Nexpose Integration with DefectDojo

Nexpose Integration with DefectDojo

Nexpose is Rapid7's vulnerability management scanner, now offered as Rapid7 InsightVM, which builds on the same Security Console and scan engines. It discovers assets on a network, fingerprints their operating systems and services, and checks them for missing patches, vulnerable software, and insecure configurations, grading each vulnerability on a 0 to 10 severity scale. Reports can be generated from the Security Console in several templates, and DefectDojo imports the XML Export 2.0 format. DefectDojo Pro adds two Rapid7 InsightVM connectors: one for an on-premises Security Console and one for InsightVM on the Rapid7 Insight cloud platform.

Nexpose Integration with DefectDojo

We scan our networks with Nexpose (now Rapid7 InsightVM) and import the XML Export 2.0 report into DefectDojo so each vulnerability becomes a Finding on the Asset that owns those systems. The parser rolls a vulnerability up across every host and port where it was found, keeps the scanner's proof text, and preserves Rapid7's references and tags. That turns a scan of several thousand hosts into a list of things to fix, each with the systems it affects, under the same SLAs as the rest of our findings. On DefectDojo Pro, the InsightVM connectors can replace the report export entirely and sync findings site by site.

Why Nexpose Matters

Most organizations still learn about missing operating system patches and exposed services from a network scanner, and Nexpose, now InsightVM, is a long-standing choice for on-premises scanning.

• It scans from inside the network, including authenticated checks, so it sees vulnerabilities that external scanners miss.
• Each vulnerability definition includes a description, solution steps, CVSS vector, and references to CVE, vendor advisories, and known exploits.
• Test results distinguish exploited, version-based, and potential findings, which helps with prioritization.
• The Security Console is built for the team running scans. Application and system owners usually need their findings in the same place as everything else they are responsible for.

Advantages of This Integration

What we gained by sending Nexpose results through DefectDojo:

• One finding per vulnerability, many endpoints. Results for the same vulnerability and severity are merged, with each affected host and port attached as an endpoint. Patching work is organized by fix, not by host.
• Deduplication across scans. Nexpose Scan findings are hashed on title, severity, vulnerability IDs, and CWE, so a monthly rescan updates existing findings rather than duplicating them.
• Lifecycle on reimport. Reimporting the next report into the same Test mitigates vulnerabilities that are no longer reported, adds new ones, and reactivates regressions.
• Rapid7 context preserved. References are formatted as links (CVE, BID, CERT, Debian, X-Force, and exploit references), and Nexpose vulnerability tags become DefectDojo tags.
• Direct sync with DefectDojo Pro. The Rapid7 InsightVM connector (on-premises Security Console) and the Rapid7 InsightVM - Cloud Instance connector create a Record for each InsightVM site and import its assets' vulnerable findings, enriched from the vulnerability catalog.
• SLAs, ownership, and ticketing. Findings carry DefectDojo severities, can be assigned to system owners, risk-accepted with an expiry, or pushed to Jira.

How This Integration Works

DefectDojo imports Nexpose results with the Nexpose Scan scan type.

1. Generate an XML Export 2.0 report. In the Security Console, open Reports and create a report (or edit an existing one), choose the XML Export 2.0 template, select the scans or sites to include, run it, and download the XML file. The parser is built for the XML Export 2.0 structure, so other report templates will not import correctly.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select Nexpose Scan, and upload the file. For automation, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Nexpose Scan" \
  -F "file=@nexpose-xml2.xml" \
  -F "product_name=corp-network" \
  -F "engagement_name=Monthly Scan" \
  -F "minimum_severity=Low" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Nexpose Scan" \
  --report-path "./nexpose-xml2.xml" \
  --product-name "corp-network" \
  --engagement-name "Monthly Scan" \
  --auto-create-context

3. Reimport each scan cycle. Send later reports for the same site to /api/v2/reimport-scan/ against the same Test so patched vulnerabilities close and the history stays in one place.

Option: Rapid7 InsightVM connector (DefectDojo Pro, on-premises). For findings from your own Security Console (API v3), configure this connector in the DefectDojo Pro UI. DefectDojo needs network access to the console, and the connector logs in with a console user account over HTTP Basic authentication.

• Location: the Security Console URL including the port, which is 3780 by default (for example https://console.example.com:3780).
• Username and Secret: the console username and password.
• Minimum Severity: optional, limits which findings are imported.

Option: Rapid7 InsightVM - Cloud Instance connector (DefectDojo Pro). For InsightVM on the Rapid7 Insight platform (Cloud Integrations API v4), use this connector instead. In the Insight platform, open the settings (gear) menu, choose API Keys, and generate an Organization Key or a User Key that belongs to a platform administrator. Copy it when shown, because it is displayed only once.

• Location: your regional API endpoint, for example https://us.api.insight.rapid7.com (replace us with your region, such as us2, eu, ca, au, or ap). The field is pre-filled with the US endpoint.
• API Key: the Insight platform key.
• Minimum Severity: optional.

With either connector, each InsightVM site becomes a Record that you map to an Asset, and the connector syncs on a schedule.

Data Granularity: What Gets Imported

Only tests with a status of vulnerable-exploited, vulnerable-version, or vulnerable-potential become vulnerability findings.

The parser also adds informational findings that are not Nexpose vulnerabilities: a Host Up finding listing every scanned node, and one Open port finding per protocol and port (for example Open port TCP/443) listing the hosts with that port open, tagged with the service name.

The table describes the XML file parser. The DefectDojo Pro connectors work per InsightVM site: they walk the site's assets and import their vulnerable findings, enriched from the console's or platform's vulnerability catalog. Both connectors import under the same Rapid7 InsightVM - Connectors Import type, so results from the on-premises and cloud connectors deduplicate together.

Use Cases

For monthly patch cycles: The infrastructure team imports each site's report after the scan window and reimports into the same Test. Each finding lists every affected host, so one ticket per fix replaces one ticket per server, and closed findings show what the patch run achieved.

For system owners: Sites that map to a business unit are imported into that unit's Asset, so owners see their own network findings next to application findings without access to the Security Console.

For exposure reviews: The Open port findings give a quick inventory of which hosts expose which services. Security teams compare them between scans to catch new listeners.

For audits: Every Nexpose finding keeps its discovery date, endpoints, SLA status, and remediation history, which makes it simpler to show that critical network vulnerabilities were fixed on time.

Operational Tips

• Decide how to handle the synthetic Info findings. Host Up and Open port entries are useful as inventory but noisy in metrics, so use minimum_severity=Low if you only want vulnerabilities.
• Expect CWE to be empty. Nexpose definitions do not populate it, so CWE contributes nothing to deduplication or reporting for this scan type.
• Only one CVE is stored per finding. For vulnerabilities that list several CVEs, check the references field for the full list.
• Keep sites and Tests aligned. Reimporting a report that covers fewer hosts than the last one will mitigate findings on the hosts that were left out.
• The finding is per vulnerability, not per host. When some hosts are patched and others are not, the finding stays open until the vulnerability disappears from every endpoint in the report.
• For the Cloud Instance connector, use an Organization Key or a platform administrator's User Key. A User Key inherits its owner's permissions, and a key from a non-administrator is rejected with a 401 error.
• Pick one path per site. File imports use the Nexpose Scan type while connectors use Rapid7 InsightVM - Connectors Import, so findings from the two paths are unlikely to deduplicate against each other.
• Tag imports with the site name and scan window (for example tags=dc-east,2026-10) for trend reporting.