvements, and enhanced container vulnerability export capabilities in InsightCloudSec.

   • Adds support for new CIS compliance packs to the platform

   1 detail in Everything

7. docs update Sep 24, 2026 · issue 084
   └──▷ HOW TO FIND IT
   Limit a BitSight connector to only ingest data for specific subsidiary organizations, excluding others from the Rapid7 Platform.
   📍In the Rapid7 Platform, go to Connectors › BitSight › Settings and populate the include and exclude organizations fields with the relevant organization identifiers, then save.
   └──▷ BREAKING ON UPGRADE

   • !The BitSight Patching Cadence risk vector title is renamed to Critical Vulnerability Management — any automation or reporting that references the old title by name will need to be updated.
8. docs update Sep 22, 2026 · issue 082

   Rapid7 Insight Platform adds DNS Made Easy connector and new BitSight organization filter settings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds include and exclude organizations connector settings to the BitSight connector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New DNS Made Easy connector imports managed domain details into the Rapid7 Platform.
   • Hides the Workflows and Functions tabs in the Connector detail panel for users without required permissions.
   • Adds include and exclude organizations connector settings to the BitSight connector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New DNS Made Easy connector imports managed domain details into the Rapid7 Platform.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The BitSight connector renames the Patching Cadence risk vector title to Critical Vulnerability Management — any workflow, report, or saved reference using the old name will need to be updated.
9. docs update Sep 9, 2026 · issue 069

   Rapid7 Command Platform adds endpoint user identity context, MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. Threat Hunting access, and an Environment Health Dashboard.

   └──▷ HOW TO FIND IT
   Switch back to the legacy navigation from Command Home while evaluating the new layout.
   📍In the Command Platform, go to Command Home › select the settings icon at the top right › toggle Disable or Enable to switch between the new and legacy navigations.
   • Adds access to MDR Threat Hunting for continuous threat hunting visibility.
   • Adds an Environment Health Dashboard to monitor data collection health.
   • Supports navigation search via Ctrl/Cmd+K keyboard shortcut to quickly locate any page by old or new name.
   • Adds the ability to switch between the new Command Platform navigation and the legacy navigation from Command Home during a transition period.
   • Adds access to MDR Threat Hunting for continuous threat hunting visibility.
   • Adds an Environment Health Dashboard to monitor data collection health.

   2 more in Everything

10. docs update Sep 9, 2026 · issue 069

    Rapid7 MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. gains a self-service Threat Hunts page with query replay, IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself., and on-demand PDF/HTML reports

    └──▷ HOW TO FIND IT
    Review the latest completed threat hunts and their IOCs after receiving an MDR monthly summary, without waiting for a report email.
    📍In the Command Platform, go to Response & Remediation › Threat Hunts. Select a completed hunt to open its detail page, where you can review the Threat Brief, indicators of compromise (IOCs), and recommended actions.
    Re-run a Rapid7 hunt query against your own environment data to validate coverage or extend the time range.
    📍In the Command Platform, go to Response & Remediation › Threat Hunts. Open a completed hunt, then select Replay in Log Search — the query and original time range are pre-populated in Log Search for you to execute or adjust.
    Generate a scheduled HTML or PDF threat hunting report across a configurable period for a quarterly board review.
    📍In the Command Platform, go to Response & Remediation › Threat Hunts. Select Generate Report, choose PDF or HTML format, set the desired time period, and configure a schedule for automatic delivery.
    • Adds the Threat Hunts page under Response & Remediation > Threat Hunts for MDR customers, surfacing every completed Rapid7-performed threat hunt with summary metric cards, full hunt detail pages (Threat Brief, description, recommended actions, IOCs, and queries used), and a continuously updated searchable list.
    • Enables replay of hunt queries directly in Log Search with the original time range pre-populated, letting analysts re-run Rapid7 hunting logic against their own data.
    • Supports on-demand and scheduled report generation in PDF and HTML at both the individual hunt level and across a configurable time period.

    3 details in Everything

11. Cloud Security (InsightCloudSec) Release Notes (2026-08-24) Aug 24, 2026 · release notes

    InsightCloudSec adds PostgreSQL insight with bot queries and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. worker pool improvements

    • Introduces new PostgreSQL Insight for cloud security posture managementcloud security posture managementCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. in 26.8.25

    1 detail in Everything

12. docs update Aug 4, 2026 · issue 035

    Rapid7 Command Platform adds an AI Summary Card to the Detection & Response Dashboard for MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. customers.

13. Cloud Security (InsightCloudSec) Release Notes (2026-07-07) Jul 7, 2026 · issue 008

    InsightCloudSec 26.7.7 adds ASG/EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives./Security Group insights, enhanced credential cleanup, and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. RHOCP v1.9.0 benchmark support.

    • New Insights added for Auto Scaling Groups, EBS Volumes, and Security Groups.
    • Enhanced credential cleanup capabilities.
    • Adds support for CIS Red Hat OpenShift Container Platform Benchmark v1.9.0.

    3 details in Everything

14. July 2026 Release Notes Jul 2026 · release notes

    New Remediation Hub reporting, DRP infostealer toggle, Surface Command connectors, Cloud Security APIs and runtime health monitoring

    • Adds CVE Publish Date filter in Attack Surface Management (Surface Command) and Exposure Command Remediation Hub to focus on vulnerability disclosure timelines
    • Surfaces Microsoft Defender recommendations as a third-party source in Attack Surface Management (Surface Command) and Exposure Command Remediation Hub
    • Adds on-demand and scheduled Top Remediation report generation in PDF, HTML, and CSV formats from Remediation Hub
    • Extends Vulnerability Management (InsightVM) role-based permissions to grant Remediation Hub access without administrator privileges
    • Surfaces workflow execution history, status, and artifact details directly in Attack Surface Management (Surface Command) and Exposure Command Remediation Hub

