Rapid7 InsightVM / Nexpose · XML Export
Rapid7 InsightVM and Nexpose reports your clients can read
Export an XML report from InsightVM or Nexpose and Varaxon Scan Hub turns it into a ranked, plain-language vulnerability report, with every finding tied to the Rapid7 test that produced it.
What Scan Hub reads from Rapid7
XML Export and XML Export 2.0.
Scan Hub reads Rapid7's NexposeReport XML in both versions. Host tests and service tests are each read as their own record.
Vulnerability definitions and CVEs.
Each test is joined to its vulnerability definition by exact ID. CVEs come only from the definition's CVE references.
Proof and fix text.
Rapid7's proof, description and solution text stay with each finding, so the report can show why it was flagged and how to fix it.
How to export from InsightVM or Nexpose
- In the Security Console, create a report for the sites or assets you want, using the XML Export 2.0 format (XML Export also works).
- Run the report and download the XML file.
- Run the free pre-flight check on the file to see what Scan Hub can read from it.
- Upload it to the client in Scan Hub and build the report.
What the report states explicitly
- Confirmed results (vulnerable-exploited and vulnerable-version) are kept apart from potential ones (vulnerable-potential).
- Rapid7 exceptions are shown as stated suppressions, not as fixed.
- Tests Rapid7 skipped or could not complete are counted as not assessed, never as clean.
Common questions
- Which Rapid7 formats work?
- The XML Export and XML Export 2.0 report formats from InsightVM or Nexpose. SimpleXML, ARF and XCCDF reports are not read.
- Is the Rapid7 risk score used?
- Rapid7's severity, PCI severity and risk score are kept as Rapid7 stated them. Scan Hub's priority puts CISA KEV vulnerabilities first, then orders the rest by EPSS and CVSS.
- Can I report on InsightVM and other scanners together?
- Yes. Scan Hub is scanner-agnostic: upload exports from different scanners to the same client and each report states which scanner and file it came from.
Guide
CVSS vs EPSS vs CISA KEVHow the three scores differ, and the order to fix things in.Read the guide