I’m being asked to create an automation inside insight VM that will send out an alert whenever port 3389 returns as open on one of our external vulnerability scans. Right now I’m building the alert using the Automation > Notification function, but I would like for the notification to be sent out as soon as a particular scan job completes. It looks like you are only able to send the notification at a set time. Is there another way to have a notification get sent out when a particular scan job completes if a certain port is found to be open?
Hi gverrault.
You can configure scan completion alerting within the site configuration where the scans are set. If you edit the site and select Alerts > Create Alert, you can specifiy the different actions that will trigger an alert. I don’t use these any more but I believe selecting the stopped scan event wil generate an alert via your chosen communication method when the scan completes or is stopped manually.
I know you can create scan job alerts, but my understanding is that would only report that the scan job is completed. I want an alert that will send out a notification if the following ports are found to be open when we run a scan from an external scanner
Ports 22, 25, 445, or 3389
It seems that the alerting function in Rapid7 really isn’t setup to accomplish this. Anyone have any thoughts on a way to get this working in Rapid7?
depending on how your sites are setup and how your scanning etc, you can Always Set up a DAG
ASSETS_W_SSH_ENABLED
ASSETS_W_RDP_ENABLED
Then just set your FILTERs on the SERVICE not the PORT as ports can change but the Service is the Service.
Then if you have a Number Count in that DAG you will know you have Exposures.