Quick Start Guide

Before installing anything, it’s important to familiarize yourself with the various concepts and components that make up Surface Command:

• Connector - A software component that enables Surface Command to collect data from an information source, such as vulnerability scanners, endpoint protection platforms, or cloud services. Each connector understands the API and data schema of its target source. Surface Command provides connectors for most major tools and supports custom connectors for enterprise-specific systems. Learn more about Connectors.
  • Orchestrator - A software component deployed in your environment when Surface Command cannot access an information source directly. Orchestrators collect data from internal or private cloud sources and can also execute actions. After deployment, orchestrators are paired to Surface Command, and one or more connectors are assigned to them.
  • Profile - A configuration that contains credentials and import feeds for a specific connector.
  • Import Feed - A scheduled task that runs a specific data ingestion job. A connector may have multiple associated import feeds.
• Attack Surface - Divided into internal and external components. The internal surface includes assets and identities. The external surface includes IPs, domains, certificates, and services exposed to the internet. Surface Command discovers external assets using domain and IP seeds. Learn more about your Surface Command attack surface.
  • Asset - Any network-connected device, such as a server, workstation, mobile device, or printer. Assets are created automatically when data is ingested from connectors.
  • Identity - A user-based entity like a username, service account, or shared mailbox. Identities can be human or non-human.
  • Seed - A discoverable domain, subdomain, CIDR, or IP used in external asset discovery to uncover certificates, services, and subdomains.
  • Type - * A schema that defines how data is structured for a specific kind of asset or identity. Each connector introduces its own types, which Surface Command maps into standardized unified types (for example, Server, Identity, or Vulnerability). These unified types allow for cross-source correlation and query filtering. Explore unified properties.
• Query - A request written in Cypher or built using the graphical interface to retrieve data ingested by connectors. Queries cannot modify data but can be customized to extract specific insights. Prebuilt queries are available, and you can also create your own. Learn more about Queries.
  • Reference list - External data imported using Excel or CSV files that augments connector data. Use reference lists to enrich queries (for example, to correlate network zones with business units).
• Dashboard - A customizable interface that displays key metrics and insights using widgets. Dashboards help you monitor your security posture visually. Learn more about Dashboards.
  • Widget - A visual component that displays filtered results from a query using charts or graphs. Widgets can be customized to show counts, trends, or metrics. The default widgets on the Surface Command home page provide asset counts by unified type and are not editable.
• Workflow - A repeatable software process that executes steps based on query results. Workflows can be triggered automatically or manually to drive consistent response actions. Learn more about Workflows.
  • Function - A reusable unit of code that interacts with remote systems to retrieve data or take action. Functions serve as the building blocks of workflows and are typically included with connector packages.

Several Rapid7 solutions are packaged with Exposure Command in addition to Surface Command. For more information, review the various solution-oriented documentation:

• InsightCloudSec 
• InsightIDR 
• InsightVM 
• InsightConnect 
• Command Platform 

You may not need to install an orchestrator, as it is only required in situations where a portion of your network is unavailable to Surface Command over the internet, such as when you have an on-prem system that you want to connect (for example, on-prem Active Directory, BigFix).

Version requirements

The minimum version of the Insight Orchestrator required to support Surface Command connectors is v1.64.0.

Operating environment

The Insight Orchestrator runs as a virtualized machine on the following virtualization platforms:

• VirtualBox
• VMWare
• AWS (conversion to AMI needed)

Required production hardware

The orchestrator requires the following resources:

• 4-core CPU
• 8GB+ available RAM
• 64-128GB available storage

Network connectivity requirements

Ensure that the following domains and ports are accessible to the orchestrator:

• {region}.api.connect.insight.rapid7.com
  • Replace the {region} section with the code for your area: us,us2,us3, eu, ap, ca, or au
• {region}.plugins.connect.insight.rapid7.com
  • Replace the {region} section with the code for your area: us,us2,us3, eu, ap, ca, or au
• Port 443 / TCP for HTTPS egress
• mirrors.fedoraproject.org (EPEL packages)
• download.docker.com(Docker packages)
• packagecloud.io (For nightly updates to the orchestrator)

If XFS is your current filesystem, the ftype setting must be correct for Docker. To check that you have this setting, run xfs_info / | grep ftype=1 | wc -l in a terminal window. The command should return 1. If it doesn’t, your XFS filesystem is not compatible with our Docker installation.

When using the script installer with a RHEL 7 or 8 image, ensure SELinux is disabled or set to permissive mode.

