# Surface Command **URL:** https://discuss.rapid7.com/c/surface-command/47.md [Latest](https://discuss.rapid7.com/latest.md) · [Categories](https://discuss.rapid7.com/categories.md) · [Tags](https://discuss.rapid7.com/tags.md) --- ## [About the Surface Command category](https://discuss.rapid7.com/t/about-the-surface-command-category/44675)
**Author:** [@Eric-Wilson](https://discuss.rapid7.com/u/Eric-Wilson)\ **Replies:** 0\ **Last updated:** [November 7, 2024, 1:13pm UTC](https://discuss.rapid7.com/t/about-the-surface-command-category/44675 "2024-11-07T13:13:04Z")
The place for topics surrounding Surface Command, including connectors, queries, dashboards, and even use cases to get started with. We want to hear about your questions, use-cases and for you to share what you’ve built… --- ## [Example use case: ASM Software Inventory and Search](https://discuss.rapid7.com/t/example-use-case-asm-software-inventory-and-search/57528)
**Author:** [@jee\_chung](https://discuss.rapid7.com/u/jee_chung)\ **Replies:** 0\ **Last updated:** [October 30, 2026, 2:40pm UTC](https://discuss.rapid7.com/t/example-use-case-asm-software-inventory-and-search/57528 "2026-10-30T14:40:34Z")
Some ASM (Surface Command) data connectors have recently been enhanced to optionally import installed software (“software inventory”) data. This article demonstrates via examples, some ideas on how to use this newly avai… --- ## [Example use case: ASM Coverage Gap Reporting](https://discuss.rapid7.com/t/example-use-case-asm-coverage-gap-reporting/57513)
**Author:** [@jee\_chung](https://discuss.rapid7.com/u/jee_chung)\ **Replies:** 0\ **Last updated:** [October 22, 2026, 5:29pm UTC](https://discuss.rapid7.com/t/example-use-case-asm-coverage-gap-reporting/57513 "2026-10-22T17:29:36Z")
Rapid7 ASM’s asset inventory provides an easy way to perform coverage analysis and reporting of EDM and VM tools in use by your organization. Key Points Coverage report - determine which endpoints have which EDM/VM co… --- ## [ManageEngine Endpoint Central documentation for only Patch Manager Plus](https://discuss.rapid7.com/t/manageengine-endpoint-central-documentation-for-only-patch-manager-plus/57482)
**Author:** [@chelminen](https://discuss.rapid7.com/u/chelminen)\ **Replies:** 1\ **Last updated:** [October 5, 2026, 2:45pm UTC](https://discuss.rapid7.com/t/manageengine-endpoint-central-documentation-for-only-patch-manager-plus/57482 "2026-10-05T14:45:23Z")
The documentation for the ManageEngine Endpoint Central connector for when you only have Patch Manger Plus is not real clear, the scopes do not work if you do not use Endpoint Central. After much trial and error I figur… --- ## [Receive email notification when connector import feed failed](https://discuss.rapid7.com/t/receive-email-notification-when-connector-import-feed-failed/57466)
**Author:** [@jlai1](https://discuss.rapid7.com/u/jlai1)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 2:00am UTC](https://discuss.rapid7.com/t/receive-email-notification-when-connector-import-feed-failed/57466 "2026-09-25T02:00:26Z")
Hi all, I am looking for a solution for the connector when it encounters an error on an imported feed, and then automatically sends an email notification to the recipient. Is that possible? --- ## [SCCM Connector](https://discuss.rapid7.com/t/sccm-connector/57289)
