Upgrade to the Vulnerability Management SaaS Console

This guide helps you upgrade your on-premises Security Console to the Vulnerability Management (VM) SaaS Console on the Command Platform.

The upgrade moves your Security Console data to a Rapid7-managed cloud environment, reducing operational overhead so your team can focus on vulnerability management outcomes rather than infrastructure maintenance. Because the VM SaaS Console runs on cloud infrastructure, the only hardware you need to maintain are scan engines and Rapid7 Agents going forward.

Benefits of the VM SaaS Console

The VM SaaS Console helps you move quickly to identify vulnerabilities at scale, reducing your environment’s risk without manual infrastructure overhead.

• Minimal operational overhead: Rapid7 manage the Command Platform so your team doesn’t have to. With automatic updates and maintenance, you do not need to schedule patches or upgrades.
• Scalability: As your environment grows, SaaS Vulnerability Management grows with you. Use the Rapid7 Agent and scan engines to scale your coverage. Add assets and environments with support for cloud, hybrid, and distributed networks where you need them.
• Improved visibility: Gain a centralized view of your security posture with real-time dashboards, filtering, and reporting. View your asset and vulnerability data in one place.
• Streamlined remediation: Use remediation projects to track fixes to action problems as they appear. Integrate ticketing systems to ensure assignment and ownership transparency, ensuring coverage across your environment.

What’s changed

As part of the upgrade to the SaaS experience, some capabilities available for on-premises deployments are not supported or are handled differently. Understanding these differences ahead of time helps you plan your workflows effectively:

VM SaaS console retention period

This table describes the changes to retention of your data when you upgrade to the VM SaaS Console.

Architecture changes

This diagram illustrates the changes to the system architecture as you move from an on-premises Security Console to the VM SaaS Console.

Navigation changes

The VM SaaS Console is on the Command Platform, so the navigation may be unfamiliar. Review the navigation mapping  to find what you need.

Prerequisites

Prior to starting the upgrade process, you must complete steps to set your on-premises Security Console up for a successful migration. As part of the upgrade process, the Security Console validates that each prerequisite has been met before proceeding.

Disable asset version history

Asset history is not supported for the Command Platform to enable optimization of your data for active prioritization.

To disable asset version history:

1. Go to Administration > Database and select Disable Asset Version History.

2. Select Disable Asset Version History. A dialog appears asking you to type Confirm.
3. After the request has been received, Rapid7 disables asset version history. The console then restarts in maintenance mode. This may take some time.
4. After maintenance is complete, you are no longer able to see asset version history in the console.

Update your Security Console, database, and scan engines

Before upgrading, ensure your Security Console, Nexpose Consoles, and Scan Engines are running version 8.54.0 or later, and your database is running PostgreSQL 15 or later. This is to support your distributed scan engines on the Command Platform. For instructions, read Managing versions, updates, and licenses .

Update your PostgreSQL database

You must be on version 15 or higher of the PostgreSQL database to upgrade. After you switch to the VM SaaS console, Rapid7 manages future PostgreSQL updates for you. For instructions, read the PostgreSQL database migration guide .

Use Active Risk strategies

Active Risk is the only risk strategy supported for VM SaaS Console. To update your risk strategy, read the Legacy Risk Strategies End-of-Life Announcement .

Remove SSO authentication

Prior to the upgrade, you must remove any SSO authentication from the on-premises console . You can then set up SSO authentication for the Command Platform.

If you are a Nexpose-only user, your Administrator needs to create a Command Platform user . For access to the VM SaaS Console, assign users to the Scan Manager role.

Any existing users with Command Platform logins persist during the upgrade, however Administrators are asked to review these users when the upgrade is complete. Users with existing accounts approved by Administrators have 30 days to log in or their account is deactivated. See more information about Role-based Access Contro l (RBAC).

Configure network access

Before you begin the upgrade, open the necessary ports and allowlist the relevant IP addresses to ensure uninterrupted data collection.

Ports

Open the following ports to connect scan engines to the VM SaaS Console:

• Outbound (Engine pairing and API access) - 443 HTTPS
• Outbound (Scan engine) - 9000 TLS/TCP

IP addresses

Allowlist the following IP addresses for your region:

Recommendations before upgrading

Although not required for the upgrade, Rapid7 also recommends completing these actions.

Configure Command Platform API keys

Ensure Command Platform API keys are configured for your organization. These are required for credential management and scan engine communication after the upgrade.

Go to Command Platform Home > Administration > API Key Management to generate and configure keys. For more information, read Manage Platform API Keys .

Review role-based access control (RBAC)

These roles are available for the VM SaaS Console:

Site and asset group access

Other than Administrators, you must assign users access to sites and asset groups regardless of their RBAC role. Go to Administration > Console Administration > Site/Group Assignment.

To assign a user access to sites and asset groups, that user must first log in to the Command Platform and navigate to one of the VM SaaS Console pages.

SSO on the Command Platform

As part of the requirements, you must disable SSO  for the on-premises Security Console before upgrading. You can then set up SSO on the Command Platform before the upgrade process to allow users to log in faster. For access to the VM SaaS Console, assign users to the Scan Manager role. For more information, see Configure single sign-on access to the Command Platform .

Notify your team

Communicate to your team that the Security Console is unavailable during the upgrade process. Rapid7 provides an estimated time for the upgrade when the process begins.

Start the upgrade

After all prerequisites are complete, you can start the process to upgrade from your on-premises Security Console.

