Issue with Insight VM Console Plugin (Asset Search)

InsightConnect Plugins
, ,
1

I imported the ‘Scan Asset with InsightVM from Microsoft Teams’ workflow and added in our connections and site details from Insight VM. However, when the workflow reaches the ‘Find Asset ID’ step, I get the following error:

json: error calling MarshalJSON for type message.EngineMessage: json: error calling MarshalJSON for type json.RawMessage: invalid character ‘<’ looking for beginning of value

It is taking the hostname provided in the teams message and looking for it in the site provided in the workflow parameter. The search criteria in the workflow step is as follows:

{“match”:“any”,“filters”:[{“field”:“host-name”,“value”:“{{["Extract Argument"].[argument]}}”,“operator”:“contains”}]}

From an example failure, the input looks like this:

{
“searchCriteria”: {
“filters”: [
{
“field”: “host-name”,
“operator”: “contains”,
“value”: “hostname”
}
],
“match”: “any”
},
“size”: 0,
“sort_criteria”: {}
}

2

Apologies for the delay in response. looking at the example failure you shared above the value section currently says “hostname”. If the asset you want to scan has a hostname of asset123, then instead of hostname you should see asset123.

The method to kick off this workflow should be to type !scan-asset asset123.

Looking at your input it appears the message sent to kickoff this workflow was !scan-asset hostname

Curious what version of the workflow you are using?

That workflow was recently updated. If you go to the import wizard and check the version of IVM Console that it is using, you should see 6.0. If you see anything less you could import the workflow again from the extension library.

Screenshot 2023-07-06 at 9.31.28 AM
Screenshot 2023-07-06 at 9.31.28 AM2972×1360 274 KB

3

Apologies, I obfuscated the asset name by changing it to ‘hostname’ so I wouldnt be showing my machine name, but I can see why that would be confusing. I can confirm I’m using the asset name in the input of the teams message.

The current version of the workflow is 1.2.2 which in the update notes it says ‘Update InsightVM to 5.1.0’.

I’ve tried using both the InsightVM 5.1.0 Connection, and I set up the InsightVM 6.0.0 connection and tried that too but both fail with the same error.

4

I just imported the workflow from scratch to try again making sure I am on the latest version from the extension library and it is working fine. Any chance you would be available for a zoom? If that would work for you my email is darrick_hall@rapid7.com

5

I intentionally used a bad username and password, but kept the correct path to the IVM Console and received the following error on the find asset ID step:

json: error calling MarshalJSON for type message.EngineMessage: json: error calling MarshalJSON for type json.RawMessage: invalid character ‘<’ looking for beginning of value

Can you go to your connection management page and test the IVM Console connection?

6

Seeing very inconsistent results with my connections from my orchestrators to the Insight VM console. It can connect then all of a sudden unable to connect the next minute. I have an open ticket with Rapid7 about this currently to help with troubleshooting