How can I get actual host names or IPs for Rapid7 Nexpose data in Splunk?

[dshpritz]

The Nexpose app uses the API to get data into Splunk. The problem is that the vulnerability events don't have actual host names or IPs in them, instead they have a list of the IDs of the hosts. As that ID is not referenced anywhere else in Splunk (for example, in a lookup file), the vulnerability events are almost useless. Is there a way to get the actual hostnames or IP addresses of the hosts?

Thanks.

[mln21]

Hi dshpritz and thanks for your question. I work on the technical alliances team at Rapid7. Our current plan is to incorporate this feature into a future release of the Rapid7 Nexpose for Splunk App. To do this we are planning leveraging the Common Information Model. In addition to the asset names or the IP addresses, what other kinds of information would you find useful? We would love to hear feedback on the app and ways to make it better.

Thanks,
Martin

[stinnett]

Hi Martin,

Is there any eta for this release?

Thanks,

Jon