epo Deprecated

Deprecated. Use McAfee ePO v2 instead.

Endpoint · McAfee ePO

Details

IDepo
ProviderTrellix
CategoryEndpoint
From Version5.0.0
Supported ModulesAgentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

This integration was integrated and tested with McAfee ePO v5.3.2.

Configure McAfee ePO in Cortex

  • Name: a textual name for the integration instance.
  • Url: for example: https://****:port
  • Username
  • Password
  • Trust any certificate (not secure) Mark to trust Certificate Authority.
  • Use system proxy settings

Permissions

McAfee ePO has a highly flexible and powerful permissions system. The permissions required for the user that uses this integration depend on which operations they need to perform. The API user should have the same permissions a regular user would have in order to access the data via the UI. It is possible to view the exact permissions needed for a specific command by running the !epo-help command. The !epo-help command’s output will include help information for the specific command including required permissions.
More info about McAfee ePO’s permissions model is available here.

Example !epo-help outputs with permission information:

  • !epo-help command="repository.findPackages":
  • !epo-help command="repository.deletePackage":

Playbooks

  • McAfee ePO Endpoint Connectivity Diagnostics - Perform a check on ePO endpoints to see if any endpoints are unmanaged or lost connectivity with ePO and take steps to return to valid state.
  • McAfee ePO Endpoint Compliance - Discover endpoints that are not using the latest McAfee AV Signatures
  • McAfee ePO Repository Compliance - Ensures that ePO servers are updated to the latest McAfee published AV signatures (DAT file version).
  • Endpoint Enrichment - Generic v2: uses epo-find-systems to enrich an endpoint by hostname.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. Print help for ePO commands: epo-help
  2. Get the latest DAT file: epo-get-latest-dat
  3. Check the current DAT file version: epo-get-current-dat
  4. Update the DAT file: epo-update-client-dat
  5. Update a repository: epo-update-repository
  6. Get system tree groups: epo-get-system-tree-group
  7. Find systems in the system tree: epo-find-systems
  8. epo-command
  9. epo-advanced-command
  10. Wake up an agent: epo-wakeup-agent
  11. Apply a tag: epo-apply-tag
  12. Clear a tag: epo-clear-tag
  13. Query an ePO table: epo-query-table
  14. Get an ePO table: epo-get-table
  15. Get the ePO version: epo-get-version
  16. Find systems in the system tree: epo-find-system
  17. Move a system to a different group: epo-move-system

1. Print help for ePO commands

Prints help (information) for ePO commands. If no command argument is specified, returns all ePO commands.

Base Command
epo-help
Input
Argument Name Description Required
search String to search for in help. Optional
command Command for which to print help. Optional
Context Output

There is no context output for this command.

Command Example

!epo-help search=”agent”

Human Readable Output

screen shot 2018-08-26 at 10 28 00

2. Get the latest DAT file

Checks for the latest DAT file in the McAfee repository.

Base Command
epo-get-latest-dat
Input

There is no input for this command.

Context Output
Path Type Description
McAfee.ePO.latestDAT Number Latest McAfee DAT file version.
Command Example

!epo-get-latest-dat

Human Readable Output

screen shot 2018-08-26 at 10 15 58

3. Check the current DAT file version

Checks the existing DAT file version in ePO.

Base Command
epo-get-current-dat
Input

There is no input for this command.

Context Output
Path Type Description
McAfee.ePO.epoDAT number Current McAfee DAT file in the ePO repository.
Command Example

!epo-get-current-dat

Human Readable Output

screen shot 2018-08-26 at 10 18 36

4. Update the DAT file

Run client task to update the DAT file.

To run this command, you need to create a task on the ePO server with a specific name.

  1. Log on to the ePO server.
  2. Select System Tree.
  3. Select Assigned Client Tasks > Actions > New Client Task Assignment.
  4. Configure the Select Task section.
Field Value
Product McAfee Agent
Task Type Product Update
Task Name DAT Update
  1. Select Create New Task.
Field Value
Task Name VSEContentUpdateDemisto
Package Selection Selected packages
Signatures and Engines DAT
Base Command
epo-update-client-dat
Input
Argument Name Description Required
systems A CSV list of IP addresses or system names. Required
retryAttempts Number of times the server will attempt to send the task to the client. Default is 1 retry. Optional
retryIntervalInSeconds Retry interval in seconds. Default is 30 seconds. Optional
abortAfterMinutes The threshold (in minutes) after which attempts to send the task to the client are aborted. Default is 5. Optional
stopAfterMinutes The threshold (in minutes) that the client task is allowed to run. Defaults to 20. Optional
randomizationInterval Duration (in minutes) over which to randomly spread task execution. Default is 0 (executes on all clients immediately). Optional
Context Output

There is no context output for this command.

