Deprecation of Integrated Vulnerability Remediation Version 2 and 3

Release Announcements CyberFOCUS (Release Announcements)
1

With the release of IVR 4.4, all supported Vulnerability Managers work on the updated IVR 4 architecture. Because of this, the BigFix team has decided to deprecate BigFix Insights for Vulnerability Remediation (IVR) version 2 and 3 on the following dates:

  • IVR 2: deprecated December 15, 2026
  • IVR 3: deprecated March 31, 2027

After these dates, IVR 2 and 3 will no longer receive updates, fixes, or support; IVR 4 replaces both.

With IVR 4.4, Rapid7 moved to IVR 4, the last data source that required IVR 3 in use. IVR 4 now supports Tenable Vulnerability Management, Tenable Security Center, Qualys, Rapid7, CrowdStrike, and Universal Vulnerability Ingestion (UVI), so you no longer need IVR 3 regardless of your Vulnerability Management tool.

How to upgrade:

IVR 4 is a new installation, so you will not be able to upgrade IVR 2 or 3 in place. First run the "Uninstall BigFix Insights for Vulnerability Remediation" task to remove IVR 2 or 3. Then download and register the BigFix IVR Retriever v4.4.0. When you download it, choose the vulnerability management platform you use. The steps are in IVR4 Fixlets and Tasks. Setup and requirements are in the IVR v.4 documentation.

If you have any questions, comments, or feedback please don’t hesitate to let us know. If you need help planning the move, open a support ticket or reach out to your BigFix team. We appreciate your understanding.

Thanks,

Jordan Warsoff, HCL BigFix Product Management

2 Likes
2

I'm a bit confused by the IVR versions and what we have.

We use Rapid7 InsightVM, and have it linked with our BigFix Insights server and the webUI, so we can see vulnerabilities in the webUI by going to Apps -> IVR, and we have an ETL running daily.

However, we don't have any devices relevant for the "Uninstall BigFix Insights for Vulnerability Remediation" fixlet, so I guess we weren't using IVR 2 or 3, but some other IVR? Our webUI currently has IVR v23 and Insights v33.

Should we just attempt to download and register the BigFix IVR Retriever v4.4.0? Am I mixing up two different IVR acronyms? Thanks

3

You are likely on IVR v3 (the WebUI site is probably that v23 and v33 that you see reported). Rapid7 on IVR v4 just became GA 10 days ago. In order to get IVR v4 you will have to do a new installation. The uninstall shouldn't require any devices but this might be worth opening a support ticket to ensure that the uninstall Fixlet is properly configured. Thanks for your patience and understanding!

4

Hm, thank you. The relevance for the uninstall fixlet is just

windows of operating system

version of client >= "9.5" as version

exists service "BFIVR"

so I wasn't sure how how we were using IVR in the webUI without a BFIVR service running on any of our servers. I'll reach out to support and check with them. Thanks