McAfee ePO integration

The McAfee ePO integration endpoint detection and response (EDR) capability that helps Security Operations Center (SOC) analysts identify cyberthreats and repair the damage caused by malicious files.

Overview of McAfee ePO integration

There are two sets of McAfee ePO capabilities used in this integration, the capabilities that invoke actions, such as isolating a host and initiating a malware scan, and the capabilities that run queries to gather system details and threat events. Both types of capabilities, the actions and the queries, are invoked from your ServiceNow AI Platform® instance. You can group these capabilities together so that they automatically run when a specific type of security event occurs, or, you can invoke them manually from a ServiceNow AI Platform® security incident.

The following McAfee ePO capabilities are available for this integration.

• Get system details

  Gather system details that include operating system details.

• Initiate malware scan

  Based on scan configuration and scheduling, initiate a scan of an impacted endpoint.

• Isolate/Unisolate host

  Remove a system from network access for investigation and restore access to the network.

• List threat events

  Gather compliance status and the most current threat events.

Key features

This integration includes the following key features.

• Supports automated triggering of McAfee ePO queries that are based on incident conditions.
• Supports launching McAfee ePO capabilities manually from ServiceNow AI Platform® Security Incident Response (SIR) security incidents that perform on-demand actions.
• The flexibility to create multiple profiles for triggering different types of McAfee ePO and ServiceNow AI Platform® Security Operations capabilities. These profiles gather threat event information or perform actions based on the conditions of specific incident categories such as malware.
• Validate your profile configuration with a preview of the McAfee ePO results on SIR security incidents.
• If tagging is enabled, security tags identify which McAfee ePO capabilities are initially launched by a workflow and when the queries or actions are successfully completed.
• A complete audit trail of the McAfee ePO queries and actions is posted in the work notes on SIR security incidents, and commands from the ServiceNow AI Platform® are logged in the McAfee ePO console.
• Supports multiple McAfee ePO consoles.

ServiceNow Plugins

The com.snc.si_dep plugin is required. This plugin automatically installs all the dependencies that are required to support the Security Incident Response product. Install and activate this plugin before installing and activating the other Security Operations applications.

The following Security Operations applications must be installed and activated from the ServiceNow Store. Install and then activate one application at a time in the order listed below to ensure a smooth installation:

1. Security Integration Framework
2. Security Support Common
3. Security Support Orchestration
4. Security Incident Response
5. Security Incident Response Workspace

For more information on setting up your ServiceNow AI Platform instance for the integration, see Set up your ServiceNow AI Platform instance for the McAfee ePO integration.

The ServiceNow extension plugin

The ServiceNow Security Operations Extension for McAfee ePO℠ extension plugin is required for this integration. You install this ServiceNow plugin in your McAfee ePO console. For more information, see Set up your ServiceNow AI Platform instance for the McAfee ePO integration.

MID Server

This integration requires an installed and configured MID Server in your ServiceNow AI Platform® instance to connect to the McAfee ePO server (console). See the ServiceNow Product Documentation website for more information about MID Servers.

Supported versions of McAfee

The integration supports version 5.9.1 & 5.10 of McAfee ePO. It supports McAfee Agent: MA 5.5.1.388 For more information about McAfee products and the ePolicy Orchestrator, see the McAfee product website.

The integration supports the version 10.5 of the McAfee Endpoint Security Threat Prevention product. If you are not running version 10.5, consult with your McAfee ePO administrator to see if your version can support on-demand scans via tag actions.

McAfee ePO security tags are used in this integration. You are required to create these tags in your McAfee ePO console. For more information on these tags, see Set up your McAfee ePO console to integrate with Security Incident Response (SIR).

References

For a checklist to track your progress with setting up, installing, and verifying results for the integration, see Checklist for the McAfee ePO integration.

For a smooth installation of the application and to help you verify expected results, follow the topics in the order they are presented.

1. Integration architecture for McAfee ePO
   The following topic is an overview of the system architecture and lists key features of the integration. This section also provides information about the setup steps that you are required to complete in your ServiceNow AI Platform instance and in the McAfee ePolicy Orchestrator (McAfee ePO) console prior to installing the application from the ServiceNow Store.
2. Checklist for the McAfee ePO integration
   Use this checklist to guide you through all the tasks of the integration. The following checklist includes setup and installation tasks and examples of use cases that include expected results for the integration.
3. Set up your ServiceNow AI Platform instance for the McAfee ePO integration
   The following section lists the setup tasks that you’re required to complete in your ServiceNow AI Platform® instance prior to installing the application for the McAfee ePO integration.
4. Set up your McAfee ePO console to integrate with Security Incident Response (SIR)
   The following section lists the setup steps that you're required to complete in your McAfee ePO console before installing the application from the ServiceNow Store for the integration.
5. Install the application and configure a server for the McAfee ePO integration
   Before you invoke the workflows for the integration, install and configure the McAfee ePO application from the ServiceNow Store on your ServiceNow AI Platform instance. The configuration is required to connect to the McAfee ePO console.
6. Edit security tags in the ServiceNow AI Platform for the McAfee ePO integration
   As part of the setup for the integration, edit the security tag names that you created in your McAfee ePO console in your ServiceNow AI Platform instance. Edit the tag names in your ServiceNow AI Platform instance so that they match the names of the tags in your McAfee ePO console.
7. Create an approval group
   Create an approval group for the McAfee ePO for Security Operations integration that can approve requests for isolating host machines, restoring them to the network.
8. McAfee ePO integration capability profiles
   As a user with the security incident administrator (sn_si.admin) role, you create profiles for the McAfee ePO capabilities in your ServiceNow AI Platform® instance. You group queries or actions in profiles and determine which McAfee ePO capabilities you want to run when a new security incident is created.
9. Trigger McAfee ePO profile manually from a security incident
   Trigger a capability profile manually from a ServiceNow AI Platform Security Incident Response (SIR) security incident.
10. Trigger additional actions in McAfee ePO integration
    The List Threat Events and Initiate Malware Scan capabilities can be triggered from Run Additional Actions.​
11. Using McAfee ePO integration in Analyst Workspace
    Use the McAfee ePO integration to leverage the McAfee ePO capabilities on the SIR Analyst workspace.
12. Test security incidents to initiate malware scan
    After you configure a profile for the malware scan, test the profile and view the security incidents that match the settings of your profile. Preview the scan results on the related lists of a ServiceNow AI Platform Security Incident Response (SIR) security incident.
13. Test security incidents and approve requests for the isolate host
    The test and preview step permits you to validate that the host isolation and remove host isolation workflow results are returned as expected for the profile.
14. Edit the start and completion tag names and colors
    You may prefer to edit the names and colors of the start and complete tags for the initiate malware scan and isolate host capabilities. The start and complete tags help you quickly identify which capabilities are invoked from ServiceNow AI Platform Security Incident Response (SIR) security incidents.

Parent Topic:Security Incident Response integrations

Related topics

Integration architecture for McAfee ePO