**Author:** [@watch22](https://discuss.rapid7.com/u/watch22)\ **Replies:** 2\ **Last updated:** [September 17, 2026, 7:07pm UTC](https://discuss.rapid7.com/t/sccm-connector/57289 "2026-09-17T19:07:06Z")
We are running the Rapid7 Microsoft SCCM connector microsoft.sccm.app version 1.23.2431. SCCM AdminService works from a domain-joined Windows device using the same service account and returns data from /AdminService/wmi… --- ## [The New ADCS ASM Connector collects but does it enum ESCs?](https://discuss.rapid7.com/t/the-new-adcs-asm-connector-collects-but-does-it-enum-escs/57440)
**Author:** [@austin\_guidry](https://discuss.rapid7.com/u/austin_guidry)\ **Replies:** 0\ **Last updated:** [September 10, 2026, 3:40pm UTC](https://discuss.rapid7.com/t/the-new-adcs-asm-connector-collects-but-does-it-enum-escs/57440 "2026-09-10T15:40:39Z")
I just found the new ASM connector that enumerates ADCS templates It seems as though this connector queries for the templates, but does it/is there vision to include displays for ESC misconfigurations? This would incl… --- ## [Export data from Widget encounter weird information](https://discuss.rapid7.com/t/export-data-from-widget-encounter-weird-information/57399)
**Author:** [@jlai1](https://discuss.rapid7.com/u/jlai1)\ **Replies:** 2\ **Last updated:** [August 21, 2026, 2:25pm UTC](https://discuss.rapid7.com/t/export-data-from-widget-encounter-weird-information/57399 "2026-08-21T14:25:43Z")
I noticed this after downloading the data from the dashboard under specific widget I created before. And the details for this device appear different from the other devices? The information does not seem displayed in th… --- ## [Need to identify assets (Cloud, On-Prem, Hybrid) missing CrowdStrike Falcon Sensor using Surface Command Advanced Query](https://discuss.rapid7.com/t/need-to-identify-assets-cloud-on-prem-hybrid-missing-crowdstrike-falcon-sensor-using-surface-command-advanced-query/57384)
**Author:** [@sraj1](https://discuss.rapid7.com/u/sraj1)\ **Replies:** 2\ **Last updated:** [August 19, 2026, 4:04pm UTC](https://discuss.rapid7.com/t/need-to-identify-assets-cloud-on-prem-hybrid-missing-crowdstrike-falcon-sensor-using-surface-command-advanced-query/57384 "2026-08-19T16:04:59Z")
Trying to identify assets (cloud, on-prem, and hybrid) that do not have CrowdStrike Falcon Sensor installed using Surface Command Advanced Query. I can see CrowdStrike software records and Asset → Software relationships… --- ## [Is anyone having issues with the DNS and RDAP connector?](https://discuss.rapid7.com/t/is-anyone-having-issues-with-the-dns-and-rdap-connector/57360)
**Author:** [@rstaley](https://discuss.rapid7.com/u/rstaley)\ **Replies:** 1\ **Last updated:** [August 5, 2026, 3:16pm UTC](https://discuss.rapid7.com/t/is-anyone-having-issues-with-the-dns-and-rdap-connector/57360 "2026-08-05T15:16:17Z")
DNS and RDAP: Enrich IPs and Domains has been having issues for a while. Returning everything with 404 errors according to the logs. Any information would be helpful. --- ## [Feature Request: Support JWT Authentication for N‑able N‑central Extension (Surface Command)](https://discuss.rapid7.com/t/feature-request-support-jwt-authentication-for-n-able-n-central-extension-surface-command/57120)
**Author:** [@bh1](https://discuss.rapid7.com/u/bh1)\ **Replies:** 3\ **Last updated:** [July 14, 2026, 1:42pm UTC](https://discuss.rapid7.com/t/feature-request-support-jwt-authentication-for-n-able-n-central-extension-surface-command/57120 "2026-07-14T13:42:56Z")
Extension: N‑able N‑central Use case: Surface Command / InsightConnect ingestion Extension page: Rapid7 Extensions Category: Extensions / Surface Command Summary We are currently unable to use the N‑able N‑central ex… --- ## [Rapid7InsightAgent vs Rapid7IVMAsset](https://discuss.rapid7.com/t/rapid7insightagent-vs-rapid7ivmasset/57325)
