This Rapid7® ControlsInsight® 2.1 release includes new trending and reporting features that enable organizations to demonstrate progress in reducing risk.
Trending for grades and controls
Find out at a quick glance how your deployment of controls is improving your security posture over time. As soon as you log onto ControlsInsight, you see a chart in the Threats panel that tracks your assets and defense grades over time.
The grade trending chart features several ways to isolate the trending information that is critical to you:
- You can select a date range for the displayed trend.
- You can select different time intervals for the data points. This is useful if you want, for example, to track changes between scheduled scans, on a quarterly basis, or a year-to-date basis.
- By hovering over a data point with your cursor, you can view the specific grade and number of covered assets for a given date.
- By moving the slider handles at the bottom of the chart, you can expand, minimize, or change the view of specific data points.
You can also view trends for individual controls. When you select any control, you see a chart that tracks deployment coverage for all relevant assets. Each data point shows the ratio of covered assets to total assets relevant to that control. This helps you identify gaps in your coverage quickly. The control trending chart features the same customization features that are available in the grade trending chart.
New trending data in the API
You can also track grade, control, and asset trends with the ControlsInsight API, which enables you to integrate trending information with third-party tools.
New CSV export of asset data
Dig deeper into your deployment of controls across assets with the new CSV export feature. You can now generate comma-separate-value (CSV) files that list each asset and indicate whether each control has been deployed or not deployed on it. The file also includes the risk score and other metadata about the asset. Use this feature to analyze asset data from a different perspective, correlating pieces of information to provide a deeper understanding of security issues. For example, by identifying assets that do not have an updated version of Internet Explorer and do not have the EMET toolkit installed, you can determine which assets are more susceptible to attacks with a malware kit that targets Explorer.
Generating CSV export is easy. Just click the CSV icon wherever Assets are listed in the Web interface.
You can now reassess your controls deployment after applying changes on the Asset Sources page in the Management panel. Previously, you were required to run a scan in Nexpose in order to generate a new assessment based on newly selected or deselected sites. With this improvement, a new assessment is automatically triggered when you save changes to the Asset Sources page.