Intergrate InsightVM with Insight Agent
The Insight Agent gives you endpoint visibility and detection by collecting live system information—including basic asset identification information, running processes, and logs—from your assets. The Agent then sends this data back to the Insight platform for analysis. As an InsightVM user you can force the Insight Agent to be immediately assessed and integrated into InsightVM. The Insight Agent checks in with the Insight Platform every 6 hours by default. If you do not want to wait for the next scheduled check-in and would prefer to check-in instantly, perform the following steps for any Windows, Mac or Linux asset:
- Local administrative access to the Insight Agent asset.
- Administrative access to the InsightVM Security Console.
Insight Agent Immediate Check-in
- Stop the Insight Agent service.
- Remove the
<install_dir>/config/agent.jobs.tem_realtime.json & <install_dir>/snapshotsdirectories.
- Start the Insight Agent service. You will need the Security Console to pull down the Agent assessment from the Insight Platform.
- Log into the Security Console as an admin.
- Navigate to the Administration page.
- Select Run Security Console Commands .
- Execute the command "import agent-assets".
- In the nsc.log file located at
<install_dir>/rapid7/nexpose/nsc/logs/nsc.log, search for the Agent ID of the asset to confirm that it is being integrated into your database.