    +15 more show less

    • Adds external user toggle in Digital Risk Protection (Threat Command) under Intelligence > DRP Configurations > Customization to control infostealer alert scope
    • Adds new connectors for Azure Blob Storage, HCL AppScan, Microsoft AD Certificate Services, and UpGuard to Attack Surface Management
    • Introduces Root Cause Analysis tab with AI-generated summaries and Prevention Windows for container runtime detection findings in Cloud Security (InsightCloudSec)
    • Replaces Edit Metadata/Add to Custom Pack actions with a unified Map to Compliance Pack action supporting custom rules in Cloud Security (InsightCloudSec)
    • Adds new API endpoints GET /pack/{pack_id}/insight-rule-mappings, GET /packs-with-rules, POST /map-to-compliance-rule, GET /pack/{pack_id}/rules, POST /pack/{pack_id}/rules/create, POST /pack/{pack_id}/rules/delete, and POST /pack/{pack_id}/rules/rename for programmatic compliance rule management
    • Adds new query filters for Lambda code signing, execution role status, Lightsail access logging, ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. public IP, and EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Tag Policy in Cloud Security (InsightCloudSec)
    • Introduces Runtime Sensor Health Monitoring with Healthy, Disconnected, or Degraded status columns on Kubernetes Clusters page in Cloud Security (InsightCloudSec)
    • Adds new Insights for Lambda deprecated runtime, admin role assignment, public access policies, load balancer HTTP configuration, and EC2 tag propagation in Cloud Security (InsightCloudSec)
    • Adds new compliance packs: HITRUSTHITRUSTA US-based certification framework for healthcare data security, maintained by the HITRUST Alliance, that maps controls from HIPAA, NIST, and ISO into a single assessable standard tools can target to prove compliance. CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. v11.7.1 e1 Essential, HITRUST CSF v11.7.1 i1 Intermediate, CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Microsoft Azure Storage Services Benchmark v1.0.0, and CIS Red Hat OpenShift Container Platform Benchmark v1.9.0
    • Adds support for harvesting AWS Organizations Tag Policy resources via TagPolicyHarvester in Cloud Security (InsightCloudSec)
    • Separates GCP onboarding permissions into observe and remediate tiers with Enable remediation permissions toggle and --permission-tier full script option
    • Adds support for Windows built-in Sysmon optional feature in Rapid7 Agent 4.1.1
    • Upgrades Suricata from 7.0.15 to 8.0.5 in Insight Network Sensor 2.1.0.1 with new protocol detection for VNC, WCF, Meraki Cloud Protocol, Centrak RTLS, and JetDirect (PJL)
    • Adds new connectors for Adaptive Security, Avigilon Alta, Halcyon, BlueCat Micetro, Paycom, Scale Computing Fleet Manager, and Nutanix Prism Central to Attack Surface Management
    • Removes Test Connection button when the test function is unavailable in Connector profile in Attack Surface Management

    20 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Renamed Query Filter Serverless Function with/without Code Signing Enabled to Serverless Function Signed Code Deployment in Cloud Security (InsightCloudSec)
    • !Deprecated Query Filters Serverless Function Not Associated with Role and Serverless Function Associated with Role replaced by Serverless Function Active Execution Role Status in Cloud Security (InsightCloudSec)
    • !Deprecated Query Filter Snapshot Accessible To Public renamed to Snapshot Accessible To Public (Deprecated) and functionality split into Snapshot Public Access and new Database Snapshot Public Access in Cloud Security (InsightCloudSec)
    • !Deprecated Insight Snapshot Available to the Public replaced by new Snapshot Is Accessible to the Public and Database Snapshot Is Accessible to the Public in Cloud Security (InsightCloudSec)
    • !Renamed Query Filter Load Balancer With HTTP Listener Not Redirecting To HTTPS to Load Balancer Comprehensive HTTP to HTTPS Redirection with new All HTTP Listeners Redirect to HTTPS option in Cloud Security (InsightCloudSec)
15. Cloud Security (InsightCloudSec) Release Notes (2026-06-30) Jun 30, 2026 · issue 001

    InsightCloudSec 26.6.30 adds AWS Lightsail support, new Insights, and CMMC compliance pack updates.

    • Adds AWS Lightsail resource coverage, enabling cloud security visibility and policy enforcement across Lightsail instances.
    • Introduces new Insights (detections/findings) to expand misconfiguration and risk coverage in cloud environments.
    • Updates the CMMC compliance pack with revised or additional compliance checks aligned to CMMC requirements.

    3 details in Everything

16. Cloud Security (InsightCloudSec) Release Notes (2026-06-23) Jun 23, 2026 · issue 001

    InsightCloudSec 26.6.23 adds new insights, query filters, Kubernetes Scanner v5.1.0, and permission remediation improvements.

    • New insights added for cloud security posture detection.
    • New query filters available for cloud resource searches.
    • Kubernetes Scanner updated to v5.1.0 with new capabilities.
    • Improved permission remediation workflows.

    4 details in Everything

17. Vulnerability Management Release Notes (2026-06-21) Jun 21, 2026 · issue 001

    Rapid7 InsightVM 8.49.0 adds ASP.NET Core 10 fingerprinting and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Microsoft Office Enterprise Benchmark v1.2.0 policy support.

    └──▷ HOW TO FIND IT
    Run a policy scan against the new CIS Microsoft Office Enterprise Benchmark to assess compliance across your environment.
    📍In the InsightVM console, go to Policies › Built-in Policies, search for CIS Microsoft Office Enterprise Benchmark v1.2.0, and add it to a scan template targeting your Windows assets.
    • Adds fingerprinting support for ASP.NET Core 10, enabling accurate asset identification and vulnerability assessment for apps running on the latest framework.
    • Adds built-in policy support for CIS Microsoft Office Enterprise Benchmark v1.2.0, enabling out-of-the-box compliance scanning against the updated CIS standard.

    2 details in Everything

18. Nexpose Release Notes (2026-06-21) Jun 21, 2026 · issue 001

    Nexpose 8.49.0 adds ASP.NET Core 10 fingerprinting and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Microsoft Office Enterprise Benchmark v1.2.0 policy support.

    • Adds fingerprinting support for ASP.NET Core 10, enabling accurate asset identification and vulnerability assessment for modern .NET workloads.
    • Adds built-in policy support for CIS Microsoft Office Enterprise Benchmark v1.2.0, enabling out-of-the-box compliance scanning against the latest CIS Office standard.

    2 details in Everything

19. Vulnerability Management Release Notes (2026-06-11) Jun 11, 2026 · issue 001

    Rapid7 VM 8.48.0 adds Nutanix AHVAHVAcropolis Hypervisor, Nutanix's built-in bare-metal hypervisor for running VMs on their hyper-converged infrastructure, giving cyber tools a tightly integrated compute and storage layer without a separate hypervisor license. fingerprinting, TLS 1.3 named-group reporting, and richer credential logging.

