https://cybertoolchain.io/tools/rapid7-insight-platform New releases and features in Rapid7 Insight Platform, tracked by The Cyber Toolchain. en Tue, 07 Jul 2026 00:00:00 GMT https://docs.rapid7.com/insight/release-notes-2026-july/ https://docs.rapid7.com/insight/release-notes-2026-july/ Tue, 07 Jul 2026 00:00:00 GMT InsightCloudSec 26.7.7 adds ASG/EBS/Security Group insights, enhanced credential cleanup, and CIS RHOCP v1.9.0 benchmark support. • New Insights added for Auto Scaling Groups, EBS Volumes, and Security Groups. • Enhanced credential cleanup capabilities. • Adds support for CIS Red Hat OpenShift Container Platform Benchmark v1.9.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/release-notes-2026-june/ https://docs.rapid7.com/insight/release-notes-2026-june/ Tue, 30 Jun 2026 00:00:00 GMT InsightCloudSec 26.6.30 adds AWS Lightsail support, new Insights, and CMMC compliance pack updates. • Adds AWS Lightsail resource coverage, enabling cloud security visibility and policy enforcement across Lightsail instances. • Introduces new Insights (detections/findings) to expand misconfiguration and risk coverage in cloud environments. • Updates the CMMC compliance pack with revised or additional compliance checks aligned to CMMC requirements. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/release-notes-2026-june/ https://docs.rapid7.com/insight/release-notes-2026-june/ Tue, 23 Jun 2026 00:00:00 GMT InsightCloudSec 26.6.23 adds new insights, query filters, Kubernetes Scanner v5.1.0, and permission remediation improvements. • New insights added for cloud security posture detection. • New query filters available for cloud resource searches. • Kubernetes Scanner updated to v5.1.0 with new capabilities. • Improved permission remediation workflows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/release-notes-2026-june/ https://docs.rapid7.com/insight/release-notes-2026-june/ Sun, 21 Jun 2026 00:00:00 GMT Rapid7 InsightVM 8.49.0 adds ASP.NET Core 10 fingerprinting and CIS Microsoft Office Enterprise Benchmark v1.2.0 policy support. • Adds fingerprinting support for ASP.NET Core 10, enabling accurate asset identification and vulnerability assessment for apps running on the latest framework. • Adds built-in policy support for CIS Microsoft Office Enterprise Benchmark v1.2.0, enabling out-of-the-box compliance scanning against the updated CIS standard. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/release-notes-2026-june/ https://docs.rapid7.com/insight/release-notes-2026-june/ Sun, 21 Jun 2026 00:00:00 GMT Nexpose 8.49.0 adds ASP.NET Core 10 fingerprinting and CIS Microsoft Office Enterprise Benchmark v1.2.0 policy support. • Adds fingerprinting support for ASP.NET Core 10, enabling accurate asset identification and vulnerability assessment for modern .NET workloads. • Adds built-in policy support for CIS Microsoft Office Enterprise Benchmark v1.2.0, enabling out-of-the-box compliance scanning against the latest CIS Office standard. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/release-notes-2026-june/ https://docs.rapid7.com/insight/release-notes-2026-june/ Thu, 11 Jun 2026 00:00:00 GMT Rapid7 VM 8.48.0 adds Nutanix AHV fingerprinting, TLS 1.3 named-group reporting, and richer credential logging. • Adds asset fingerprinting support for Nutanix AHV hypervisor environments. • Improves reporting of TLS 1.3 named groups for deeper cryptographic visibility. • Enhances credential success logging for better scan auditability. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/release-notes-2026-june/ https://docs.rapid7.com/insight/release-notes-2026-june/ Thu, 11 Jun 2026 00:00:00 GMT Nexpose 8.48.0 adds TLS 1.3 named-group reporting, Nutanix AHV fingerprinting, and richer credential success logging. • Improves reporting of TLS 1.3 named groups for more precise cipher-suite visibility. • Adds asset fingerprinting support for Nutanix AHV hypervisor environments. • Enhances credential success logging to provide more detail on authenticated scan activity. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/release-notes-2026-june/ https://docs.rapid7.com/insight/release-notes-2026-june/ Tue, 09 Jun 2026 00:00:00 GMT InsightCloudSec 26.6.9 adds ECS insights, enhanced logging, and EventBridge filtering for cloud security. • New ECS insights extend cloud security coverage to Amazon Elastic Container Service workloads. • Enhanced logging capabilities provide richer audit and operational visibility within the platform. • New EventBridge filtering support enables more precise event-driven cloud security workflows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/release-notes-2026-june/ https://docs.rapid7.com/insight/release-notes-2026-june/ Tue, 02 Jun 2026 00:00:00 GMT InsightCloudSec 26.6.2 adds new insights, query filters, bot action improvements, and enhanced compliance pack filtering. • Adds new Insights to expand cloud security detection coverage. • Adds new query filters for more precise resource querying within the platform. • Improves bot actions with new or expanded automation capabilities. • Enhances compliance pack filtering for more granular compliance posture management. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/release-notes-2026-june/ https://docs.rapid7.com/insight/release-notes-2026-june/ Mon, 01 Jun 2026 00:00:00 GMT Rapid7 June 2026: New integrations, IaC insights, NGAV rollout controls, bot creation from JSON • Adds Exabeam New-Scale, SUSE Manager, Ubuntu Landscape, Zimperium MTD, SonicWall Capture Client, Nudge Security and Symmetry DataGuard DSPM connectors to Attack Surface Management • Adds `Create Bot From JSON` dropdown option in Automation (InsightConnect) > Bot Factory to create bots directly from JSON configuration files • Adds Kubernetes runtime security monitoring capabilities to Cloud Security (InsightCloudSec), including sensor deployment, process termination actions, and least-privilege network policy enforcement • Includes Microsoft Defender vulnerabilities in the unified Remediation Hub view across Attack Surface Management, Exposure Command, and Incident Command • Updates Cloud Security (InsightCloudSec) with new AWS IaC Insights (e.g., `Web App without Log Streaming Fully Configured`, `ECS Task Definition without Logging Configuration`) and Query Filters (e.g., `Cloud Region Disk Encryption`) • Adds Gradual Prevention rollout capability for Next-Generation Antivirus and Ransomware Prevention, allowing protection to be enabled for specific endpoint groups while others remain in Detection Only mode Breaking changes: • Offline installation support has been removed for the following connectors in Attack Surface Management: AWS Core, AWS EC2, AWS IAM, AWS Route53, AWS S3, Amazon Inspector, Armis, Atlassian Bitbucket Cloud, Atlassian Jira Cloud, Azure Core, BigFix, Bitdefender, CrowdStrike Falcon, Cyberhaven, Device42, Devo SIEM, Exabeam, ExtraHop, GCP Core, Google Workspace, Infoblox BloxOne Threat Defense, Jamf, Lansweeper, MITRE CWE, ManageEngine OpManager, Microsoft Active Directory, Microsoft Defender, Microsoft Entra ID (formerly Azure AD), Microsoft Graph Security, Microsoft Intune, Microsoft SCCM, Microsoft SQL, Mosyle MDM, Nexthink, Okta, Paessler PRTG Network Monitor, Palo Alto Cortex Cloud CSPM, Proofpoint TAP, SailPoint Security Cloud, ServiceNow, Slack, Snyk, Splunk, Tanium, Tenable Security Center, and Tenable Vulnerability Management. Offline installation workflows for these connectors will no longer function after upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/release-notes-2026-may/ https://docs.rapid7.com/insight/release-notes-2026-may/ Fri, 01 May 2026 00:00:00 GMT New Terraform detection management in SIEM, native IOC sources, and unified user settings across Rapid7 Command Platform • Adds the ability to create, validate, and deploy detections as code in SIEM (InsightIDR) using Terraform. • Adds Native IOC Management for Threat Intelligence feeds within Command Platform > Data Connectors > Sources. • Adds a Resource Type filter to the Remediation Hub main table to filter by Instance, Container, or Host. • Adds AI-Enhanced Attack Modules with LLM-based vulnerability pre-triage in Application Security > Settings > Scan Options. • Adds Unified User Resources and Settings via Command Platform > Profile > User Settings for centralized profile management. Breaking changes: • Oracle Cloud Vault and Secret resource identification changes format to `{vault_display_name}.{vault_id}` and `{secret_name}{vault_id}`, causing existing resources to be re-identified as new. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/release-notes-2026-april/ https://docs.rapid7.com/insight/release-notes-2026-april/ Wed, 01 Apr 2026 00:00:00 GMT Rapid7 April 2026 adds dynamic seed queries, Bulk Export API scan policy data, persistent search tabs, multi-tenant API key, and more • Automate external attack surface discovery with dynamic seed queries using supported connectors (e.g., Markmonitor, NetBox). • Export scan policy data alongside existing Rapid7 Agent policy data via the Bulk Export API. • Maintain investigation context with persistent search tabs in Log Search that preserve open tabs and queries across sessions. • Access all tenants programmatically using a single multi-tenant API key. • View group membership details for Okta and Microsoft Entra ID users directly in the User Details page. • Map SIEM (InsightIDR) users to ASM identity profiles in Incident Command for unified identity context. • Increase in custom detection rule limits for greater flexibility. • Include new optional field `r7_hostid` in the JSON payload for supported endpoint-related event sources. • Export user access data for audit and compliance in CSV format from Command Platform > Users > Export User List. • Gain more coverage with the Web & App Framework Vulnerability Detection Module for Drupal and WordPress Core in InsightAppSec. • Support for NetAppFilesAccount and ContainerAppJob resource types in Cloud Security (InsightCloudSec). • Add support for filtering out devices by last sync date in Microsoft Intune connector. • New connector support for Check Point Harmony Endpoint, Cisco Catalyst Center, Datadog, Iru, PingOne Advanced Identity Cloud, privacyIDEA MFA, and PDQ Deploy and Inventory. • Endpoint Security Notifications provide real-time on-device alerts for blocked malicious activity on Windows assets. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/release-notes-2026-march/ https://docs.rapid7.com/insight/release-notes-2026-march/ Sun, 01 Mar 2026 00:00:00 GMT Cloud Security adds bot threshold controls, r7_hostid correlation in Log Search, and InsightsVM bulk remediation export API; IaC Scanner breaks with new flag names. • `LogSearch` now correlates endpoint authentication events with other logs using the `r7_hostid` key for faster investigation context. • `Cloud Security > Bot Factory` introduces threshold controls to automatically stop Bot runs when configured limits are exceeded. • `InsightVM` adds a Bulk Export API endpoint to export up to 3 months of remediation metadata for external BI reporting. • `Mimics Infrastructure as Code (IaC) Scanning Tool v2.0.0` requires the `files_to_scan` positional argument in GitHub Actions, replacing the deprecated `target` flag. Breaking changes: • The `Mimics IaC Scanner` GitHub Action positional argument `target` is removed; workflows must update to use `files_to_scan`. • The `Mimics IaC Scanner` OPA dependency is upgraded to v1.0, breaking custom Rego policies that rely on 0.x syntax. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/release-notes-2026-february/ https://docs.rapid7.com/insight/release-notes-2026-february/ Sun, 01 Feb 2026 00:00:00 GMT Rapid7 Feb 2026: Active Risk prioritization, MDR for Microsoft, ServiceNow Zurich support, Bot thresholds, and macOS scanning. • Adds `Active Risk` as the single standardized risk strategy across Vulnerability Management (InsightVM), Cloud Security (InsightCloudSec), and Exposure Command for consistent vulnerability prioritization. • Integrates contextual vulnerability intelligence into Threat Intelligence (Intelligence Hub) via the Response & Remediation > Remediation Hub view to link active exploitation data directly to impacted assets. • Deploys AI-generated risk insights in Remediation Hub that provide concise, single-sentence summaries of affected assets and ownership to accelerate remediation triage. • Extends Managed Detection and Response (MDR) protection across Microsoft environments with purpose-built detection and response capabilities available in the Alerts view. • Upgrades ServiceNow integration to support Zurich (AI) release for both Application Vulnerability Response (AVR) and IT Service Management (ITSM), enabling bidirectional vulnerability data updates from the ServiceNow App Store. • Adds `action_threshold_count` and `threshold_mail_recipients` optional fields to the Bot Factory `instructions` JSON object, allowing Bots to suppress actions when resource counts exceed configured limits and notify specified recipients. • Enables review of historical Bot activity in the new Bot Runs tab within the Bot Factory UI. • Adds support for scanning macOS Sonoma, Sequoia, and Tahoe assets via the Nexpose Scan Assistant with installers for Intel-based and Apple Silicon architectures. • Adds harvesting support for Azure Backup Vault resources (`Microsoft.DataProtection/backupVaults`) and Azure Recovery Services Vault resources (`Microsoft.RecoveryServices/vaults`), requiring respective `read` permissions. • Adds new query filters for App Service Environments allowing TLS 1.0/1.1, VNet integration routing for Function Apps/Slots, and Azure Batch private endpoint connection states. • Updates the Cloud Listing table in Cloud Security to display Oracle and Alibaba Cloud account IDs and role ARNs. • Adds feature to download Software Bill of Materials (SBOMs) for container images scanned for vulnerabilities in Cloud Security. Breaking changes: • The Plugins tab is deprecated in Cloud Security (InsightCloudSec). • Database Cluster Without Audit Logging (ID 595) and Database Instance Without Audit Logging (ID 350) insights are removed; customers must use ID 2471 and ID 2472 respectively. • The Rapid7 Agent (Insight Agent) no longer supports openSUSE LEAP 15.5, Fedora 41, Windows 10 v1507, or Windows 10 v1511. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/release-notes-2026-january/ https://docs.rapid7.com/insight/release-notes-2026-january/ Thu, 01 Jan 2026 00:00:00 GMT Rapid7 adds new Cloud security insights/compliance packs, Velociraptor polling interval reduction, and API role-aware filtering. • Adds `ap-southeast-6` to AWS region support for harvesting strategy dropdown • Adds Advanced Filter on Vulnerability Proof in the visual interface • Adds new Query Filters including `Resource Does Not Support TLS 1.3 Minimum` and `Secret is Expired` for cloud resource identification • Adds CIS AWS End User Compute Services Benchmark v1.2.0 as a new Compliance Pack • Adds support for AWS ElastiCache `has_pending_update` column and requires `elasticache:DescribeServiceUpdates`/`elasticache:DescribeUpdateActions` permissions • Adds TLS encryption detection and minimal TLS version support for AWS Database Clusters (Neptune, DocumentDB, Aurora MySQL/PostgreSQL) • Adds new Query Filter `Database Cluster Encryption In Transit Disabled` for CIS AWS Database Services Benchmark 1.0.0 Recommendation 7.4 • Adds storage account VHD encryption type and volume network access checks via new insights and Query Filters • Adds `filter_id` parameter support to the paginated insights endpoint `/v4/iac/insights` • Enhanced fingerprinting for Citrix Virtual Apps and Desktops using additional system components • Allows custom properties to be managed directly from the Console host's text-based command console • Enables asset group exclusion directly within scan schedules regardless of creation time • Reduces Velociraptor client polling interval from ten minutes to three minutes for faster job initiation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/release-notes-2025-december/ https://docs.rapid7.com/insight/release-notes-2025-december/ Mon, 01 Dec 2025 00:00:00 GMT Rapid7 Dec 2025: EPSS in bulk export APIs, Oracle SID failure threshold config, and new InsightCloudSec integrations • Adds `epss_score` and `epss_percentile` fields to Vulnerability Management (InsightVM) asset and vulnerability bulk export APIs, enabling prioritization by real-world exploit probability. • Adds new Oracle SID enumeration failure threshold mechanism with configurable custom properties `com.rapid7.oracle.bootstrap.failure.limit` and `com.rapid7.oracle.bootstrap.failure.codes` in the Scan Engine. • Adds `LakeFormationHarvester` for harvesting AWS Lake Formation resources and requires the `lakeformation:GetDataLakeSettings` permission in Cloud Security (InsightCloudSec). • Adds new AliCloud Python onboarding script exposed via API endpoints in Cloud Security (InsightCloudSec) for streamlined cloud account onboarding. Breaking changes: • The query filter field names `full_tls_10`, `full_tls_11`, `full_ssl_30`, and `full_tls_12` have been removed from the RestAPI resource in InsightCloudSec, replaced by `client_tls_*`, `backend_tls_*`, and `client_ssl_*` fields. • The query filter named 'App Stream Fleet Not Using VPC (AWS)' has been renamed to 'App Stream Fleet Not Using Securely Configured VPC', affecting any automation referencing the old name. • The query filter 'Database Instance Vulnerability Assessment Not Associated with Storage Account' and its associated insight have been deprecated and removed from all compliance packs in InsightCloudSec. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/release-notes-2025-november/ https://docs.rapid7.com/insight/release-notes-2025-november/ Sat, 01 Nov 2025 00:00:00 GMT New on-demand NGAV scanning, Microsoft Entra ID event source in SIEM, and IaC exceptions management in Cloud Security • Adds On-Demand Scanning capability to Next-Generation Antivirus for proactive malware detection across Windows, Linux, and macOS assets • Adds Microsoft Entra ID as a configurable event source in Data Connectors for SIEM (InsightIDR) to enrich alerts with identity context • Adds ability to manage exceptions for Infrastructure as Code (IaC) findings via the Controls & Compliance > Infrastructure as Code console view in Cloud Security (InsightCloudSec) • Adds `PA_DBINSTANCE_EXTERNAL_SCANNER` feature flag to enable External Scanning support for Database Instances in Cloud Security (InsightCloudSec) • Adds source document storage integration for Tenable, Qualys, CrowdStrike, and SentinelOne agents via feature flags in Cloud Security (InsightCloudSec) • Adds AWS DevOps Guru Integration with `DevOpsGuruInsightHarvester` support in Cloud Security (InsightCloudSec) Breaking changes: • Rapid7 Agent (Insight Agent) v4.0.20.15 no longer supports Ubuntu 24.10, Open Suse LEAP 15.4, or Fedora 40 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/release-notes-2025-october/ https://docs.rapid7.com/insight/release-notes-2025-october/ Wed, 01 Oct 2025 00:00:00 GMT New AWS/Azure harvesters, Remediation Hub filtering by CVSS/Risk, Certificate SSH creds, and CIS Win11 support in InsightVM • Adds `AmplifyAppHarvester`, `CodePipelineHarvester`, `MediaAnalysisJobHarvester`, `AppflowHarvester`, and `MapHarvester` to Cloud Security for new AWS/Azure resource discovery. • Adds filter by CVSS score and filter by Active Risk score in `Response & Remediation > Remediation Hub` to prioritize vulnerabilities. • Adds Certificate-Based SSH Authentication as a credential option for authenticated scans of Linux/Unix systems in InsightVM. • Adds built-in policy support for CIS Microsoft Windows 11 Benchmark v4.0.0 in InsightVM. • Adds `environment_variables_configured` field source of truth for AWS/GCP Serverless Functions in Cloud Security. • Adds new Query Filters: `Amplify App Without Web Application Firewall`, `Amplify App Using Basic Auth`, `Local Authentication Turned Off On Map Account`, and Rekognition status filters. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/releasenotes-2025sep/ https://docs.rapid7.com/insight/releasenotes-2025sep/ Mon, 01 Sep 2025 00:00:00 GMT Rapid7 Command Platform Sept 2025: Remediation Hub, Vector Command Advanced, AI Log Search, GCP SCC Triage-as-Code, CVA env vars, NGAV registry field • Adds `Remediation Hub` in Response & Remediation to prioritize high-impact fixes using Active Risk Score • Introduces Vector Command Advanced managed service for validating internal segmentation controls and compliance evidence • Simplifies GCP SCC Alert triage with Triage-as-Code (TRaC) translation to plain language • Enriches GCP SCC alerts with asset context from Cloud Security (InsightCloudSec) • Adds `SSL_NO_VERIFY` environment variable to CVA Local Scanner to skip TLS verification • Adds `SCAN_SCHEDULE` environment variable to CVA Local Scanner to customize scan interval in