You modify the nexpose_reports.py file and change the allSites variable from: allSites = nexposeClient.site_id_listing() To: allSites = [1,17,123,99] The IDs are those of the corresponding sites within Nexpose and can be found in the site URL e.g. https://<$NEXPOSE_CONSOLE>/site.jsp?siteid=17. You just take however many site IDs you want data to be collected on and add them to the script. The next time the application collects data it will be limited to those specific sites. Another way of doing this is modifying the configured Nexpose user that the application uses to login to the Nexpose console and limit the user's access to only the sites you want data retrieved for. This will require no change to the Splunk application and will achieve the same goal. ... View more

The application does not define a new index for Rapid7 data – this option is left to the user. It uses the ‘default’ index out of the box but most users change this after installation. In terms of placement inside your environment you can install it on a single node or both. The application pulls pre-processed data from your Nexpose Console so load on your Splunk node is minimal (meaning installation on the search head alone should be fine). If you don’t like the idea of your search head pulling and indexing data then you can install a copy of the application on the indexer and configure it to pull data from your Nexpose Console. A copy of the application can then be installed on the search head to just view the indexed data (obviously both will have to be configured to use the new index you are considering setting up). ... View more

Hello, Please contact Rapid7 Integrations Support at integrations_support[at]rapid7[dot]com and a representative from support will assist you in resolving this issue. ... View more