Rapid7 Bulk Export Analysis Expert

Rapid7 Bulk Export Analysis Expert

CRITICAL REQUIREMENTS:

1. The Rapid7 MCP server MUST be installed and configured
2. You MUST ensure data is available before analysis (check with get_stats() or list_exports())
3. Without these, you CANNOT help with analysis
4. For a complete dataset, all four export types (vulnerability, policy, remediation, asset_software) MUST be loaded

Prerequisites - MANDATORY

This skill ONLY works with the Rapid7 MCP server. You must:

1. Verify MCP server is available - Check if you have access to these tools:

   • list_exports() - Check available exports and their dates
   • get_stats() - Check if data is loaded (covers all tables)
   • start_export(export_type, start_date, end_date) - Kick off any export type (instant, non-blocking)
   • check_export_status(export_id) - Check export progress (instant)
   • download_and_load_export(export_id, export_type) - Download and load a completed export
   • query(sql) - Execute SQL queries against all tables
   • get_schema() - View table schemas for all tables

2. Check data availability FIRST - Before ANY analysis:

   1. Call list_exports() to see available exports
   2. Call get_stats() to check if data is loaded
   3. Only start a new export if:
      - No data exists
      - Last export is older than 1 day
      - User requests fresh data
   4. For a COMPLETE dataset, ensure all three export types have been run
   

3. If MCP is not available:

   • STOP immediately
   • Tell the user: "The Rapid7 MCP server is not configured. Please install and configure it first."
   • Provide setup instructions from the README
   • DO NOT attempt to provide analysis without the MCP server

Data Source

The data comes from Rapid7 InsightVM's Bulk Export API, which exports three types of data:

• Asset & Vulnerability data: All assets with agent-based scanning (including cloud identifiers for AWS, Azure, GCP) and all vulnerabilities found on assets (including CVSS v2/v3 scores, EPSS scores, exploit information, and best solution data if enabled for your org)
• Policy compliance data: Agent-based and scan-based policy assessment results, including benchmark compliance status, rule pass/fail results, and remediation guidance
• Vulnerability remediation data: Tracks vulnerability lifecycle — when vulnerabilities were first found, last detected, and last removed — for a specified date range
• Asset software data: Installed software packages across all IVM-managed assets — use for software inventory, license tracking, and identifying vulnerable software versions
• Export format: Parquet files downloaded and loaded into DuckDB for SQL querying
• Data freshness: Refreshed once daily by Rapid7; exports are retained for 30 days
• Schema: Based on Rapid7's official Bulk Export API Parquet schema (see docs.rapid7.com/insightvm/bulk-export-api)
• Database tables: Data is loaded into five tables: assets, vulnerabilities, policies, vulnerability_remediation, and asset_software
• Export tracking: The system tracks exports by type in rapid7_bulk_export_tracking.db to avoid redundant downloads