seconds • Deprecates `CRON_SCHEDULE` environment variable for CVA Local Scanner scan frequency configuration • Renames `DIVVY_SOURCE_DOCUMENT_FORCE_WRITE` to `DIVVY_SOURCE_DOCUMENT_FORCE_WRITE_ENABLED` environment variable in Cloud Security • Adds `SOURCE_DOCUMENT_BLOCKED_JOBS` environment variable to Cloud Security to block source document storage for specific harvesters • Adds new Query Filters for Azure Service Bus Namespace Topics including `Message Topic Minimum TLS Version`, `Message Topic Type`, and others • Adds `Workspace Directory With Enabled Web Access` Insight and Query Filter in Cloud Security • Adds AppStream Private Image resource support with `AppStreamImageHarvester` in Cloud Security AWS • Adds protected registry path visibility to NGAV/Ransomware Prevention alert payloads via the `protectedRegistry` field • Updates SIEM API documentation paths to include `/api/3/yaml` format in Console v3 Breaking changes: • `CRON_SCHEDULE` environment variable is deprecated and no longer used for CVA Local Scanner scan schedule intervals; use `SCAN_SCHEDULE` instead. • Environment variable `DIVVY_SOURCE_DOCUMENT_FORCE_WRITE` must be renamed to `DIVVY_SOURCE_DOCUMENT_FORCE_WRITE_ENABLED` in Cloud Security configurations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/releasenotes-2025aug/ https://docs.rapid7.com/insight/releasenotes-2025aug/ Fri, 01 Aug 2025 00:00:00 GMT New Attack Surface API, External Scanner Integration, In-Product Remediation Steps, and Unified Navigation preview for Rapid7 Insight Platform August 2025 • Adds `Attack Surface Management (ASM) API` for Cypher-based queries across assets, identities, and related ASM data types in Surface Command and Exposure Command • Enables Asset and Identity filters using source-specific properties (e.g., Microsoft Active Directory, Crowdstrike) in Surface Command without custom Cypher queries • Adds detection of container public exposure with full orchestration context (service meshes, ingress controllers, node roles) in Cloud Security (InsightCloudSec) and Exposure Command • Enables real-time exposure validation via external scanner integration that assesses business impact and maps attack vectors for open database ports and misconfigured services • Adds enhanced Bulk Export API using GraphQL to retrieve asset/vulnerability data in Parquet format for Vulnerability Management (InsightVM) • Embeds step-by-step remediation guidance directly within vulnerability findings in Cloud Security (InsightCloudSec) and Exposure Command • Enables dynamic third-party alert prioritization reflecting current severity levels for third-party alerts in Managed Detection and Response (MDR) and Managed Threat Complete • Adds SOC-monitored coverage for Okta Identity and Palo Alto Cortex XDR telemetry via Data Connectors > Data Collectors • Migrates 8 legacy and 5 third-party detection rules into the SIEM (InsightIDR) Detection Rule Library • Enables Unified Navigation feature preview with streamlined cross-solution access in Administration • Adds automatic allowlisting settings to disable IOC auto-allowlisting in Threat Intelligence (Intelligence Hub) • Supports Azure Event Driven Harvesting and Least-Privileged Access via automatic deployment in Azure China and Azure Government clouds Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/releasenotes-2025jul/ https://docs.rapid7.com/insight/releasenotes-2025jul/ Tue, 01 Jul 2025 00:00:00 GMT Rapid7 adds Local CVA for private registries, new Surface Command connectors, and AI MDR workflows in July 2025 • Adds `HTTPS_PROXY`, `SSL_CERT_FILE`, and `SSL_CERT_DIR` environment variables to Cloud Security (InsightCloudSec) bot configurations for custom network and SSL settings • Integrates Attack Surface Management (Surface Command) with Cisco ISE, CyberArk PAM, Nucleus Security, PingOne, and Deep Instinct connectors • Adds dynamic third-party alert prioritization mapping in SIEM (InsightIDR) to clarify triage ownership between customer teams and the Rapid7 SOC • Introduces AI-assisted agentic workflows in MDR service for automated alert triage and enrichment • Adds new Insights, Query Filters, and CIS Azure 3.0/4.0 compliance packs to Cloud Security (InsightCloudSec) • Expands InsightVM/Nexpose tag management permissions with `Manage Site Tags`, `Manage Asset Tags`, and `Manage Group Tags` • Adds Network Sensor native detection for DNP3 protocol and enhanced VLAN/VXLAN inspection • Migrates legacy UBA detection rules (e.g., HONEY USER AUTHENTICATION) to the SIEM Detection Library Breaking changes: • Bots interacting with OCI Compartment resources must update their configuration to reference the new Organization Services level organization service ID, as older service IDs will trigger alerts. • The option to 'Switch to Legacy UI' has been removed in Cloud Security (InsightCloudSec). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/releasenotes-2025june https://docs.rapid7.com/insight/releasenotes-2025june Sun, 01 Jun 2025 00:00:00 GMT New connectors for Surface Command, AI disposition in InsightIDR, new Insights/harvesters in Cloud Security, and manual update uploads. • Adds Baramundi, Cybereason, Dragos, Markmonitor, Microsoft Defender for IoT, and Zabbix Cloud as Attack Surface Management (Surface Command) integrations • Unifies external and internal attack surface discovery in a single interface with seed management and insight dashboards for Discovery Seeds under External Attack Surface in Attack Surface Management (Surface Command) • Allows marking subdomains, IP addresses, or network services as out-of-scope for Continuous Red Teaming (Vector Command) within the External Attack Surface view of Attack Surface Management (Surface Command) • Adds dark mode toggle to Attack Surface Management (Surface Command) workspace • Introduces mitigating controls prioritization in Remediation Hub across Command Platform, Exposure Command, Cloud Security (InsightCloudSec), InsightVM, and Automation (InsightConnect) • Adds Claroty xDome and Imperva WAF as direct cloud log event sources for detection products without additional software • Provides expert-driven remediation guidance for AWS GuardDuty and Azure Defender for Cloud alerts in SIEM (InsightIDR) Alerts > Alert Details • Adds dozens of new Suricata rules under ET EXPLOIT, ET EXPLOIT_KIT, and ET SCAN to Network Sensor in SIEM (InsightIDR) • Adds Account Password Reset – Is Watched and Account Password Reset – Is Admin detection rules to the Detection Library in SIEM (InsightIDR) • Migrates legacy UBA rules (Third Party Alert – Cyberark Vault, Third Party Alert – Cybereason, Third Party Alert – Netskope, Zone Policy Violation, Flagged Hash On Asset, Flagged Process On Asset) into the Detection Library in SIEM (InsightIDR) • Introduces a graph-based Principal API Activity Timeline for Azure audit logs in SIEM (InsightIDR) Alerts > Alert Details • Publishes Cloud Security (InsightCloudSec) API documentation accessible via Profile and Help menu for programmatic access • Adds AI Dispositioning to automatically classify alerts as likely benign or malicious with the 'AI Suggested Disposition' field in SIEM (InsightIDR) Alerts > Alert Details • Excludes Enhanced Endpoint Telemetry (EET) data from monthly Fair Use allowance calculations in SIEM (InsightIDR) • Adds False Positive and Security Test as selectable disposition options for alerts and investigations in SIEM (InsightIDR), Managed Threat Complete, and MDR • Centralizes endpoint exclusion management under Command Platform > Administration > Data Collection > Agents > Endpoint Prevention > Exclusions for Managed Threat Complete and MDR • Adds Insights: Encryption Key Vault With Public Network Access Enabled When Using Private Endpoint and Databricks Workspace Enable Customer Managed Keys (CMK) in Cloud Security (InsightCloudSec) • Removes the 'Switch to Legacy UI' option in Cloud Security (InsightCloudSec) System Settings • Expands Azure Container Registry fields to include local admin and managed identity information in Cloud Security (InsightCloudSec) • Adds Insights: Secrets stored in ConfigMaps and Web App with Remote Debugging Enabled in Cloud Security (InsightCloudSec) • Enables namespace-level fallback for the Guardrails inventory scanner when cluster-wide permissions fail in Cloud Security (InsightCloudSec) Kubernetes Scanner version 4.1.5 • Adds Add Organization button to Cloud Accounts > Organizations page in Cloud Security (InsightCloudSec) Modern UI • Adds support for optional custom tags in Automatic LPA Deployment modal and Azure Container Registry tagging in Cloud Security (InsightCloudSec) • Enables local assessments of private OCI registries in Cloud Security (InsightCloudSec) • Deprecates Web App with Remote Debugging Turned On Insight in favor of Web App with Remote Debugging Enabled in Cloud Security (InsightCloudSec) • Adds insights for Azure Storage Account lifecycle policies and query filters: Storage Account Without Lifecycle Policy, Storage Account With Disabled Lifecycle Policy Rules, etc. in Cloud Security (InsightCloudSec) • Supports tagging for deployed resources during Azure LPA and EDH auto-deployment endpoints in Cloud Security (InsightCloudSec) • Adds StartInstances event harvesting with the `StartInstancesEventHarvest` feature flag to populate launch_time in Cloud Security (InsightCloudSec) • Expands OS package detection for higher-fidelity proof in host and container assessments in Cloud Security (InsightCloudSec) • Adds Storage Account with Default to OAuth Authentication Disabled insight, Azure Stream Analytics Clusters/Jobs harvesting, and associated query filters in Cloud Security (InsightCloudSec) • Adds new Insights: Serverless Function With Enabled Cloud Secret Manager API, Subnet Without VPC Flow Logs Enabled, Cloud Accounts Without Sinks Configured for All Log Entries, and Cloud Account Linked to Cloud Credential Without App Restrictions in Cloud Security (InsightCloudSec) • Adds Query Filters: Resource Encrypted With Cloud Managed Key, Database Migration Endpoint Is/Is Not Encrypted, Cloud Accounts Without Sinks Configured For All Log Entries, and Cloud Credential Without App Restrictions in Cloud Security (InsightCloudSec) • Adds CIS GCP 3.0 Compliance Pack and updates Insights for CIS GCP 3.0 Recommendations 2.4–2.11 in Cloud Security (InsightCloudSec) • Introduces Azure App Service Environments support with new harvester, resource, and query filter in Cloud Security (InsightCloudSec) • Adds BigQuery Dataset Tables harvesting support