**Author:** [@jlee7](https://discuss.rapid7.com/u/jlee7)\ **Replies:** 3\ **Last updated:** [July 14, 2026, 11:59am UTC](https://discuss.rapid7.com/t/rapid7insightagent-vs-rapid7ivmasset/57325 "2026-07-14T11:59:57Z")
Hello, I was trying to query for all offline agents via api based on this “WHERE ('Rapid7InsightAgent' IN a.sources)” clause. The actual agents listing in the command platform correctly lists an asset that has an offlin… --- ## [Attack Surface Command - Dashboard](https://discuss.rapid7.com/t/attack-surface-command-dashboard/57308)
**Author:** [@jlai1](https://discuss.rapid7.com/u/jlai1)\ **Replies:** 2\ **Last updated:** [July 14, 2026, 3:04am UTC](https://discuss.rapid7.com/t/attack-surface-command-dashboard/57308 "2026-07-14T03:04:38Z")
Hi , I have encountered this error, my widget can’t show data then when I remove one of the widget and upload back the widget. After reuploading back, the widget all works nicely already. May I know what happen for t… --- ## [Red Hat Satellite Connector](https://discuss.rapid7.com/t/red-hat-satellite-connector/57232)
**Author:** [@dave\_mc](https://discuss.rapid7.com/u/dave_mc)\ **Replies:** 1\ **Last updated:** [June 12, 2026, 1:15pm UTC](https://discuss.rapid7.com/t/red-hat-satellite-connector/57232 "2026-06-12T13:15:05Z")
We are trying to use the Red Hat Satellite connector to connect and extract the information from Red Hat Satellite 6.17.5 but we are getting schema validations errors. What versions of Red Hat satellite does the Rapid7 S… --- ## [Surface Command Connector documentation (really all products)](https://discuss.rapid7.com/t/surface-command-connector-documentation-really-all-products/57259)
**Author:** [@flobmeyer](https://discuss.rapid7.com/u/flobmeyer)\ **Replies:** 1\ **Last updated:** [June 8, 2026, 3:10pm UTC](https://discuss.rapid7.com/t/surface-command-connector-documentation-really-all-products/57259 "2026-06-08T15:10:49Z")
It would be nice if someone went through and updated all the public facing documentation. Is it so hard to put screenshots in for everything? Products change and your language is not always accurate. It would also be … --- ## [Remove Domain and Certificate in Attack Surface Management ( EASM )](https://discuss.rapid7.com/t/remove-domain-and-certificate-in-attack-surface-management-easm/57254)
**Author:** [@jlai1](https://discuss.rapid7.com/u/jlai1)\ **Replies:** 1\ **Last updated:** [June 3, 2026, 2:06pm UTC](https://discuss.rapid7.com/t/remove-domain-and-certificate-in-attack-surface-management-easm/57254 "2026-06-03T14:06:27Z")
Hi all, I accidentally entered the wrong domain in the discovery seed section. But I have removed it already. I have noticed the related domains and certificates still remain there and I can’t remove them. May I know ho… --- ## [Reporting Vulnerability Exceptions in Surface Command](https://discuss.rapid7.com/t/reporting-vulnerability-exceptions-in-surface-command/57191)
**Author:** [@tward1](https://discuss.rapid7.com/u/tward1)\ **Replies:** 0\ **Last updated:** [April 27, 2026, 2:12pm UTC](https://discuss.rapid7.com/t/reporting-vulnerability-exceptions-in-surface-command/57191 "2026-04-27T14:12:05Z")
I am trying to write a surface command query that returns vulnerabilities - it returns vulnerability, finding, and asset data. If a vulnerability has a exception I need to know that because my surface command query feeds… --- ## [Crowdstrike Falcon](https://discuss.rapid7.com/t/crowdstrike-falcon/57168)