To begin the upgrade process:

1. Log in to your on-premises Security Console.
2. Go to Administration > Console > Upgrade to the Vulnerability Management SaaS Console.
3. Review the outlined prerequisites and select Mark as Complete for each item you complete.
4. Confirm you have completed the required tasks and select Start Upgrade.
5. Validation checks run to confirm these prerequisites have been completed successfully.
   1. If any of the prerequisite checks fail, read the error for the relevant steps, select Cancel and complete these steps before trying this process again. If a step fails that you believe is complete, contact your system administrator or contact Rapid7 Support with the subject line, “VM SaaS Migration Support”.
   2. After the checks have completed successfully, select Continue.
6. A screen appears outlining the changes to your environment after you upgrade to the VM SaaS Console. Read these carefully before checking the box to agree to the changes, then select Continue.
7. Review the information about the upgrade process and the steps following the upgrade, which is also outlined in After the upgrade section of this document. Enter CONFIRM in the text box and select Save.
8. The Security Console enters maintenance mode immediately after you select Start Upgrade. Ensure you are ready to upgrade prior to selecting this, as the Security Console is inaccessible to all users until the upgrade process is complete. A banner appears on the Command Platform to let you know the upgrade process has begun.

During the upgrade

While your on-premises Security Console is in maintenance mode, users can see who has authorized the upgrade process, as well as the date and time they started the process.

The Security Console runs two processes:

• Step 1 of 2 - Backup in Progress: A full backup of your on-premises Security Console is created. The estimated time for upgrading is calculated based on the backup size after this stage is complete. A banner is visible on the Command Platform to let you know the upgrade process has begun.
• Step 2 of 2 - Migrating Data: Your backed-up data from step 1 is migrated to the Command Platform. You will see an estimated time for this on the maintenance screen.
• To check that the upgrade process has finished, you can check the Command Platform that the banner outlining the upgrade process has been removed, and that the Launchpad now lists Vulnerability Management (SaaS).

After the upgrade

After the upgrade is complete, your data migrates to your new console on the Command Platform and your on-premises Security Console is no longer accessible. If your team needs help finding features in the new interface, review the navigation mapping .

However, you must first ensure your team can access the new console:

• From the Command Home, go to Administration > Users to review user access and RBAC assignments.
  • Ensure each user has received an activation email for their own login.
  • Assign new non-administrator users access to the appropriate sites and access groups.

Lastly, you must finish these tasks to close unnecessary ports andensure all data is accessible:

1. From a terminal or command line interface:
   1. Close the following ports (unless they are being used for another purpose):
      • TCP 40814: Inbound to the Scan Engine
      • TCP 40815: Outbound to the on-premises Security Console
   2. Allowlist the following port for server updates:
      • TCP 443 (PGP Encrypted)
2. Manually reverse pair each distributed Scan Engine.

Reverse pair a scan engine

To configure an engine-to-console pairing (also known as a reverse pair) on a Scan Engine you have already installed, you must manually add a new Security Console entry to the Scan Engine configuration and confirm the pairing with a console-generated shared secret.

To reverse pair a scan engine to the VM SaaS Console:

1. Remove and re-add the Scan Engine to the VM SaaS Console:

   1. From the Command Platform, go to Administration > Engines.
   2. Copy the Scan Engine’s current name, address, and port.
   3. Next to the Scan Engine, select Delete.
   4. Select Yes to confirm the delete.
   5. Select New Engine.
   6. Paste the Scan Engine name, address, and port.
   7. Select Save.

2. Open the Scan Engine command screen:

   1. Linux Scan Engine: Connect using SSH and run screen -r
   2. Windows Scan Engine: Access the host directly or through RDP. Stop the Scan Engine service, then restart it in interactive mode from the Scan Engine service applet.

3. Connect the Scan Engine:

   1. Generate  an organization API key or user API key on the Command Platform. Copy the key.

   2. On the Scan Engine command screen, run register platform api-key

   3. Paste the key and enter the code for your data storage region:

      Data storage region	Region code	Scan Manager endpoint
      United States – 1	us1	us.engine.scan-manager.insight.rapid7.com
      United States – 2	us2	us2.engine.scan-manager.insight.rapid7.com
      United States – 3	us3	us3.engine.scan-manager.insight.rapid7.com
      Europe	eu	eu.engine.scan-manager.insight.rapid7.com
      Japan	ap	ap.engine.scan-manager.insight.rapid7.com
      Canada	ca	ca.engine.scan-manager.insight.rapid7.com
      Australia	au	au.engine.scan-manager.insight.rapid7.com
      India (Hyderabad)	aps2	aps2.engine.scan-manager.insight.rapid7.com
      Middle East (UAE)	me1	me1.engine.scan-manager.insight.rapid7.com

4. Add the SaaS Console: add console vulnerabilitymanagement

1. Display all consoles: show consoles
2. Copy the SaaS Console ID and initiate the connection: connect to console <saas-console-id>
3. Generate and add a shared secret:
   1. Return to the Command Platform, and go to Administration > Engines.
   2. In the Generate Scan Engine Shared Secret section, select Generate and copy the secret.
   3. Return to the Scan Engine command screen and run: add shared secret <saas-console-id>
   4. Paste the secret.
   5. Enable the connection: enable console <saas-console-id>
4. Verify the connection:
   1. Return to the Command Platform, and go to Administration > Engines to confirm that the Scan Engine is connected.
   2. Run a test scan.
   3. Confirm the Scan Engine is functioning correctly.
5. Repeat these steps for each distributed Scan Engine.

Support

As the VM SaaS Console is being improved incrementally, Rapid7 appreciates your continued partnership and collaboration in shaping the future of our Command Platform.

For issues or questions, contact Rapid7 Support, using the subject VM SaaS Migration Support.