    • Adds asset fingerprinting support for Nutanix AHV hypervisor environments.
    • Improves reporting of TLS 1.3 named groups for deeper cryptographic visibility.
    • Enhances credential success logging for better scan auditability.

    3 details in Everything

20. Nexpose Release Notes (2026-06-11) Jun 11, 2026 · issue 001

    Nexpose 8.48.0 adds TLS 1.3 named-group reporting, Nutanix AHVAHVAcropolis Hypervisor, Nutanix's built-in bare-metal hypervisor for running VMs on their hyper-converged infrastructure, giving cyber tools a tightly integrated compute and storage layer without a separate hypervisor license. fingerprinting, and richer credential success logging.

    • Improves reporting of TLS 1.3 named groups for more precise cipher-suite visibility.
    • Adds asset fingerprinting support for Nutanix AHV hypervisor environments.
    • Enhances credential success logging to provide more detail on authenticated scan activity.

    3 details in Everything

21. Cloud Security (InsightCloudSec) Release Notes (2026-06-09) Jun 9, 2026 · issue 001

    InsightCloudSec 26.6.9 adds ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. insights, enhanced logging, and EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. filtering for cloud security.

    • New ECS insights extend cloud security coverage to Amazon Elastic Container Service workloads.
    • Enhanced logging capabilities provide richer audit and operational visibility within the platform.
    • New EventBridge filtering support enables more precise event-driven cloud security workflows.

    3 details in Everything

22. Cloud Security (InsightCloudSec) Release Notes (2026-06-02) Jun 2, 2026 · issue 001

    InsightCloudSec 26.6.2 adds new insights, query filters, bot action improvements, and enhanced compliance pack filtering.

    • Adds new Insights to expand cloud security detection coverage.
    • Adds new query filters for more precise resource querying within the platform.
    • Improves bot actions with new or expanded automation capabilities.
    • Enhances compliance pack filtering for more granular compliance posture management.

    4 details in Everything

23. June 2026 Release Notes Jun 2026 · release notes

    Rapid7 June 2026: New integrations, IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. insights, NGAV rollout controls, bot creation from JSON

    • Adds Exabeam New-Scale, SUSE Manager, Ubuntu Landscape, Zimperium MTDMTDMoving Target Defense: a strategy that continuously shifts a system's attack surface — rotating IPs, ports, or configurations — so attackers cannot rely on static reconnaissance data., SonicWall Capture Client, Nudge Security and Symmetry DataGuard DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. connectors to Attack Surface Management
    • Adds Create Bot From JSON dropdown option in Automation (InsightConnect) > Bot Factory to create bots directly from JSON configuration files
    • Adds Kubernetes runtime security monitoring capabilities to Cloud Security (InsightCloudSec), including sensor deployment, process termination actions, and least-privilege network policy enforcement
    • Includes Microsoft Defender vulnerabilities in the unified Remediation Hub view across Attack Surface Management, Exposure Command, and Incident Command
    • Updates Cloud Security (InsightCloudSec) with new AWS IaC Insights (e.g., Web App without Log Streaming Fully Configured, ECS Task Definition without Logging Configuration) and Query Filters (e.g., Cloud Region Disk Encryption)

    +1 more show less

    • Adds Gradual Prevention rollout capability for Next-Generation Antivirus and Ransomware Prevention, allowing protection to be enabled for specific endpoint groups while others remain in Detection Only mode

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Offline installation support has been removed for the following connectors in Attack Surface Management: AWS Core, AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware., AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege., AWS Route53, AWS S3, Amazon Inspector, Armis, Atlassian Bitbucket Cloud, Atlassian Jira Cloud, Azure Core, BigFix, Bitdefender, CrowdStrike Falcon, Cyberhaven, Device42, Devo SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents., Exabeam, ExtraHop, GCP Core, Google Workspace, Infoblox BloxOne Threat Defense, Jamf, Lansweeper, MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances., ManageEngine OpManager, Microsoft Active Directory, Microsoft Defender, Microsoft Entra ID (formerly Azure AD), Microsoft Graph Security, Microsoft Intune, Microsoft SCCM, Microsoft SQL, Mosyle MDM, Nexthink, Okta, Paessler PRTG Network Monitor, Palo Alto Cortex Cloud CSPM, Proofpoint TAP, SailPoint Security Cloud, ServiceNow, Slack, Snyk, Splunk, Tanium, Tenable Security Center, and Tenable Vulnerability Management. Offline installation workflows for these connectors will no longer function after upgrade.
24. May 2026 Release Notes May 2026 · release notes

    New Terraform detection management in SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents., native IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. sources, and unified user settings across Rapid7 Command Platform

    • Adds the ability to create, validate, and deploy detections as code in SIEM (InsightIDR) using Terraform.
    • Adds Native IOC Management for Threat Intelligence feeds within Command Platform > Data Connectors > Sources.
    • Adds a Resource Type filter to the Remediation Hub main table to filter by Instance, Container, or Host.
    • Adds AI-Enhanced Attack Modules with LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-based vulnerability pre-triage in Application Security > Settings > Scan Options.
    • Adds Unified User Resources and Settings via Command Platform > Profile > User Settings for centralized profile management.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Oracle Cloud Vault and Secret resource identification changes format to {vault_display_name}.{vault_id} and {secret_name}{vault_id}, causing existing resources to be re-identified as new.
25. April 2026 Release Notes Apr 2026 · release notes

    Rapid7 April 2026 adds dynamic seed queries, Bulk Export API scan policy data, persistent search tabs, multi-tenant API key, and more

    • Automate external attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. discovery with dynamic seed queries using supported connectors (e.g., Markmonitor, NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment.).
    • Export scan policy data alongside existing Rapid7 Agent policy data via the Bulk Export API.
    • Maintain investigation context with persistent search tabs in Log Search that preserve open tabs and queries across sessions.
    • Access all tenants programmatically using a single multi-tenant API key.
    • View group membership details for Okta and Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. users directly in the User Details page.

