https://cybertoolchain.io/tools/rapid7-insightcloudsec New releases and features in Rapid7 InsightCloudSec, tracked by The Cyber Toolchain. en Mon, 02 Nov 2026 00:00:00 GMT https://docs.rapid7.com/insight/release-notes-2026-november/ https://docs.rapid7.com/insight/release-notes-2026-november/ Mon, 02 Nov 2026 00:00:00 GMT InsightCloudSec 26.11.3 adds new and updated Insights, harvester updates, and improved Azure load balancer visibility⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • InsightCloudSec now includes new and updated Insights for cloud security posture checks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • InsightCloudSec now harvests additional cloud resource data with harvester updates. • InsightCloudSec now surfaces improved visibility into Azure load balancer configurations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insightcloudsec https://docs.rapid7.com/insight/release-notes-2026-october/ https://docs.rapid7.com/insight/release-notes-2026-october/ Mon, 26 Oct 2026 00:00:00 GMT InsightCloudSec 26.10.27 adds a Lifecycle Management page, Compliance Scorecard tag export, and BotFactory API updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a Lifecycle Management page for tracking and managing deprecated components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds tag export options to the Compliance Scorecard. • Updates the BotFactory API with new capabilities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insightcloudsec https://docs.rapid7.com/insight/release-notes-2026-october/ https://docs.rapid7.com/insight/release-notes-2026-october/ Wed, 21 Oct 2026 07:51:47 GMT InsightCloudSec 26.10.20 adds four database security Insights, a new Query Filter, and expanded RDS security group evaluation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Database Instance Without Security Group` Query Filter to identify database instances and clusters lacking an attached security group.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Database Instance Without Security Group` Insight to flag database instances and clusters with no attached security group configured. • Adds Distributed Table Using Provider Default Encryption Key (DynamoDB) Insight to detect DynamoDB tables using the AWS-owned default key instead of an AWS-managed or customer-managed KMS key. • Adds `Cache Instance Security Group Allows Ingress From the Public` Insight to identify cache instances whose security groups permit ingress from the public internet, mapped to CIS Controls v8.1.2 safeguard 12.2, CMMC Level 1 and 2, NIST SP 800-53 Rev. 5, NIST SP 800-171, and NIST CSF v2.0. • Adds `Cache Database Cluster Transit Encryption Disabled` Insight to flag Cache Database Clusters without Transit Encryption, mapped to CIS AWS Database Services Benchmark control 6.2 and CIS Controls v8.1.2 safeguard 3.10. • Expands Amazon RDS harvester to evaluate VPC Security Group configurations across RDS DB Instances and Clusters (including Aurora) using existing harvested data. • Updates `Instance With Image Owned Outside Of Organization` Query Filter so instances running AMIs shared from accounts within your organization are no longer flagged, reducing false positives in custom Insights using this filter. • Updates Database Instance not Encrypted (RDS) Insight to support CIS Amazon Web Services Database Services Benchmark v2.0.0 Control 2.2 and adds compliance mappings for NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2, and CMMC Level 2. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insightcloudsec https://docs.rapid7.com/insight/release-notes-2026-october/ https://docs.rapid7.com/insight/release-notes-2026-october/ Tue, 06 Oct 2026 07:53:28 GMT InsightCloudSec 26.10.6 expands Remediation Hub access for cloud teams and ships a new Kubernetes Scanner version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Expands Remediation Hub access to empower cloud teams with broader remediation capabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Ships a new Kubernetes Scanner version with improved performance and stability. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insightcloudsec https://docs.rapid7.com/insight/release-notes-2026-september/ https://docs.rapid7.com/insight/release-notes-2026-september/ Tue, 29 Sep 2026 07:39:38 GMT InsightCloudSec 26.9.29 adds CIS database compliance packs, container CVE CSV export, and richer Layered Context resource state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Exports container vulnerability findings from the Layered Context list view as a CSV file, with one row per container, CVE, and affected package.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `CIS AWS Database Services Benchmark v1.0.0` compliance pack covering 22 controls across Aurora, RDS, DynamoDB, ElastiCache, Redshift, DocumentDB, Neptune, and Timestream. • Adds `CIS Microsoft Azure Database Services Benchmark v2.0.0` compliance pack covering 47 controls across Azure Cache for Redis, Azure Cosmos DB, Azure Data Factory, Azure Database for MySQL, Azure Database for PostgreSQL, and Azure SQL Database — available for Azure, Azure Gov, and Azure China. • Adds Database Instance Not Enforcing Transit Encryption (AWS) detection identifying Amazon RDS instances that do not enforce SSL/TLS encryption in transit, excluding DocumentDB and Neptune. • Adds Database Instance Without Automatic Backups (AWS) detection identifying Amazon RDS instances with backup retention period of 0, excluding DocumentDB and Neptune. • Shows each resource's lifecycle state as reported by the cloud provider, along with last harvest time, in Layered Context. • Reduces OCI Identity Domains API calls during cloud user harvesting for Oracle Cloud Infrastructure, lowering the risk of rate-limit errors on large tenancies. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insightcloudsec https://docs.rapid7.com/insight/release-notes-2026-september/ https://docs.rapid7.com/insight/release-notes-2026-september/ Tue, 22 Sep 2026 07:44:33 GMT InsightCloudSec 26.9.22 adds CrowdStrike Falcon OCI support, seven new Azure Insights, and six new Query Filters for Cosmos DB, MySQL, and PostgreSQL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Extends CrowdStrike Falcon agent Query Filters to Oracle Cloud Infrastructure (OCI) compute instances, joining existing AWS, Azure, and GCP coverage — enabling security teams to identify OCI instances by Falcon agent presence.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds harvesting of the `disableLocalAuth` property and firewall IP rules (including `0.0.0.0` datacenter-access detection) for Azure Distributed Table (Cosmos DB) resources. • Adds harvesting of private endpoint connection counts for Azure Database for MySQL and PostgreSQL Flexible Servers. • Adds `Distributed Table Local Authentication Configuration` Query Filter to identify Cosmos DB accounts by whether local (key-based) authentication is enabled or disabled (default: enabled). • Adds `Distributed Table Encryption Configuration` Query Filter to identify Cosmos DB accounts by customer-managed vs. provider-managed encryption keys (default: provider-managed). • Adds `Distributed Table Without Network Traffic Restrictions` Query Filter to identify Cosmos DB accounts that allow all network traffic or have `0.0.0.0` in firewall IP rules. • Adds `Database Instance Microsoft Entra-Only Authentication` Query Filter to identify Database Instances by Entra-only authentication status (default: not configured). • Adds `Database Instance Flexible Private Endpoint Connections` Query Filter to identify Azure Flexible Servers by private endpoint connection status, configurable by engine type (default: MySQL Flexible Servers without private endpoints). • Adds `Database Instance Firewall Allows Public Ingress` Query Filter to flag Database Instances with a firewall rule whose start IP is `0.0.0.0` and end IP is any address other than `0.0.0.0` (Azure services-only rule `0.0.0.0`–`0.0.0.0` is not flagged). • Adds `Distributed Table With Local Authentication Enabled` Insight to identify Azure Cosmos DB accounts using key-based authentication instead of Microsoft Entra ID only. • Adds `Distributed Table Encrypted With Provider Managed Key` Insight to identify Azure Cosmos DB accounts using service-managed rather than customer-managed keys. • Adds `Distributed Table Without Network Traffic Restrictions` Insight to identify Azure Cosmos DB accounts with unrestricted network access or `0.0.0.0` in firewall rules. • Adds Database Instance Without Microsoft Entra-Only Authentication (MySQL) Insight to identify Azure Database for MySQL Flexible Servers lacking Entra-only authentication. • Adds Database Instance Without Private Endpoint (MySQL Flexible Server) Insight to identify Azure Database for MySQL Flexible Servers without private endpoints. • Adds `PostgreSQL Database Instance With Public Network Access Enabled` Insight to identify PostgreSQL instances with public network access enabled. • Adds `PostgreSQL Database Instance Without Private Endpoint Connection` Insight to identify Azure Database for PostgreSQL Flexible Servers without a private endpoint connection. • Adds Database Instance Firewall Allows Public Ingress (SQL Server) Insight to flag SQL Server instances with a firewall rule permitting public ingress (start IP `0.0.0.0`, end IP anything other than `0.0.0.0`). • Updates Database Instance Log Retention Below Threshold (PostgreSQL) Insight to detect Azure PostgreSQL Flexible Servers where `logfiles.retention_days` is set to 3 days or fewer, supporting both the legacy `log_retention_days` and updated `logfiles.retention_days` parameter names. • Updates Database Instance With Setting Below Threshold log_retention_days (PostgreSQL) Insight to match both `log_retention_days` and `logfiles.retention_days` parameter names using an OR condition. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insightcloudsec https://docs.rapid7.com/insight/release-notes-2026-september/ https://docs.rapid7.com/insight/release-notes-2026-september/ Tue, 15 Sep 2026 13:01:10 GMT InsightCloudSec 26.9.15 adds 8 new Azure Insights, 5 new Query Filters, and expanded harvesters for Redis, Cosmos DB, and PostgreSQL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Cache Instance Encryption Type` Query Filter to identify Cache Instances by encryption configuration (Customer-Managed Key vs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Provider-Managed Key), defaulting to Provider-Managed Key detection. • Adds `Cache Instance Access Key Authentication Enabled` Query Filter to identify Azure Cache for Redis instances where `disableAccessKeyAuthentication` is set to false. • Adds `Distributed Table Public Network Access` Query Filter to identify Azure Cosmos DB accounts with public network access enabled. • Adds `Distributed Table Without Diagnostic Logging` Query Filter to identify Cosmos DB accounts missing a specified diagnostic log category, defaulting to the `allLogs` category. • Adds `Database Instance Entra-Only Authentication` Query Filter to identify Database Instances without Microsoft Entra-only authentication configured. • Adds new Insight `Cache Instance Not Using Customer Managed Key` to detect Azure Cache for Redis instances not using CMK encryption at rest. • Adds new Insight `Cache Instance With Access Key Authentication Enabled` to detect Azure Cache for Redis instances with access key auth enabled, aligned with CIS Azure Database Services Benchmark v2.0.0 Control 2.9. • Adds new Insight `Distributed Table With Public Network Access Enabled` for Azure Cosmos DB, mapped to CIS Controls v8.1.2 safeguard 4.4, CMMC L1/L2, NIST SP 800-53 Rev. 5, and Microsoft Cloud Security Benchmark v1. • Adds new Insight `Distributed Table Without Diagnostic Logging` to detect Azure Cosmos DB accounts missing diagnostic logging with the required `allLogs` category. • Adds new Insight Database Instance Without Microsoft Entra-Only Authentication (PostgreSQL) to detect PostgreSQL instances not configured with Entra as the sole authentication method. • Adds new Insight Database Instance Public Network Access Enabled (SQL Server) to detect SQL Server instances with public network access enabled. • Adds new Insight Database Instance Without Secure Transport Enabled (MySQL) to detect Azure Database for MySQL Flexible Servers where `require_secure_transport` is not enabled, mapped to NIST SP 800-53 Rev. 5, NIST SP 800-171, NIST CSF v2.0, CMMC Level 2, and Microsoft Cloud Security