in Cloud Security (InsightCloudSec) • Enables EDH actions TagResource and UntagResource for EFS in Cloud Security (InsightCloudSec) • Adds in-transit encryption support for auto-provisioned EDH queues in Cloud Security (InsightCloudSec) • Updates Databricks Workspace resource expansion with configuration fields and Private Network linkage in Cloud Security (InsightCloudSec) • Allows manual upload of product and content updates for offline environments in InsightVM/Nexpose version 8.13.0 • Adds confirmation step requiring 'CONFIRM' to be typed before deactivating console in InsightVM/Nexpose versions 8.11.0+ and InsightIDR Settings • Updates JunosOSVersionComparator logic and canCompare method for better version handling in InsightVM/Nexpose versions 8.11.0+ • Adds support for CIS Google Chrome Benchmark 3.0.0 and CIS Microsoft Windows 11 Enterprise Benchmark 4.0.0 content in InsightVM/Nexpose • Adds User Attribution settings page in SIEM (InsightIDR) Settings for customizing account/user involvement in collected log activity • Adds optional fields to AWS GuardDuty event source form for SQS Messages and EC2 Instance Authentication methods in SIEM (InsightIDR) • Updates default date range for Investigation Details > Inspect Actor Activity to last 24 hours in SIEM (InsightIDR) • Consolidates InsightVM and Agent settings into a 'Command Platform Features' tab in Settings for SIEM (InsightIDR) • Groups related fields with collapsible sections in the event source creation form in SIEM (InsightIDR) • Updates Threat Actor Activity Tracking prioritization by most recent activity in Intelligence Hub version 1.4.2 • Adds stream line table search for campaigns and actor profiles by name and description in Intelligence Hub version 1.4.2 • Adds domain-type IOC decay score in Intelligence Hub version 1.4.3 • Enables partial prefix searches for threat actors/campaigns in Intelligence Hub version 1.4.3 • Upgrades Java Runtime to version 17.0.15 and adds CIS Ubuntu 24.04 Benchmark v1.0.0 support in InsightVM/Nexpose version 8.9.1 • Adds AI attack coverage configuration details for LLM Vulnerability Scanning in Application Security (InsightAppSec) AppSpider 7.5.019 Breaking changes: • Deprecated Insights and Compliance Packs will remain visible until their specified removal version, but the 'Switch to Legacy UI' option is removed in Cloud Security (InsightCloudSec) System Settings. • Legacy risk strategies—Temporal, TemporalPlus, Weighted, and PCI ASV 2.0—are deprecated in InsightVM/Nexpose and will cease support on January 21, 2026; users must switch to the Active Risk strategy. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/releasenotes-2025may/ https://docs.rapid7.com/insight/releasenotes-2025may/ Thu, 01 May 2025 00:00:00 GMT Rapid7 May 2025 adds attack surface connectors, AI dispositioning, ET rules, and bulk exclusion workflows • Attack Surface Management (Surface Command) integrates with Baramundi, Cybereason, Dragos, Markmonitor, Microsoft Defender for IoT, and Zabbix Cloud as new third-party connectors. • Cloud Security (InsightCloudSec) expands the `/v2/prototype/apa/path-mapping` API endpoint to map old Attack Path IDs to new ones. • SIEM (InsightIDR) adds False Positive and Security Test as selectable disposition options for alerts and investigations. • `Network Sensor` activates Enhanced Emerging Threats (ET) rulesets including ET EXPLOIT, ET EXPLOIT_KIT, and ET SCAN for network traffic detection. • Cloud Security (InsightCloudSec) adds the CIS GCP 3.0 Compliance Pack for cloud account auditing. Breaking changes: • The `ContainerRegistryHarvester` harvester is deregistered and replaced by `ArtifactRegistryHarvester` in Cloud Security (InsightCloudSec). • The query filter Dataset Tables Not Leveraging Customer-Managed Encryption Key (CMEK) is removed in Cloud Security (InsightCloudSec). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/release-notes-2025-april/ https://docs.rapid7.com/insight/release-notes-2025-april/ Tue, 01 Apr 2025 00:00:00 GMT April 2025 adds Surface Command connectors for Cyberhaven and KACE, MDR customization, Azure API timeline, and more. • Adds `Cyberhaven` and `KACE Asset Management Appliance` as new connector profiles in Attack Surface Management • Enables creation of `Connector Profiles` to deploy multiple instances of the same connector across distributed environments • Introduces `Breach Protection Warranty` offering built-in financial protection for Managed Threat Complete Ultimate customers • Adds `Unified Executive Risk View` for consolidated reporting across InsightVM, Exposure Command, and Cloud Security • Integrates `Rapid7 Labs` to power the `Threat Library` in Intelligence Hub for faster threat intelligence delivery • Enables customization of detection rules, dashboards, and data source ingestion within `MDR` services • Adds new interactive visualizations to the `Detection and Response Dashboard` with MITRE ATT&CK mapping • Adds automated removal of historical asset records via `Maintenance Schedule` in Administration • Visualizes user and service activity across Azure environments using the `Principal API Activity Timeline` in SIEM Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/releasenotes-2025mar/ https://docs.rapid7.com/insight/releasenotes-2025mar/ Sat, 01 Mar 2025 00:00:00 GMT March 2025 adds Alert Triage workflows, AWS principal API timeline, Executive Risk View reports, and new Surface Command connectors. • Adds support for deploying multiple instances of the same connector in Attack Surface Management (Surface Command). • Introduces unified Executive Risk View reports on the Command Platform to consolidate cross-product risk reporting. • Adds a graph-based principal API activity timeline for AWS in Cloud Detection & Response. • Enables direct ingestion of cloud log data via webhooks and S3 into SIEM (InsightIDR), Managed Threat Complete, and MDR. • Expands Digital Risk Protection (Threat Command) monitoring to LinkedIn, Roblox, and Facebook Ads for brand impersonation detection. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/releasenotes-2025feb/ https://docs.rapid7.com/insight/releasenotes-2025feb/ Sat, 01 Feb 2025 00:00:00 GMT Rapid7 February 2025 adds On-Prem API integrations for Surface Command, custom IaC query filters, Chronological Search in InsightIDR, and new UI for Credits Management. • Adds `on-premise API Integrations` to Attack Surface Management (Surface Command) to ingest asset, identity, vulnerability, and exposure data from private IT systems like Active Directory • Introduces ~250 custom query filters for Cloud Formation in Cloud Security (InsightCloudSec) via the `Security > Query Filters` UI path • New connectors added to Attack Surface Management: Action1 Vulnerability Management, ESET PROTECT Platform, Cloudflare, JumpCloud, Red Hat Insights, and SOTI MobiControl • Adds `Chronological Search` in SIEM (InsightIDR) > Log Search to view event logs in time order for investigation • Adds `alert triage` capabilities in SIEM (InsightIDR) > Alerts including filtering, bulk actions, and contextual grouping • New `Credits Management UI` in Digital Risk Protection (Threat Command) at `Settings > Subscription` for tracking service credits • Configurable `Credential Alert Timeframe` in Digital Risk Protection (Threat Command) at `Configurations > Customization > Company Credentials Policies` • Adds automated MFA for Macro workflow in Application Security (InsightAppSec) and Exposure Command • Adds `Vulnerability Proof` view in Remediation Hub to see concrete vulnerability evidence before assigning fixes • Adds exportable solution reports feature in Remediation Hub at `Command Platform > Response & Remediation > Remediation Hub` • Adds `Security Context` from Attack Surface Management to Remediation Hub for holistic asset risk view Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/releasenotes-2025jan/ https://docs.rapid7.com/insight/releasenotes-2025jan/ Wed, 01 Jan 2025 00:00:00 GMT New Surface Command connectors, NIST CSF 2.0 pack, GuardDuty attack sequence detection, InsightVM alert enrichment, Microsoft Defender auto-triage, and User Management redesi • Integrates Cisco Umbrella DNS, Claroty xDome, ManageEngine ServiceDesk Plus Asset Catalog, Honeywell SCADAfence, Nozomi Vantage, and SpecterOps BloodHound Enterprise into Attack Surface Management (Surface Command) • Adds NIST Cybersecurity Framework (CSF) 2.0 compliance pack for AWS and Azure • Leverages Amazon GuardDuty's new attack sequence findings in Cloud Detection and Response • Enriches SIEM (InsightIDR) alerts with InsightVM risk context to view exploitable vulnerabilities within alerts • Automatically identifies benign activity and real threats for Microsoft Defender alerts using advanced AI models • Redesigns User Management interface to support tailored access per organization, conflict prevention logic, SSO integration via User Group and Group Sync Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform https://docs.rapid7.com/insight/releasenotes-2024dec/ https://docs.rapid7.com/insight/releasenotes-2024dec/ Sun, 01 Dec 2024 00:00:00 GMT December 2024 release adds Attack Surface Management connectors, Remediation Hub, AppSec vulnerability groupings, ServiceNow and GitLab CI/CD integrations, expanded custom co • Adds new Attack Surface Management (Surface Command) connectors for Cisco Umbrella DNS, Claroty xDome, Honeywell SCADAfence, SpecterOps BloodHound Enterprise, and Devo to the Rapid7 Extension Library • Introduces Remediation Hub in Response & Remediation to visualize top 25 remediation solutions and track risk reduction metrics • Adds vulnerability groupings in Application Security (InsightAppSec) to group findings by application and attack type for efficient triage • Integrates Application Security (InsightAppSec) with ServiceNow Xanadu for bidirectional data synchronization • Integrates Cloud Security (InsightCloudSec) with GitLab CI/CD pipelines to automate repository scans • Enables combining multiple compliance packs into a single custom compliance pack in Cloud Security (InsightCloudSec) • Adds automatic triage for Rapid7 alerts using AI models in SIEM (InsightIDR) • Adds automatic triage for CrowdStrike alerts using AI models in SIEM (InsightIDR) • Makes log lines clickable in SIEM (InsightIDR) Log Search to open a structured JSON panel view • Refreshes the Digital Risk Protection (Threat Command) home page visual design and navigation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insight-platform