    +9 more show less

    • Map SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. (InsightIDR) users to ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. identity profiles in Incident Command for unified identity context.
    • Increase in custom detection rule limits for greater flexibility.
    • Include new optional field r7_hostid in the JSON payload for supported endpoint-related event sources.
    • Export user access data for audit and compliance in CSV format from Command Platform > Users > Export User List.
    • Gain more coverage with the Web & App Framework Vulnerability Detection Module for Drupal and WordPress Core in InsightAppSec.
    • Support for NetAppFilesAccount and ContainerAppJob resource types in Cloud Security (InsightCloudSec).
    • Add support for filtering out devices by last sync date in Microsoft Intune connector.
    • New connector support for Check Point Harmony Endpoint, Cisco Catalyst Center, Datadog, Iru, PingOne Advanced Identity Cloud, privacyIDEA MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., and PDQ Deploy and Inventory.
    • Endpoint Security Notifications provide real-time on-device alerts for blocked malicious activity on Windows assets.

    14 details in Everything

26. March 2026 Release Notes Mar 2026 · release notes

    Cloud Security adds bot threshold controls, r7_hostid correlation in Log Search, and InsightsVM bulk remediation export API; IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. Scanner breaks with new flag names.

    • LogSearch now correlates endpoint authentication events with other logs using the r7_hostid key for faster investigation context.
    • Cloud Security > Bot Factory introduces threshold controls to automatically stop Bot runs when configured limits are exceeded.
    • InsightVM adds a Bulk Export API endpoint to export up to 3 months of remediation metadata for external BI reporting.
    • Mimics Infrastructure as Code (IaC) Scanning Tool v2.0.0 requires the files_to_scan positional argument in GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure., replacing the deprecated target flag.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Mimics IaC Scanner GitHub Action positional argument target is removed; workflows must update to use files_to_scan.
    • !The Mimics IaC Scanner OPAOPAOpen Policy Agent, a CNCF-graduated policy engine that evaluates rules written in the Rego language against JSON-structured data, letting tools enforce authorization and compliance decisions without hardcoding logic. dependency is upgraded to v1.0, breaking custom Rego policies that rely on 0.x syntax.
27. February 2026 Release Notes Feb 2026 · release notes

    Rapid7 Feb 2026: Active Risk prioritization, MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. for Microsoft, ServiceNow Zurich support, Bot thresholds, and macOS scanning.

    • Adds Active Risk as the single standardized risk strategy across Vulnerability Management (InsightVM), Cloud Security (InsightCloudSec), and Exposure Command for consistent vulnerability prioritization.
    • Integrates contextual vulnerability intelligence into Threat Intelligence (Intelligence Hub) via the Response & Remediation > Remediation Hub view to link active exploitation data directly to impacted assets.
    • Deploys AI-generated risk insights in Remediation Hub that provide concise, single-sentence summaries of affected assets and ownership to accelerate remediation triage.
    • Extends Managed Detection and Response (MDR) protection across Microsoft environments with purpose-built detection and response capabilities available in the Alerts view.
    • Upgrades ServiceNow integration to support Zurich (AI) release for both Application Vulnerability Response (AVR) and IT Service Management (ITSMITSMIT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows.), enabling bidirectional vulnerability data updates from the ServiceNow App Store.

    +7 more show less

    • Adds action_threshold_count and threshold_mail_recipients optional fields to the Bot Factory instructions JSON object, allowing Bots to suppress actions when resource counts exceed configured limits and notify specified recipients.
    • Enables review of historical Bot activity in the new Bot Runs tab within the Bot Factory UI.
    • Adds support for scanning macOS Sonoma, Sequoia, and Tahoe assets via the Nexpose Scan Assistant with installers for Intel-based and Apple Silicon architectures.
    • Adds harvesting support for Azure Backup Vault resources (Microsoft.DataProtection/backupVaults) and Azure Recovery Services Vault resources (Microsoft.RecoveryServices/vaults), requiring respective read permissions.
    • Adds new query filters for App Service Environments allowing TLS 1.0/1.1, VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. integration routing for Function Apps/Slots, and Azure Batch private endpoint connection states.
    • Updates the Cloud Listing table in Cloud Security to display Oracle and Alibaba Cloud account IDs and role ARNs.
    • Adds feature to download Software Bill of MaterialsSoftware Bill of MaterialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. (SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.) for container images scanned for vulnerabilities in Cloud Security.

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Plugins tab is deprecated in Cloud Security (InsightCloudSec).
    • !Database Cluster Without Audit Logging (ID 595) and Database Instance Without Audit Logging (ID 350) insights are removed; customers must use ID 2471 and ID 2472 respectively.
    • !The Rapid7 Agent (Insight Agent) no longer supports openSUSE LEAP 15.5, Fedora 41, Windows 10 v1507, or Windows 10 v1511.
28. January 2026 Release Notes Jan 2026 · release notes

    Rapid7 adds new Cloud security insights/compliance packs, Velociraptor polling interval reduction, and API role-aware filtering.

    • Adds ap-southeast-6 to AWS region support for harvesting strategy dropdown
    • Adds Advanced Filter on Vulnerability Proof in the visual interface
    • Adds new Query Filters including Resource Does Not Support TLS 1.3 Minimum and Secret is Expired for cloud resource identification
    • Adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. AWS End User Compute Services Benchmark v1.2.0 as a new Compliance Pack
    • Adds support for AWS ElastiCache has_pending_update column and requires elasticache:DescribeServiceUpdates/elasticache:DescribeUpdateActions permissions

    +8 more show less

    • Adds TLS encryption detection and minimal TLS version support for AWS Database Clusters (Neptune, DocumentDB, Aurora MySQL/PostgreSQL)
    • Adds new Query Filter Database Cluster Encryption In Transit Disabled for CIS AWS Database Services Benchmark 1.0.0 Recommendation 7.4
    • Adds storage account VHD encryption type and volume network access checks via new insights and Query Filters
    • Adds filter_id parameter support to the paginated insights endpoint /v4/iac/insights
    • Enhanced fingerprinting for Citrix Virtual Apps and Desktops using additional system components
    • Allows custom properties to be managed directly from the Console host's text-based command console
    • Enables asset group exclusion directly within scan schedules regardless of creation time
    • Reduces Velociraptor client polling interval from ten minutes to three minutes for faster job initiation