Benchmark v1. • Adds new Insight Database Instance Without Connection Log Auditing Events (MySQL) to detect MySQL Flexible Server instances where `audit_log_events` does not include `CONNECTION` or `CONNECTION_V2`, aligned with CIS Azure Database Services Benchmark v2.0.0 Control 5.6. • Expands Azure Cache for Redis harvester to collect Customer-Managed Key (CMK) encryption properties from Azure Cache for Redis Enterprise resources. • Expands Azure Diagnostic Settings harvester to collect diagnostic settings for Azure Cosmos DB accounts (`Microsoft.DocumentDb/databaseAccounts`). • Expands Azure Database Instance harvester to collect Microsoft Entra-only authentication status for Azure Database for PostgreSQL flexible servers. • Expands Azure Distributed Table (Cosmos DB) harvester to collect the `public_network_access` property for Azure Cosmos DB accounts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insightcloudsec https://docs.rapid7.com/insight/release-notes-2026-september/ https://docs.rapid7.com/insight/release-notes-2026-september/ Mon, 07 Sep 2026 00:00:00 GMT InsightCloudSec 26.9.8 adds a new Kubernetes Scanner version plus new and enhanced Insights and Query Filters. • Introduces a new Kubernetes Scanner version for improved cluster resource coverage. • Adds new Insights for cloud security posture assessment. • Enhances existing Query Filters with additional filtering capabilities. • Improves harvester performance and resource collection. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insightcloudsec https://docs.rapid7.com/insight/release-notes-2026-august/ https://docs.rapid7.com/insight/release-notes-2026-august/ Tue, 11 Aug 2026 15:37:25 GMT InsightCloudSec 26.8.11 adds four new CIS compliance packs, seven new Insights, two new query filters, and Azure Data Factory resource harvesting. • Adds `Data Factory with/without Managed Identity` query filter to identify Azure Data Factories based on Managed Identity configuration status (defaults to 'without'). • Adds `Data Factory Linked Services Use Key Vault` query filter to identify Data Factories based on whether linked services store credentials in Azure Key Vault (defaults to identifying inline storage). • Adds the `CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0` compliance pack for Kubernetes EKS clusters. • Adds the `CIS Google Kubernetes Engine (GKE) Benchmark v1.9.0` compliance pack for GKE clusters. • Adds the `CIS Red Hat OpenShift Container Platform Benchmark v1.9.0` compliance pack for OpenShift clusters. • Adds the `CIS AWS Compute Services Benchmark v1.1.0` compliance pack covering EC2, EBS, ECS, Lambda, Lightsail, Elastic Beanstalk, Fargate, Batch, App Runner, and SimSpace Weaver — 47 Insights mapped across AWS, AWS GovCloud, and AWS China regions. • New `Data Factory without Customer Managed Key Encryption` Insight identifies Azure Data Factories not encrypted at rest with Customer Managed Keys. • New `Data Factory without Managed Identity` Insight identifies Azure Data Factories with no Managed Identity configured. • New `Data Factory Linked Services Not Using Key Vault for Credentials` Insight identifies Data Factories storing credentials inline rather than in Azure Key Vault. • New `PostgreSQL Database Instance without Customer Managed Key Encryption` Insight identifies PostgreSQL instances not using Customer Managed Keys. • New `Aurora Database Cluster Encryption at Rest Disabled` Insight identifies Aurora clusters without encryption at rest. • New `DocumentDB Database Cluster Encryption at Rest Disabled` Insight identifies DocumentDB clusters without encryption at rest. • New `Cache Instance SSL Access Not Enforced` Insight identifies Azure Cache for Redis instances not enforcing SSL-only access, aligned with CIS Azure Database Services Benchmark Control 2.2. • Adds harvesting support for Managed Identity configurations (system-assigned and user-assigned) and linked services credential storage method for Azure Data Factory resources. • Paginates the Cloud Security Insights Library by default with a toggle to revert to the classic view, improving load times for large libraries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insightcloudsec