Command Example

!epo-update-client-dat systems=ADMIN-PC

Human Readable Output

screen shot 2018-08-26 at 10 41 04

5. Update a repository

Triggers a server task in specific ePO servers to retrieve the latest signatures from the update server.

Base Command
epo-update-repository
Input

There is no input for this command.

Context Output

There is no context output for this command.

Command Example

!epo-update-repository

Human Readable Output

screen shot 2018-08-26 at 10 00 40

6. Get system tree groups

Returns system tree groups.

Base Command

epo-get-system-tree-group

Input
Argument Name Description Required
search String to search for in the system tree group. Optional
Context Output
Path Type Description
McAfee.ePO.SystemTreeGroups.groupId number System tree group ID.
McAfee.ePO.SystemTreeGroups.groupPath string System tree group path.
Human Readable Output

screen shot 2018-08-26 at 9 59 49

7. Find systems in the system tree

Find systems in the System Tree - by group ID or by search

Base Command

epo-find-systems

Input
Argument Name Description Required
groupId System tree group ID. Required
verbose Whether to return all system data. Optional
Context Output
Path Type Description
Endpoint.Name string Endpoint name.
Endpoint.Domain string Endpoint domain.
Endpoint.Hostname string Endpoint hostname.
Endpoint.IPAddress string Endpoint IP address.
Endpoint.OS string Endpoint OS.
Endpoint.OSVersion string Endpoint OS version.
Endpoint.Processor string Processor model.
Endpoint.Processors number Number of processors.
Endpoint.Memory number Endpoint memory.
McAfee.ePO.Endpoint.ComputerName string Endpoint name.
McAfee.ePO.Endpoint.Domain string Endpoint domain.
McAfee.ePO.Endpoint.Hostname string Endpoint hostname.
McAfee.ePO.Endpoint.IPAddress string Endpoint IP address.
McAfee.ePO.Endpoint.OS string Endpoint OS.
McAfee.ePO.Endpoint.OSVersion string Endpoint OS version.
McAfee.ePO.Endpoint.Processor string Processor model.
McAfee.ePO.Endpoint.Processors number Number of processors
McAfee.ePO.Endpoint.Memory number Endpoint memory.

8. epo-command

Executes the ePO command. Receives the mandatory ‘‘command’’ argument, and other optional arguments.

To get a list of available commands, run the ‘‘epo-help’’ command to get a list of available commands. You can also specify the ‘‘headers’’ argument to filter table headers. Example/:/ !epo-command command=system.find searchText=10.0.0.1 headers=EPOBranchNode.AutoID,EPOComputerProperties.ComputerName

Base Command

epo-command

Command Example

!epo-command command=system.find searchText=10.0.0.1

screen shot 2018-10-02 at 9 44 34

!epo-command command=agentmgmt.listAgentHandlers

screen shot 2018-10-02 at 9 46 00

9. epo-advanced-command

Executes the ePO command.

To get a list of available commands, run the ‘‘epo-help’’ command. For example/:/ !epo-advanced-command command=clienttask.find commandArgs=searchText:On-demand. You can also specify the ‘‘headers’’ argument to filter table headers, for example/:/ !epo-command command=system.find searchText=10.0.0.1 headers=EPOBranchNode.AutoID,EPOComputerProperties.ComputerName.

Base Command
epo-advanced-command
Input
Argument Name Description Required
command The command to execute. Run either the core.help command or the !epo-help to get all available commands. Required
commandArgs CSV list of key value pairs as additional arguments to pass, for example, “argName1:argValue1,argName2:argValue2”. Required
Context Output

 There is no context output for this command.

Command Example

!epo-advanced-command command=”clienttask.find” commandArgs=”searchText:On-demand”

screen shot 2018-10-29 at 13 31 53

10. Wake up an agent

Wakes up an agent.

Input
Argument Name Description Required
names Agent hostname. Required

11. Apply a tag

Applies a tag to hostnames.

Input
Argument Name Description Required
names Hostnames on which to apply tags. Required
tagName Tag name. Required

Command Example

!epo-apply-tag names=”ADMIN-PC” tagName=”Compromised”

12. Clear a tag

Clears a tag from hostnames.

Input
Argument Name Description Required
names Hostnames from which to clear tags. Required
tagName Tag name. Required

Command Example

!epo-clear-tag names=”ADMIN-PC” tagName=”Compromised”

13. Query an ePO table

Queries an ePO table.