    13 details in Everything

29. December 2025 Release Notes Dec 2025 · release notes

    Rapid7 Dec 2025: EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. in bulk export APIs, Oracle SID failure threshold config, and new InsightCloudSec integrations

    └──▷ TRY IT
    Harvest AWS Lake Formation resources to monitor configuration and access controls across your organization.
    copy

    $ terraform get -update

    • Adds epss_score and epss_percentile fields to Vulnerability Management (InsightVM) asset and vulnerability bulk export APIs, enabling prioritization by real-world exploit probability.
    • Adds new Oracle SID enumeration failure threshold mechanism with configurable custom properties com.rapid7.oracle.bootstrap.failure.limit and com.rapid7.oracle.bootstrap.failure.codes in the Scan Engine.
    • Adds LakeFormationHarvester for harvesting AWS Lake Formation resources and requires the lakeformation:GetDataLakeSettings permission in Cloud Security (InsightCloudSec).
    • Adds new AliCloud Python onboarding script exposed via API endpoints in Cloud Security (InsightCloudSec) for streamlined cloud account onboarding.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The query filter field names full_tls_10, full_tls_11, full_ssl_30, and full_tls_12 have been removed from the RestAPI resource in InsightCloudSec, replaced by client_tls_*, backend_tls_*, and client_ssl_* fields.
    • !The query filter named App Stream Fleet Not Using VPC (AWS) has been renamed to App Stream Fleet Not Using Securely Configured VPC, affecting any automation referencing the old name.
    • !The query filter Database Instance Vulnerability Assessment Not Associated with Storage Account and its associated insight have been deprecated and removed from all compliance packs in InsightCloudSec.
30. November 2025 Release Notes Nov 2025 · release notes

    New on-demand NGAV scanning, Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. event source in SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents., and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. exceptions management in Cloud Security

    • Adds On-Demand Scanning capability to Next-Generation Antivirus for proactive malware detection across Windows, Linux, and macOS assets
    • Adds Microsoft Entra ID as a configurable event source in Data Connectors for SIEM (InsightIDR) to enrich alerts with identity context
    • Adds ability to manage exceptions for Infrastructure as Code (IaC) findings via the Controls & Compliance > Infrastructure as Code console view in Cloud Security (InsightCloudSec)
    • Adds PA_DBINSTANCE_EXTERNAL_SCANNER feature flag to enable External Scanning support for Database Instances in Cloud Security (InsightCloudSec)
    • Adds source document storage integration for Tenable, Qualys, CrowdStrike, and SentinelOne agents via feature flags in Cloud Security (InsightCloudSec)

    +1 more show less

    • Adds AWS DevOps Guru Integration with DevOpsGuruInsightHarvester support in Cloud Security (InsightCloudSec)

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Rapid7 Agent (Insight Agent) v4.0.20.15 no longer supports Ubuntu 24.10, Open Suse LEAP 15.4, or Fedora 40
31. October 2025 Release Notes Oct 2025 · release notes

    New AWS/Azure harvesters, Remediation Hub filtering by CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it./Risk, Certificate SSH creds, and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Win11 support in InsightVM

    • Adds AmplifyAppHarvester, CodePipelineHarvester, MediaAnalysisJobHarvester, AppflowHarvester, and MapHarvester to Cloud Security for new AWS/Azure resource discovery.
    • Adds filter by CVSS score and filter by Active Risk score in Response & Remediation > Remediation Hub to prioritize vulnerabilities.
    • Adds Certificate-Based SSH Authentication as a credential option for authenticated scans of Linux/Unix systems in InsightVM.
    • Adds built-in policy support for CIS Microsoft Windows 11 Benchmark v4.0.0 in InsightVM.
    • Adds environment_variables_configured field source of truth for AWS/GCP Serverless Functions in Cloud Security.

    +1 more show less

    • Adds new Query Filters: Amplify App Without Web Application Firewall, Amplify App Using Basic Auth, Local Authentication Turned Off On Map Account, and Rekognition status filters.

    6 details in Everything

32. September 2025 Release Notes Sep 2025 · release notes

    Rapid7 Command Platform Sept 2025: Remediation Hub, Vector Command Advanced, AI Log Search, GCP SCC Triage-as-Code, CVA env vars, NGAV registry field

    • Adds Remediation Hub in Response & Remediation to prioritize high-impact fixes using Active Risk Score
    • Introduces Vector Command Advanced managed service for validating internal segmentation controls and compliance evidence
    • Simplifies GCP SCC Alert triage with Triage-as-Code (TRaC) translation to plain language
    • Enriches GCP SCC alerts with asset context from Cloud Security (InsightCloudSec)
    • Adds SSL_NO_VERIFY environment variable to CVA Local Scanner to skip TLS verification

    +9 more show less

    • Adds SCAN_SCHEDULE environment variable to CVA Local Scanner to customize scan interval in seconds
    • Deprecates CRON_SCHEDULE environment variable for CVA Local Scanner scan frequency configuration
    • Renames DIVVY_SOURCE_DOCUMENT_FORCE_WRITE to DIVVY_SOURCE_DOCUMENT_FORCE_WRITE_ENABLED environment variable in Cloud Security
    • Adds SOURCE_DOCUMENT_BLOCKED_JOBS environment variable to Cloud Security to block source document storage for specific harvesters
    • Adds new Query Filters for Azure Service Bus Namespace Topics including Message Topic Minimum TLS Version, Message Topic Type, and others
    • Adds Workspace Directory With Enabled Web Access Insight and Query Filter in Cloud Security
    • Adds AppStream Private Image resource support with AppStreamImageHarvester in Cloud Security AWS
    • Adds protected registry path visibility to NGAV/Ransomware Prevention alert payloads via the protectedRegistry field
    • Updates SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. API documentation paths to include /api/3/yaml format in Console v3

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !CRON_SCHEDULE environment variable is deprecated and no longer used for CVA Local Scanner scan schedule intervals; use SCAN_SCHEDULE instead.
    • !Environment variable DIVVY_SOURCE_DOCUMENT_FORCE_WRITE must be renamed to DIVVY_SOURCE_DOCUMENT_FORCE_WRITE_ENABLED in Cloud Security configurations.
33. August 2025 Release Notes Aug 2025 · release notes

    New Attack Surface API, External Scanner Integration, In-Product Remediation Steps, and Unified Navigation preview for Rapid7 Insight Platform August 2025