Software requirements

In order for Surface Command connectors to run using an Insight Orchestrator, Docker Community Edition (CE)  is required for all supported operating systems. The virtual appliance will ensure Docker CE is already installed while the install script will ensure the necessary Yum or Apt repo is added and that Docker is installed for Ubuntu version 20.04 or 22.04 and RHEL version 7 or 8.

The Rapid7 Command Platform is your base within the ecosystem of Rapid7 cloud products and services. It provides a centralized location for administrative functions and makes navigating the Insight product suite simple. To log in to the platform, you need a Rapid7 Command Platform account.

To create an account:

1. Check your corporate email inbox for an email from the Rapid7 Command Platform team.
2. Visit insight.rapid7.com/login.
3. Select Haven’t activated your account?.
4. Enter your corporate email address to receive an activation email with next steps. If you do not receive an activation email, reach out to your Customer Adoption Manager (CAM) or Customer Success Advisor (CSA).
5. Refer to the activation email and follow the instructions to create and activate your Command Platform account

Surface Command offers many different Connectors, all of which are outlined on the Connector Library page. Rapid7 has organized Connectors into 5 categories to simplify the process of ensuring you have coverage across your entire Attack Surface. We recommend installing at least 1 Connector from each category:

When Surface Command is provisioned, your desired Connectors, including Rapid7 Connectors (and orchestator, if applicable), are installed automatically by the Rapid7 deployment team. This means if you have any existing Rapid7 solutions, their data should appear in Surface Command with no additional configuration on your part. For additional Connector installations or help with Connectors, contact Support through the customer portal .

After you’ve confirmed that Connectors have been installed, you need to provide credentials in Surface Command and update any necessary settings. You may also want to verify your Import Feeds are scheduled to ensure data is coming properly.

Add Connector Credentials

For detailed information on interacting with Connectors, visit Connectors.

To add Connector credentials and update settings:

1. Log in to the Command Platform.
2. Navigate to Surface Command > Connectors.
3. Search for a Connector, then click its corresponding card.
4. Click Settings.

All configured profiles for the Connector appear. Click a profile to expand the configuration details.

Verify Import Feeds

To verify Import Feeds:

1. Log in to the Command Platform.
2. Navigate to Surface Command > Import Feeds.
3. Search for a Connector.

The Import Feeds results are filtered for the search string. Click Edit to adjust the schedule or Connector settings for the given profile.

Rapid7 External Attack Surface helps you achieve better visibility of your externally accessible assets by scanning your complete connected attack surface.

How it works:

• First, you add seeds, which are domains, CIDRs, and IP addresses (or ranges) that you know are externally accessible.
• After seeds are added, Rapid7’s External Asset Engine will use a combination of non-invasive methods to discover and crawl the external surface of your organization and report discoveries and analysis.

To add seeds:

1. Log in to the Command Platform and navigate to Command Platform Home.
   1. If your company has multiple Rapid7 Organizations, for example for multiple divisions or locations, ensure you select the correct Organization by using the drop-down next to the Rapid7 logo. This will help keep your external attack surface findings appropriate for the given organization. If you only have one Organization, you can skip this step.
2. In the navigation menu, click Attack Surface > External Attack Surface > Seeds. On the Seeds tab, you will see a brief introduction if you have never added seeds before or a list of existing seeds.
3. Click Add Seeds. A window containing a free text field opens.
4. Enter seeds (separated by spaces, commas, or line breaks) into the text field.
5. Click Add Seeds. Rapid7’s External Asset Engine begins scanning your seeds immediately, and you will see discoveries populate the IPs & Domains and Network Services & Certificates tabs as appropriate.

To start seeing your cloud data integrated with Exposure Command, you’ll need to set up InsightCloudSec. Follow the Getting Started Overview  and then return to the Exposure Command Quick Start Guide.

To start seeing your on-prem data and detailed vulnerabilities integrated with Exposure Command, you’ll need to set up InsightVM. Follow the Quick Start Guide  and then return to the Exposure Command Quick Start Guide.

To start building automated workflows to handle security operations tasks, you’ll need to set up InsightConnect. Follow the Quick Start Guide  and then return to the Exposure Command Quick Start Guide.

To access the Surface Command home page, log in to the Command Platform and click Surface Command from the Solutions list. The home page offers a quick glance at the total number of assets by type as well as recommended dashboards and queries that are relevant to your data. Click 1 of the asset widgets to open the Workspace filtered to the selected asset type. From the Workspace, you can create:

• Queries
• Widgets
• Dashboards

These 3 Surface Command components are the building blocks you can use to quickly and effectively understand your Attack Surface. The following sections contain examples for getting a dashboard set up to track admin users without multi-factor authentication turned on.