<style>p { margin: 0; }span.fr-emoticon.fr-emoticon-img { background-repeat: no-repeat !important; font-size: inherit; height: 1em; width: 1em; min-height: 20px; min-width: 20px; display: inline-block; margin: -0.1em 0.1em 0.1em; line-height: 1; vertical-align: middle; } span.fr-emoticon { font-weight: normal; font-family: "Apple Color Emoji", "Segoe UI Emoji", "NotoColorEmoji", "Segoe UI Symbol", "Android Emoji", "EmojiSymbols"; display: inline; line-height: 0; } blockquote { border-left: solid 2px #5e35b1; color: #5e35b1; margin-left:0; padding-left:5px;}blockquote blockquote{ border-color: #00bcd4; color: #00bcd4;}blockquote blockquote blockquote{ border-color: #43a047; color: #43a047;} table.grid{ border-collapse: collapse;} table.grid td, table.grid th { border: 1px solid #ddd;} .fr-fic.fr-dib{ display: block; margin: 5px auto;}.fr-fic.fr-dib.fr-fir{ text-align: right; margin: 5px 0 5px auto;}.fr-fic.fr-dib.fr-fil{ text-align: left; margin: 5px auto 5px 0;}.fr-fic.fr-dii{ float: none; margin: 5px auto;}.fr-fic.fr-dii.fr-fil{ float: left; margin: 5px auto;}.fr-fic.fr-dii.fr-fir{ float: right; margin: 5px auto;}img.fr-dib.fr-fir { margin-right: 0; text-align: right;}img.fr-dib.fr-fil { margin-left: 0; text-align: left;}img.fr-dib { margin: 5px auto; display: block; float: none;}img.fr-bordered { box-sizing: content-box; border: solid 5px #CCC;}img.fr-shadow { box-shadow: 10px 10px 5px 0px #cccccc;}img.fr-rounded { border-radius: 10px; -moz-border-radius: 10px; -webkit-border-radius: 10px; -moz-background-clip: padding; -webkit-background-clip: padding-box; background-clip: padding-box;}</style><p><strong>In this guide we will cover:</strong></p><p><strong>- What is the Rapid7 Integration?</strong></p><p><strong>- Enabling the Rapid7 Module</strong></p><p><strong>- Connecting to Rapid7</strong></p><p><strong>- Runbooks from Rapid7</strong></p><p><br></p><p><br></p><p><strong><span style="font-size: 14pt;">What is the Rapid7 Integration?</span></strong></p><p>The Rapid7 integration is runbook-based and can be used for Ticket creation and alert management.</p><p><br></p><p><strong><span style="font-size: 14pt;">Enabling the Rapid7 Module</span></strong></p><p>In Configuration > Integrations > Asset Management and Alerting, you will find the Rapid7 module. Hover over this and press the plus (+) in the corner to enable it. It will then show a cross (X) when enabled.</p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjZhYzA3ZWM2LTdkNjAtNDU4MC1iMTI0LTU2ZWQyNzFmMmY5MiJ9.KO6ljvwfw48PcaDituQhtJr1ezkk0uVfBOcs5d62e6A" class="fr-fic fr-fil fr-dib" width="344" height="156"></p><p><strong><span style="font-size: 10pt;">Fig 1. Enabled Rapid7 module.</span></strong></p><p><br></p><p>Upon enabling the module, the relevant runbooks will be added to your instance. These can be quickly accessed by the three buttons within the module, or within the list in Configuration > Integrations > Custom Integrations > Integration Runbooks.</p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjIwZjM3NjRlLTFjM2QtNDFlOS04MGZmLWVhMzE2YzZmNDc1YyJ9.WWh6K9OMod12HjjLB7Maote5kZtEIt101Xyk_0TE4ss" class="fr-fic fr-fil fr-dib" width="903" style="width: 905px; height: 136.661px;" height="137"></p><p><strong><span style="font-size: 10pt;">Fig 2. Rapid7 runbook buttons.</span></strong></p><p><br></p><p><strong><span style="font-size: 14pt;">Connecting to Rapid7</span></strong></p><p>To connect, enter your URL and an API Key generated from Rapid7 in the provided fields.</p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJmMGVmYjE1LTljZmYtNDNmZS05NDVmLTM1YWY3Nzc1ODAxOSJ9.QOzMD9P0-r0qJs3SXF5MHBdpwIWWxKj2zuqavcr-bgc" class="fr-fic fr-fil fr-dib" width="1219" style="width: 1221px; height: 109.503px;" height="110"></p><p><strong><span style="font-size: 10pt;">Fig 3. Connecting to Rapid7.</span></strong></p><p><br></p><p><strong><span style="font-size: 14pt;">Runbooks for Rapid7</span></strong></p><p data-pasted="true">Webhooks will need to be set up in Rapid7 to trigger the runbooks when an investigation is created.</p><p><br></p><p>Upon enabling the module, three runbooks and a system method will be downloaded.</p><p><br></p><ul><li><strong>Rapid7 Investigation Creation: </strong>Creates a ticket when an investigation is opened in Rapid7.</li><li><strong>Rapid7 Alerts Creation: </strong>Obtains any new alerts and adds them to the ticket on a schedule.</li><li><strong>Rapid7 Investigation Close:</strong> Closes the investigation in Rapid7. Triggered from a workflow or action on a ticket. </li></ul><p><br></p><p>The method uses the URL and API key entered in <strong>Fig 3</strong> to authorise.</p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImNlYTZhZjY4LWNhZDMtNDM0Ni1hY2ViLTdmMGNmNjRlMjA4NyJ9.gzZa3JmstUbpcr-l4lihnPcvOIdBKrIcP32-CYR1SHc" class="fr-fic fr-fil fr-dib" width="1212" style="width: 1214px; height: 315.78px;" height="316"></p><p><strong><span style="font-size: 10pt;">Fig 4. Rapid7 system method.</span></strong></p><p><br></p><p>Within each runbook, there will be "placeholder" values that can be changed to edit the behaviour of the integration. For example, in the "Rapid7 Investigation Creation" runbook, you may want to customise what ticket type is logged from it by changing the ID here in the "Add/Update Ticket" step.</p><p><br></p><p>You could also do the same within the "Create Action" step to customise how the automatic action appears on the ticket, i.e. whether it shows to the end-user.</p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImYxODJhMzNiLTNhNzEtNDc4ZC1hOWFjLTQxMTA2ZDU0ZjhhMCJ9.9RpRfI0b6n1M4gP42xN678JC6FNXrK9obrS1f22VkZU" class="fr-fic fr-fil fr-dib" width="1215" style="width: 1217px; height: 579.248px;" height="579"></p><p><strong><span style="font-size: 10pt;">Fig 5. Customising the runbook.</span></strong></p><p><br></p><p>Whilst the ticket creation and alert updates are triggered from Rapid7, the closure is triggered from within Halo. This can be done via an action or a workflow.</p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6Ijc3MWM5ODgzLTA2MDUtNGFkZi04YzcxLTkwMTRjZjc0ODJlZSJ9.owrbkvnEq1w-cUTDt9z9ErMku3m1Q-Up0YShiWsXawQ" class="fr-fic fr-fil fr-dib" width="362" height="325"></p><p><strong><span style="font-size: 10pt;">Fig 6. Action to trigger the runbook closure.</span></strong></p>