    • Adds Attack Surface Management (ASM) API for Cypher-based queries across assets, identities, and related ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. data types in Surface Command and Exposure Command
    • Enables Asset and Identity filters using source-specific properties (e.g., Microsoft Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments., Crowdstrike) in Surface Command without custom Cypher queries
    • Adds detection of container public exposure with full orchestration context (service meshes, ingress controllers, node roles) in Cloud Security (InsightCloudSec) and Exposure Command
    • Enables real-time exposure validation via external scanner integration that assesses business impact and maps attack vectors for open database ports and misconfigured services
    • Adds enhanced Bulk Export API using GraphQL to retrieve asset/vulnerability data in Parquet format for Vulnerability Management (InsightVM)

    +7 more show less

    • Embeds step-by-step remediation guidance directly within vulnerability findings in Cloud Security (InsightCloudSec) and Exposure Command
    • Enables dynamic third-party alert prioritization reflecting current severity levels for third-party alerts in Managed Detection and Response (MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools.) and Managed Threat Complete
    • Adds SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared.-monitored coverage for Okta Identity and Palo Alto Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. telemetry via Data Connectors > Data Collectors
    • Migrates 8 legacy and 5 third-party detection rules into the SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. (InsightIDR) Detection Rule Library
    • Enables Unified Navigation feature preview with streamlined cross-solution access in Administration
    • Adds automatic allowlisting settings to disable IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. auto-allowlisting in Threat Intelligence (Intelligence Hub)
    • Supports Azure Event Driven Harvesting and Least-Privileged Access via automatic deployment in Azure China and Azure Government clouds

    12 details in Everything

34. July 2025 Release Notes Jul 2025 · release notes

    Rapid7 adds Local CVA for private registries, new Surface Command connectors, and AI MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. workflows in July 2025

    • Adds HTTPS_PROXY, SSL_CERT_FILE, and SSL_CERT_DIR environment variables to Cloud Security (InsightCloudSec) bot configurations for custom network and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. settings
    • Integrates Attack Surface Management (Surface Command) with Cisco ISE, CyberArk PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded., Nucleus Security, PingOne, and Deep Instinct connectors
    • Adds dynamic third-party alert prioritization mapping in SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. (InsightIDR) to clarify triage ownership between customer teams and the Rapid7 SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared.
    • Introduces AI-assisted agentic workflows in MDR service for automated alert triage and enrichment
    • Adds new Insights, Query Filters, and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Azure 3.0/4.0 compliance packs to Cloud Security (InsightCloudSec)

    +3 more show less

    • Expands InsightVM/Nexpose tag management permissions with Manage Site Tags, Manage Asset Tags, and Manage Group Tags
    • Adds Network Sensor native detection for DNP3DNP3A serial and TCP/IP communication protocol used in industrial control systems, especially power grids and water utilities, to let control software poll and command field devices like sensors and switches. protocol and enhanced VLAN/VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments. inspection
    • Migrates legacy UBA detection rules (e.g., HONEY USER AUTHENTICATION) to the SIEM Detection Library

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Bots interacting with OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Compartment resources must update their configuration to reference the new Organization Services level organization service ID, as older service IDs will trigger alerts.
    • !The option to Switch to Legacy UI has been removed in Cloud Security (InsightCloudSec).
35. June 2025 Release Notes Jun 2025 · release notes

    New connectors for Surface Command, AI disposition in InsightIDR, new Insights/harvesters in Cloud Security, and manual update uploads.

    • Adds Baramundi, Cybereason, Dragos, Markmonitor, Microsoft Defender for IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure., and Zabbix Cloud as Attack Surface Management (Surface Command) integrations
    • Unifies external and internal attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. discovery in a single interface with seed management and insight dashboards for Discovery Seeds under External Attack Surface in Attack Surface Management (Surface Command)
    • Allows marking subdomains, IP addresses, or network services as out-of-scope for Continuous Red Teaming (Vector Command) within the External Attack Surface view of Attack Surface Management (Surface Command)
    • Adds dark mode toggle to Attack Surface Management (Surface Command) workspace
    • Introduces mitigating controls prioritization in Remediation Hub across Command Platform, Exposure Command, Cloud Security (InsightCloudSec), InsightVM, and Automation (InsightConnect)