**Author:** [@jlai1](https://discuss.rapid7.com/u/jlai1)\ **Replies:** 4\ **Last updated:** [April 16, 2026, 2:06pm UTC](https://discuss.rapid7.com/t/crowdstrike-falcon/57168 "2026-04-16T14:06:01Z")
When I try to run the import feed for CrowdStrike falcon incidents. But prompt “Failed”. But encounter the below error : \[3:33:24 pm\] Calling 'get\_incidents' \[3:33:26 pm\] Function get\_incidents failed: \[{'message': 'N… --- ## [Teams Integration surface command](https://discuss.rapid7.com/t/teams-integration-surface-command/57059)
**Author:** [@agregg](https://discuss.rapid7.com/u/agregg)\ **Replies:** 2\ **Last updated:** [February 5, 2026, 2:13pm UTC](https://discuss.rapid7.com/t/teams-integration-surface-command/57059 "2026-02-05T14:13:25Z")
Does this connector work? It seems the connector does not send as an adaptive card so the workflows just fail. Anyone run into this? --- ## [Surface command, vulnerability publish date as date instead of epoch](https://discuss.rapid7.com/t/surface-command-vulnerability-publish-date-as-date-instead-of-epoch/57039)
**Author:** [@tward1](https://discuss.rapid7.com/u/tward1)\ **Replies:** 0\ **Last updated:** [January 15, 2026, 9:01pm UTC](https://discuss.rapid7.com/t/surface-command-vulnerability-publish-date-as-date-instead-of-epoch/57039 "2026-01-15T21:01:30Z")
kind of surprised this isn’t in the forums, which probably means i am missing something obvious. when i MATCH (rf:Finding)--\>(rv:Rapid7IVMVulnerability), (rf)--\>(ra:Rapid7IVMAsset) and i match rv.datePublished is retu… --- ## [DATE FOrmat change](https://discuss.rapid7.com/t/date-format-change/56537)
**Author:** [@amiah](https://discuss.rapid7.com/u/amiah)\ **Replies:** 1\ **Last updated:** [November 19, 2025, 12:40pm UTC](https://discuss.rapid7.com/t/date-format-change/56537 "2025-11-19T12:40:57Z")
how do i convert a date format to “DD-MM-YYYY” or “DD/MM/YYYY” i have tried , to\_char((a.endpoint\_last\_scanned),‘DD-MM-YYYY’) i have tried ,SUBSTRING(tostring(a.endpoint\_last\_scanned),9,2)+‘/’+SUBSTRING(tostring(a.en… --- ## [Sample/templated JSON file for import file](https://discuss.rapid7.com/t/sample-templated-json-file-for-import-file/56180)
**Author:** [@dblack](https://discuss.rapid7.com/u/dblack)\ **Replies:** 1\ **Last updated:** [November 5, 2025, 1:11pm UTC](https://discuss.rapid7.com/t/sample-templated-json-file-for-import-file/56180 "2025-11-05T13:11:50Z")
I’m using the sftp connector for importing assets through json files. Rapid7 Extensions. I can’t find a source that explains creating a json file that is recognized by the connector. Also, I can’t locate an example json… --- ## [Surface Command - How is "Administrator?" (is\_administrator) determined?](https://discuss.rapid7.com/t/surface-command-how-is-administrator-is-administrator-determined/54709)
**Author:** [@jee\_chung\_mca](https://discuss.rapid7.com/u/jee_chung_mca)\ **Replies:** 1\ **Last updated:** [November 3, 2025, 4:51pm UTC](https://discuss.rapid7.com/t/surface-command-how-is-administrator-is-administrator-determined/54709 "2025-11-03T16:51:01Z")
Overview When viewing the “Identities” page in Surface Command, how is “Administrator?” determined? What does it mean when this value is True, False, or blank? While this field is a boolean field, interpreting its va… --- ## [Solarwinds Orion connector](https://discuss.rapid7.com/t/solarwinds-orion-connector/54885)