https://docs.rapid7.com/insight/release-notes-2026-july/ https://docs.rapid7.com/insight/release-notes-2026-july/ Tue, 28 Jul 2026 16:02:38 GMT InsightCloudSec 26.7.28 adds AI Root Cause Analysis for runtime findings, HITRUST CSF v11.7.1 compliance packs, and AWS Tag Policy resource harvesting. • Adds a Root Cause Analysis tab to the AI Analysis panel for container runtime detection findings, surfacing an AI-generated summary, a Prevention Window showing when posture risks were first detected relative to the runtime incident, Primary Causes with confidence scores, and Contributing Factors. • New HITRUST CSF v11.7.1 e1 Essential and i1 Intermediate compliance packs available. • Adds harvesting support for AWS Organizations Tag Policy resources across AWS, AWS GovCloud, and AWS China environments via the new TagPolicyHarvester, enabling visibility into tag enforcement policies. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insightcloudsec https://docs.rapid7.com/insight/release-notes-2026-july/ https://docs.rapid7.com/insight/release-notes-2026-july/ Thu, 23 Jul 2026 15:52:36 GMT InsightCloudSec 26.7.21 adds Runtime Sensor health monitoring, unified compliance rule mapping, new API endpoints, and a CIS Azure Storage pack. • Adds real-time Runtime Sensor health status (Healthy, Disconnected, or Degraded) on the Kubernetes Clusters page and Resources Listing for customers with a Runtime license. • Introduces a unified 'Map to Compliance Pack' row and bulk action in the Insights Library, replacing the separate 'Edit Metadata' and 'Add to Custom Pack' actions. • Enables cascading dropdown selection of one or more compliance rules when mapping an Insight to a compliance pack. • Supports user-defined compliance rules (e.g., Custom Control 1.3) on custom packs, with a new Compliance Rules tab for adding, renaming, and deleting rules. • Supports rule inheritance from base packs; inherited rules appear read-only on the child pack's Compliance Rules tab. • Adds seven new compliance rule management API endpoints: GET /pack/{pack_id}/insight-rule-mappings, GET /packs-with-rules, POST /map-to-compliance-rule, GET /pack/{pack_id}/rules, POST /pack/{pack_id}/rules/create, POST /pack/{pack_id}/rules/delete, and POST /pack/{pack_id}/rules/rename. • Adds the CIS Microsoft Azure Storage Services Benchmark v1.0.0 compliance pack. • Adds new query filters: Serverless Function With Admin Role, Load Balancer Listener Frontend Protocols, Load Balancer Listener Instance Protocols, and Web App Load Balancer HTTP Configuration. • Adds an 'All HTTP Listeners Redirect to HTTPS' configuration option to the renamed Load Balancer Comprehensive HTTP to HTTPS Redirection query filter. • Adds a search input field to the Bot matched resources modal for quickly locating a specific resource by name. Breaking changes: • The 'Edit Metadata' and 'Add to Custom Pack' actions in the Insights Library have been replaced by the single 'Map to Compliance Pack' action; any workflows or documentation referencing those actions must be updated. • The query filter 'Snapshot Accessible To Public' is deprecated (renamed to 'Snapshot Accessible To Public (Deprecated)'); its functionality is now split across 'Snapshot Public Access' and 'Database Snapshot Public Access'. • The Insight 'Snapshot Available to the Public' is deprecated (targeted removal in version 27.1); it should be replaced with 'Snapshot Is Accessible to the Public' and 'Database Snapshot Is Accessible to the Public'. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insightcloudsec https://docs.rapid7.com/insight/release-notes-2026-july/ https://docs.rapid7.com/insight/release-notes-2026-july/ Thu, 09 Jul 2026 00:00:00 GMT InsightCloudSec 26.7.7 adds new insights for Auto Scaling Groups, EBS Volumes, and Security Groups, plus CIS Red Hat OpenShift Benchmark v1.9.0. • Adds new Insights covering Auto Scaling Groups, EBS Volumes, and Security Groups for expanded cloud misconfiguration detection. • Supports CIS Red Hat OpenShift Container Platform Benchmark v1.9.0 for container platform compliance assessments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rapid7-insightcloudsec