    +48 more show less

    • Adds Claroty xDome and Imperva WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. as direct cloud log event sources for detection products without additional software
    • Provides expert-driven remediation guidance for AWS GuardDuty and Azure Defender for Cloud alerts in SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. (InsightIDR) Alerts > Alert Details
    • Adds dozens of new Suricata rules under ET EXPLOIT, ET EXPLOIT_KIT, and ET SCAN to Network Sensor in SIEM (InsightIDR)
    • Adds Account Password Reset – Is Watched and Account Password Reset – Is Admin detection rules to the Detection Library in SIEM (InsightIDR)
    • Migrates legacy UBA rules (Third Party Alert – Cyberark Vault, Third Party Alert – Cybereason, Third Party Alert – Netskope, Zone Policy Violation, Flagged Hash On Asset, Flagged Process On Asset) into the Detection Library in SIEM (InsightIDR)
    • Introduces a graph-based Principal API Activity Timeline for Azure audit logs in SIEM (InsightIDR) Alerts > Alert Details
    • Publishes Cloud Security (InsightCloudSec) API documentation accessible via Profile and Help menu for programmatic access
    • Adds AI Dispositioning to automatically classify alerts as likely benign or malicious with the AI Suggested Disposition field in SIEM (InsightIDR) Alerts > Alert Details
    • Excludes Enhanced Endpoint Telemetry (EET) data from monthly Fair Use allowance calculations in SIEM (InsightIDR)
    • Adds False Positive and Security Test as selectable disposition options for alerts and investigations in SIEM (InsightIDR), Managed Threat Complete, and MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools.
    • Centralizes endpoint exclusion management under Command Platform > Administration > Data Collection > Agents > Endpoint Prevention > Exclusions for Managed Threat Complete and MDR
    • Adds Insights: Encryption Key Vault With Public Network Access Enabled When Using Private Endpoint and Databricks Workspace Enable Customer Managed Keys (CMK) in Cloud Security (InsightCloudSec)
    • Removes the Switch to Legacy UI option in Cloud Security (InsightCloudSec) System Settings
    • Expands Azure Container Registry fields to include local admin and managed identity information in Cloud Security (InsightCloudSec)
    • Adds Insights: Secrets stored in ConfigMaps and Web App with Remote Debugging Enabled in Cloud Security (InsightCloudSec)
    • Enables namespace-level fallback for the Guardrails inventory scanner when cluster-wide permissions fail in Cloud Security (InsightCloudSec) Kubernetes Scanner version 4.1.5
    • Adds Add Organization button to Cloud Accounts > Organizations page in Cloud Security (InsightCloudSec) Modern UI
    • Adds support for optional custom tags in Automatic LPA Deployment modal and Azure Container Registry tagging in Cloud Security (InsightCloudSec)
    • Enables local assessments of private OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. registries in Cloud Security (InsightCloudSec)
    • Deprecates Web App with Remote Debugging Turned On Insight in favor of Web App with Remote Debugging Enabled in Cloud Security (InsightCloudSec)
    • Adds insights for Azure Storage Account lifecycle policies and query filters: Storage Account Without Lifecycle Policy, Storage Account With Disabled Lifecycle Policy Rules, etc. in Cloud Security (InsightCloudSec)
    • Supports tagging for deployed resources during Azure LPA and EDH auto-deployment endpoints in Cloud Security (InsightCloudSec)
    • Adds StartInstances event harvesting with the StartInstancesEventHarvest feature flag to populate launch_time in Cloud Security (InsightCloudSec)
    • Expands OS package detection for higher-fidelity proof in host and container assessments in Cloud Security (InsightCloudSec)
    • Adds Storage Account with Default to OAuth Authentication Disabled insight, Azure Stream Analytics Clusters/Jobs harvesting, and associated query filters in Cloud Security (InsightCloudSec)
    • Adds new Insights: Serverless Function With Enabled Cloud Secret Manager API, Subnet Without VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Flow Logs Enabled, Cloud Accounts Without Sinks Configured for All Log Entries, and Cloud Account Linked to Cloud Credential Without App Restrictions in Cloud Security (InsightCloudSec)
    • Adds Query Filters: Resource Encrypted With Cloud Managed Key, Database Migration Endpoint Is/Is Not Encrypted, Cloud Accounts Without Sinks Configured For All Log Entries, and Cloud Credential Without App Restrictions in Cloud Security (InsightCloudSec)
    • Adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. GCP 3.0 Compliance Pack and updates Insights for CIS GCP 3.0 Recommendations 2.4–2.11 in Cloud Security (InsightCloudSec)
    • Introduces Azure App Service Environments support with new harvester, resource, and query filter in Cloud Security (InsightCloudSec)
    • Adds BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. Dataset Tables harvesting support in Cloud Security (InsightCloudSec)
    • Enables EDH actions TagResource and UntagResource for EFS in Cloud Security (InsightCloudSec)
    • Adds in-transit encryption support for auto-provisioned EDH queues in Cloud Security (InsightCloudSec)
    • Updates Databricks Workspace resource expansion with configuration fields and Private Network linkage in Cloud Security (InsightCloudSec)
    • Allows manual upload of product and content updates for offline environments in InsightVM/Nexpose version 8.13.0
    • Adds confirmation step requiring CONFIRM to be typed before deactivating console in InsightVM/Nexpose versions 8.11.0+ and InsightIDR Settings
    • Updates JunosOSVersionComparator logic and canCompare method for better version handling in InsightVM/Nexpose versions 8.11.0+
    • Adds support for CIS Google Chrome Benchmark 3.0.0 and CIS Microsoft Windows 11 Enterprise Benchmark 4.0.0 content in InsightVM/Nexpose
    • Adds User Attribution settings page in SIEM (InsightIDR) Settings for customizing account/user involvement in collected log activity
    • Adds optional fields to AWS GuardDuty event source form for SQS Messages and EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Instance Authentication methods in SIEM (InsightIDR)
    • Updates default date range for Investigation Details > Inspect Actor Activity to last 24 hours in SIEM (InsightIDR)
    • Consolidates InsightVM and Agent settings into a Command Platform Features tab in Settings for SIEM (InsightIDR)
    • Groups related fields with collapsible sections in the event source creation form in SIEM (InsightIDR)
    • Updates Threat Actor Activity Tracking prioritization by most recent activity in Intelligence Hub version 1.4.2
    • Adds stream line table search for campaigns and actor profiles by name and description in Intelligence Hub version 1.4.2
    • Adds domain-type IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. decay score in Intelligence Hub version 1.4.3
    • Enables partial prefix searches for threat actors/campaigns in Intelligence Hub version 1.4.3
    • Upgrades Java Runtime to version 17.0.15 and adds CIS Ubuntu 24.04 Benchmark v1.0.0 support in InsightVM/Nexpose version 8.9.1
    • Adds AI attack coverage configuration details for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Vulnerability Scanning in Application Security (InsightAppSec) AppSpider 7.5.019

    53 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deprecated Insights and Compliance Packs will remain visible until their specified removal version, but the Switch to Legacy UI option is removed in Cloud Security (InsightCloudSec) System Settings.
    • !Legacy risk strategies—Temporal, TemporalPlus, Weighted, and PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. ASV 2.0—are deprecated in InsightVM/Nexpose and will cease support on January 21, 2026; users must switch to the Active Risk strategy.
36. May 2025 Release Notes May 2025 · release notes

    Rapid7 May 2025 adds attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. connectors, AI dispositioning, ET rules, and bulk exclusion workflows

    • Attack Surface Management (Surface Command) integrates with Baramundi, Cybereason, Dragos, Markmonitor, Microsoft Defender for IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure., and Zabbix Cloud as new third-party connectors.
    • Cloud Security (InsightCloudSec) expands the /v2/prototype/apa/path-mapping API endpoint to map old Attack Path IDs to new ones.
    • SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. (InsightIDR) adds False Positive and Security Test as selectable disposition options for alerts and investigations.
    • Network Sensor activates Enhanced Emerging Threats (ET) rulesets including ET EXPLOIT, ET EXPLOIT_KIT, and ET SCAN for network traffic detection.
    • Cloud Security (InsightCloudSec) adds the CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. GCP 3.0 Compliance Pack for cloud account auditing.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The ContainerRegistryHarvester harvester is deregistered and replaced by ArtifactRegistryHarvester in Cloud Security (InsightCloudSec).
    • !The query filter Dataset Tables Not Leveraging Customer-Managed Encryption Key (CMEK) is removed in Cloud Security (InsightCloudSec).
37. What’s New in April 2025 Apr 2025 · release notes

    April 2025 adds Surface Command connectors for Cyberhaven and KACE, MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. customization, Azure API timeline, and more.

