Insight Agent requirements - an overview

Operating Systems

The Insight Agent is supported on Microsoft Windows, macOS, and various Linux distributions. This page defines what official support means for the functions of the Insight Agent software and details the support schedules for specific operating system (OS) versions.

How OS supportability affects agent functionality

The Insight Agent software receives regular updates (including new features, improvements, and defect fixes) designed to maintain agent performance for all supported OS versions. Running the agent on a supported version ensures that the agent software continues to receive these updates. Rapid7’s Customer Support team can also assist with any questions and troubleshoot any issues that arise with agents installed on supported OS versions.

Insight Agents installed on unsupported OS versions will continue to perform their usual tasks, but will not receive any software updates. Customer Support is unable to help install agents on unsupported OS versions, nor can they troubleshoot any issues that arise with agents installed on those versions. Additionally, the Insight Agent will not collect any new data for the InsightVM vulnerability content. However, due to the large amount of data the Insight Agent already collects, InsightVM itself will continue to detect vulnerabilities on the old content as well as the majority of new vulnerability content.

Supported OS versions

Refer to these tables to view the OS versions that the Insight Agent currently supports and the End-Of-Life (EOL) schedule for each.

How to run the Insight Agent on an unsupported OS

If your organization has assets that run a version of an OS that is outside of what the Insight Agent currently supports, you can install an older, compatible version of the agent to maintain coverage. Check the unsupported OS versions table to determine the Insight Agent version range that applies to your assets, then refer to the Insight Agent Version History table to download legacy installers if they are available.

Unsupported OS versions

These tables contain the OS versions that the Insight Agent no longer supports.

FAQs

Network traffic and connectivity

In order for the Insight Agent to successfully transmit data between the asset on which it is installed and the Insight Platform, your network must allow communication with a variety of endpoints through specific network ports based on the Rapid7 data storage region to which your organization is subscribed. Additionally, your network must allow agent-related data in transit to reach the Insight Platform without undergoing decryption or any other process that modifies the data from the format Rapid7 services are expecting.

This article covers all network traffic and connectivity requirements you need to be aware of, along with other common network scenarios that could impact the functionality of your agent deployment.

Insight Agent data must be excluded from SSL decryption

If your network decrypts traffic in transit to perform deep packet inspection (DPI) using a transparent proxy, Insight Agent-related data must be excluded from this process.

The Insight Platform will only accept data transmitted by an Insight Agent if the data is accompanied by the X.509 certificate that the Insight Platform is expecting. DPI technologies often replace this certificate with their own as a final step before allowing traffic to continue to its destination. Without the original certificate, the Insight Platform will not accept the data.

Network traffic allowance requirements by region

The assets on which the Insight Agent is installed (or the proxy you configure to receive all agent-related traffic) must be able to communicate with several Insight Platform endpoints for the agent to function properly and power your Insight products. Consult the following data region tables for a breakdown on what endpoints need to be reachable.

If you deploy a network traffic filtering solution that supports wildcards, each table indicates an optional wildcard endpoint that can accommodate multiple endpoint traffic allowances if you want to simplify your configuration.

Port requirements for assets when using Rapid7 Collectors as proxies

If you use the Rapid7 Collector as a proxy destination for Insight Agent traffic, your assets must also be allowed to communicate with your Collector host through these ports:

• 5508 - Used for agent messages and beacons.
• 6608 - Used for agent update requests and file uploads for collection.
• 8037 - Used for agent messages and beacons.

Endpoint protection software exclusion

Endpoint Protection Software is an umbrella of applications that can be deployed on endpoint devices to detect and block malicious activity from both trusted and untrusted applications.

Endpoint security applications (such as McAfee Threat Intelligence Exchange, CylancePROTECT, Carbon Black, and others) may flag, block, or delete the Insight Agent from your assets depending on your detection and response settings. To prevent this and ensure the successful operation of the Insight Agent, you have to allowlist the Agent in the Endpoint Protection Platform you have deployed in your environment.

Allowlist the Insight Agent within your Endpoint Protection Software

To allowlist the Insight Agent, navigate to your Endpoint Protection Platform and set up a path exclusion rule for the agent directory.

Your rule must accommodate all subdirectories contained in the agent installation path. The following paths show default agent installation locations by operating system:

• Windows - C:\Program Files\Rapid7\Insight Agent\
• Mac and Linux - /opt/rapid7/ir_agent/

InsightIDR asset quarantine

The Insight Agent allows you to quarantine an asset in InsightIDR until you are able to resolve the investigation. This isolates the asset from all other network connections, except for connections to the Insight Platform and trusted services, such as DHCP. To ensure your quarantine actions are successful, you must properly configure your operating systems:

• Linux/Unix Operating Systems
• Windows Operating Systems

Linux/Unix Operating Systems

For Linux/Unix systems, you must enable iptables.

Windows Operating Systems

The Insight Agent uses the operating system’s local firewall service for the quarantine actions. To ensure that Insight Agent quarantine actions run successfully for Windows assets, the Insight Agent must be able to use the Windows Firewall service. Review the Firewall Group Policy settings for your organization to verify that you do not have the Windows Firewall service disabled. If you do have the Windows Firewall service disabled, you will need to set it to either Not Configured or On to be able to quarantine an asset with the Insight Agent.

Group Policy Management of Windows Firewall

Windows Firewall Service must be enabled and properly configured to ensure that the Insight Agent quarantine actions run successfully. If you have not previously configured Windows Firewall group policy for your domain, the quarantine will succeed. However, if your Windows Firewall Domain Policy is configured to turn the service off, the Agent quarantine will fail. To verify your Group Policy Management settings for Windows Firewall and Windows Defender Firewall, follow the instructions below.

Group Policy Management of Windows Firewall with Advanced Security

Verify your group policy settings for Windows Firewall follow the requirements mentioned above. Use the tool you normally use to manage your global group policies to verify these settings.

1. Open the Group Policy Management tool. Find the policy that you use to apply settings for the Windows Firewall service in your organization and edit the policy.
2. Click Computer Configuration > Windows Settings > Security Settings > Windows Firewall with Advanced Security Settings folder > Windows Firewall with Advanced Security Settings.
3. Click Windows Firewall Properties.
4. Verify that the Firewall state is set to Not Configured or On for each profile: Domain/Private/Public/Standard.
5. Under Settings, click Customize.
6. Verify that "Apply local firewall rules" is set to Not Configured or Yes.
   • Click Ok.
7. Click Apply.

Group Policy Management of Windows Defender Firewall

Verify your group policy settings for Windows Defender Firewall follow the requirements mentioned above. Ensure that all profiles are set to either Not Configured or Enabled.

1. Open the Group Policy Management console.
2. Click Policies > Administrative Templates > Network > Network Connections > Windows (Defender) Firewall > Domain/Private/Public/Standard Profile.
3. Click Windows Firewall: Protect all network connections.
4. Ensure that either Not Configured or Enabled are selected.