**Author:** [@nick\_graves](https://discuss.rapid7.com/u/nick_graves)\ **Replies:** 2\ **Last updated:** [November 3, 2025, 4:48pm UTC](https://discuss.rapid7.com/t/solarwinds-orion-connector/54885 "2025-11-03T16:48:09Z")
Hi, Trying to setup the SolardWinds Orion connector, however receive the following error when I test the connection: While executing function test, an error was encountered: test() missing 1 required positional argume… --- ## [SolarWinds Orion account permissions & SSO auth](https://discuss.rapid7.com/t/solarwinds-orion-account-permissions-sso-auth/56113)
**Author:** [@matt\_wyen](https://discuss.rapid7.com/u/matt_wyen)\ **Replies:** 0\ **Last updated:** [November 3, 2025, 3:36pm UTC](https://discuss.rapid7.com/t/solarwinds-orion-account-permissions-sso-auth/56113 "2025-11-03T15:36:47Z")
Hello, We are attempting to setup the SolarWInds Orion data import connector for Surface Command However the documentation does not clarify if active directory joined SSO accounts are usable for this such as “DOMAIN\\… --- ## [R7 Surface Command correlation log table](https://discuss.rapid7.com/t/r7-surface-command-correlation-log-table/55546)
**Author:** [@amiah](https://discuss.rapid7.com/u/amiah)\ **Replies:** 0\ **Last updated:** [October 14, 2025, 8:27am UTC](https://discuss.rapid7.com/t/r7-surface-command-correlation-log-table/55546 "2025-10-14T08:27:38Z")
Im looking for a way (or a table) to return the linkage between the Assets Fields and how they map to source datasets. i need to be able to quickly trace where and how the fields for a certain asset has been derived for… --- ## [Trying to get the latest patch or patches on an asset](https://discuss.rapid7.com/t/trying-to-get-the-latest-patch-or-patches-on-an-asset/55140)
**Author:** [@amiah](https://discuss.rapid7.com/u/amiah)\ **Replies:** 1\ **Last updated:** [September 30, 2025, 6:19pm UTC](https://discuss.rapid7.com/t/trying-to-get-the-latest-patch-or-patches-on-an-asset/55140 "2025-09-30T18:19:13Z")
Is it possible to get the patches that have been applied to the asset. --- ## [Requesting v2 API for Netskope](https://discuss.rapid7.com/t/requesting-v2-api-for-netskope/54931)
**Author:** [@JeraldT](https://discuss.rapid7.com/u/JeraldT)\ **Replies:** 1\ **Last updated:** [September 19, 2025, 11:27am UTC](https://discuss.rapid7.com/t/requesting-v2-api-for-netskope/54931 "2025-09-19T11:27:09Z")
Netskope API v1 has been deprecated and our Netskope account team is requesting us to utilize v2 API as they plan on ending support for v1 soonish. --- ## [Surface command unable connect to Active Directory Connector](https://discuss.rapid7.com/t/surface-command-unable-connect-to-active-directory-connector/54746)
**Author:** [@jlai1](https://discuss.rapid7.com/u/jlai1)\ **Replies:** 7\ **Last updated:** [September 19, 2025, 1:42am UTC](https://discuss.rapid7.com/t/surface-command-unable-connect-to-active-directory-connector/54746 "2025-09-19T01:42:39Z")
Hi all, I am fresh at here and still in exploring stage. I am tried to set up a orchestrator to connect my on-primes Active directory server in Insight Connect. That is succeed to connect with my Active Directory.However… --- ## [Surface Command Asset Retention](https://discuss.rapid7.com/t/surface-command-asset-retention/54581)
**Author:** [@rockchav](https://discuss.rapid7.com/u/rockchav)\ **Replies:** 3\ **Last updated:** [September 10, 2025, 3:47pm UTC](https://discuss.rapid7.com/t/surface-command-asset-retention/54581 "2025-09-10T15:47:17Z")
Anyone how long Surface Command keeps old assets? We can’t image anything right now because if we do we go over our license count, and it doesn’t look like you can even delete anything. [Next page](https://discuss.rapid7.com/c/surface-command/47.md?page=1)