    • Adds Cyberhaven and KACE Asset Management Appliance as new connector profiles in Attack Surface Management
    • Enables creation of Connector Profiles to deploy multiple instances of the same connector across distributed environments
    • Introduces Breach Protection Warranty offering built-in financial protection for Managed Threat Complete Ultimate customers
    • Adds Unified Executive Risk View for consolidated reporting across InsightVM, Exposure Command, and Cloud Security
    • Integrates Rapid7 Labs to power the Threat Library in Intelligence Hub for faster threat intelligence delivery

    +4 more show less

    • Enables customization of detection rules, dashboards, and data source ingestion within MDR services
    • Adds new interactive visualizations to the Detection and Response Dashboard with MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. mapping
    • Adds automated removal of historical asset records via Maintenance Schedule in Administration
    • Visualizes user and service activity across Azure environments using the Principal API Activity Timeline in SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents.

    9 details in Everything

38. What’s new in March 2025 Mar 2025 · release notes

    March 2025 adds Alert Triage workflows, AWS principal API timeline, Executive Risk View reports, and new Surface Command connectors.

    • Adds support for deploying multiple instances of the same connector in Attack Surface Management (Surface Command).
    • Introduces unified Executive Risk View reports on the Command Platform to consolidate cross-product risk reporting.
    • Adds a graph-based principal API activity timeline for AWS in Cloud Detection & Response.
    • Enables direct ingestion of cloud log data via webhooks and S3 into SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. (InsightIDR), Managed Threat Complete, and MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools..
    • Expands Digital Risk Protection (Threat Command) monitoring to LinkedIn, Roblox, and Facebook Ads for brand impersonation detection.

    5 details in Everything

39. What’s New in February 2025 Feb 2025 · release notes

    Rapid7 February 2025 adds On-Prem API integrations for Surface Command, custom IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. query filters, Chronological Search in InsightIDR, and new UI for Credits Management.

    • Adds on-premise API Integrations to Attack Surface Management (Surface Command) to ingest asset, identity, vulnerability, and exposure data from private IT systems like Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments.
    • Introduces ~250 custom query filters for Cloud Formation in Cloud Security (InsightCloudSec) via the Security > Query Filters UI path
    • New connectors added to Attack Surface Management: Action1 Vulnerability Management, ESET PROTECT Platform, Cloudflare, JumpCloud, Red Hat Insights, and SOTI MobiControl
    • Adds Chronological Search in SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. (InsightIDR) > Log Search to view event logs in time order for investigation
    • Adds alert triage capabilities in SIEM (InsightIDR) > Alerts including filtering, bulk actions, and contextual grouping

    +6 more show less

    • New Credits Management UI in Digital Risk Protection (Threat Command) at Settings > Subscription for tracking service credits
    • Configurable Credential Alert Timeframe in Digital Risk Protection (Threat Command) at Configurations > Customization > Company Credentials Policies
    • Adds automated MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. for Macro workflow in Application Security (InsightAppSec) and Exposure Command
    • Adds Vulnerability Proof view in Remediation Hub to see concrete vulnerability evidence before assigning fixes
    • Adds exportable solution reports feature in Remediation Hub at Command Platform > Response & Remediation > Remediation Hub
    • Adds Security Context from Attack Surface Management to Remediation Hub for holistic asset risk view

    11 details in Everything

40. What’s New in January 2025 Jan 2025 · release notes

    New Surface Command connectors, NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 2.0 pack, GuardDuty attack sequence detection, InsightVM alert enrichment, Microsoft Defender auto-triage, and User Management redesi

    • Integrates Cisco Umbrella DNS, Claroty xDome, ManageEngine ServiceDesk Plus Asset Catalog, Honeywell SCADAfence, Nozomi Vantage, and SpecterOps BloodHound Enterprise into Attack Surface Management (Surface Command)
    • Adds NIST Cybersecurity FrameworkNIST Cybersecurity FrameworkThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. (CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals.) 2.0 compliance pack for AWS and Azure
    • Leverages Amazon GuardDuty's new attack sequence findings in Cloud Detection and Response
    • Enriches SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. (InsightIDR) alerts with InsightVM risk context to view exploitable vulnerabilities within alerts
    • Automatically identifies benign activity and real threats for Microsoft Defender alerts using advanced AI models

    +1 more show less

    • Redesigns User Management interface to support tailored access per organization, conflict prevention logic, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. integration via User Group and Group Sync

    6 details in Everything

41. What’s New in December 2024 Dec 2024 · release notes

    December 2024 release adds Attack Surface Management connectors, Remediation Hub, AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. vulnerability groupings, ServiceNow and GitLab CI/CD integrations, expanded custom co

    • Adds new Attack Surface Management (Surface Command) connectors for Cisco Umbrella DNS, Claroty xDome, Honeywell SCADAfence, SpecterOps BloodHound Enterprise, and Devo to the Rapid7 Extension Library
    • Introduces Remediation Hub in Response & Remediation to visualize top 25 remediation solutions and track risk reduction metrics
    • Adds vulnerability groupings in Application Security (InsightAppSec) to group findings by application and attack type for efficient triage
    • Integrates Application Security (InsightAppSec) with ServiceNow Xanadu for bidirectional data synchronization
    • Integrates Cloud Security (InsightCloudSec) with GitLab CI/CD pipelines to automate repository scans

    +5 more show less

    • Enables combining multiple compliance packs into a single custom compliance pack in Cloud Security (InsightCloudSec)
    • Adds automatic triage for Rapid7 alerts using AI models in SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. (InsightIDR)
    • Adds automatic triage for CrowdStrike alerts using AI models in SIEM (InsightIDR)
    • Makes log lines clickable in SIEM (InsightIDR) Log Search to open a structured JSON panel view
    • Refreshes the Digital Risk Protection (Threat Command) home page visual design and navigation

    10 details in Everything