InsightVM Incorrect remediation project data compared to tags and missing proof in remediator exports

Rahpudsehvun · April 19, 2023, 3:36am

Have a case open on this but posting to hear about others experiences.

I noticed starting mid-late last week that the remediation project data for # of assets was suddenly missing, and then it somewhat seemed to self correct for a few projects the next few days.

The # of affected assets does not line up with all of the assets we previously have tags for under specific vulnerabilities.

I also noticed recently that when using the remediation export, a handful of assets (even the ones that do appear in the plan) do not show up at all.

This is preventing me from effectively planning and coordinating a comprehensive remediation plan for some vulnerabilities with my team.

Is there any alternative way to quickly get the full scope of assets along with the proof, aka the file paths, etc? Or do we just have to wait til it’s resolved? Not sure what the expected turnaround time for a resolution is.

john_hartman · April 19, 2023, 1:31pm

This isn’t a solution to your problem, and I hope that support is working to quickly resolve this. However, you can get a lot of the same data through the console level reports, mainly the “Top remediation with details” report depending on how you scope it.

Alternatively you can write SQL Queries to display the remediations as well. Unfortunately for this, the filtering is a little harder than what is offered through the platform using the query builder and of course these reports are a point-in-time and do not get updated like the remediation projects.

github.com

rapid7/insightvm-sql-queries/blob/master/sql-query-export/Assets-Vulns-Remediations.sql

-- collects site, IP address, host, vulnerability title, solution
-- Copy the SQL query below

SELECT dsite.name AS "Site Name", da.ip_address AS "IP Address", da.host_name AS "Host Name", dv.title  AS "Vulnerabiltiy", ds.solution_type  AS "Solution Type", ds.summary AS "Solution"
FROM fact_asset_vulnerability_instance AS fav
JOIN fact_vulnerability AS fv ON fav.vulnerability_id = fv.vulnerability_id
JOIN dim_vulnerability AS dv ON fav.vulnerability_id = dv.vulnerability_id
JOIN dim_site_asset AS dsa ON fav.asset_id = dsa.asset_id
JOIN dim_site AS dsite ON dsa.site_id = dsite.site_id
JOIN dim_ASset AS da ON fav.asset_id = da.asset_id
JOIN dim_vulnerability_solution AS dvs ON fv.vulnerability_id = dvs.vulnerability_id
JOIN dim_solution AS ds ON dvs.solution_id = ds.solution_id
GROUP by dsite.name, da.ip_address, da.host_name,dv.title, ds.solution_type, ds.summary
ORDER by dsite.name ASC

The link above is one example query in our public GitHub repo you could either use or reference. There are a handful more examples in that repo as well.

ebrooks · June 21, 2023, 1:27pm

We are having this issue now and have a ticket open. Was this ever resolved for you?

Buckofive · January 2, 2024, 8:52pm

Same issue here as well. I have a ticket open with support and they’ve identified it as a known issue and is currently in a state of “In engineering backlog”. Lord knows when this will get fixed…