Base Command
epo-query-table
Input
Argument Name Description Required
target Table name. Required
select The columns to select, in SQUID syntax. Example: “(select EPOEvents.AutoID EPOEvents.DetectedUTC EPOEvents.ReceivedUTC)”. Optional
where Filter results, in SQUID syntax. Example: “(where ( eq ( OrionTaskLogTask .UserName “ga” )))”. Optional
order Order in which to return the results, in SQUID syntax. Example: “(order (asc OrionTaskLogTask.StartDate) )”). Optional
group Group the results, in SQUID Syntax. Example: “(group EPOBranchNode.NodeName)”. Optional
joinTables Perform join, in SQUID syntax. Optional
query_name Name for the query to appear in the context. Optional
Context Output
Path Description
McAfee.ePO.Query Query result.
Human Readable Output

!epo-query-table target=EPOLeafNode select="(select EPOLeafNode.NodeName EPOLeafNode.Tags EPOBranchNode.NodeName)" where="(hasTag EPOLeafNode.AppliedTags 4)"

screen shot 2018-10-29 at 15 17 18

!epo-query-table target=EPOLeafNode select="(select (top 3) EPOLeafNode.NodeName EPOLeafNode.Tags EPOBranchNode.NodeName)"

screen shot 2018-10-29 at 15 17 43

!epo-query-table target="EPOEvents" select="(select EPOEvents.AutoID EPOEvents.DetectedUTC EPOEvents.ReceivedUTC)" order="(order(desc EPOEvents.DetectedUTC))"

screen shot 2018-10-29 at 16 35 41

!epo-query-table target="EPExtendedEvent" select="(select (top 250) EPOEvents.ThreatName EPOEvents.AutoID EPExtendedEvent.EventAutoID EPExtendedEvent.TargetHash EPExtendedEvent.TargetPath EPOEvents.SourceHostName)" order="(order(desc EPExtendedEvent.TargetHash))" joinTables="EPOEvents"where="(where(eq EPOEvents.ThreatName "real Protect-LS!d5435f1fea5e"))"

screen shot 2018-10-31 at 10 03 49

14. Get an ePO table

Returns an ePO table.

Base Command
epo-get-tables
Input
Argument Name Description Required
table Name of the table to return. Optional
Context Output

There is no context output for this command.

Command Example

!epo-get-tables

Human Readable Output
screen shot 2018-10-29 at 15 19 13

15. Get the ePO version

Gets the ePO version. This command requires global admin permissions.

Base Command
epo-get-version
Context Output
Path Type Description
McAfee.ePO.Version string ePO version.
Human Readable Output

!epo-get-version

screen shot 2018-11-06 at 15 43 18

16. Find systems in the system tree

Finds systems in the system tree.

Base Command
epo-find-system
Input
Argument Name Description Required
searchText Hostname to search. Optional
verbose Print all system data Optional
Context Output
Path Type Description
Endpoint.Name string Endpoint name.
Endpoint.Domain string Endpoint domain.
Endpoint.Hostname string Endpoint hostname.
Endpoint.IPAddress string Endpoint IP address.
Endpoint.OS string Endpoint OS.
Endpoint.OSVersion string Endpoint OS version.
Endpoint.Processor string Processor model.
Endpoint.Processors number Number of processors.
Endpoint.Memory number Endpoint memory.
McAfee.ePO.Endpoint.ComputerName string Endpoint name.
McAfee.ePO.Endpoint.Domain string Endpoint domain.
McAfee.ePO.Endpoint.Hostname string Endpoint hostname.
McAfee.ePO.Endpoint.IPAddress string Endpoint IP address.
McAfee.ePO.Endpoint.OS string Endpoint OS.
McAfee.ePO.Endpoint.OSVersion string Endpoint OS version.
McAfee.ePO.Endpoint.Processor string Processor model.
McAfee.ePO.Endpoint.Processors number Number of processors.
McAfee.ePO.Endpoint.Memory number Endpoint memory.
Human Readable Output

!epo-find-system searchText=mar

screen shot 2018-11-06 at 15 46 12

17. Move a system to a different group

Moves a system to a different group.

Base Command

epo-move-system

Input
Argument Name Description Required
names Asset name. Required
parentGroupId Group ID. Required
Context Output

There is no context output for this command.

Command Example

!epo-move-system names=tie parentGroupId=3

Human Readable Output

Screen Shot 2019-07-31 at 11 34 28

Configuration parameters

  • address — https://<address>:port (required)
  • authentication — Username (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (17)

  • epo-advanced-command

    Executes the ePO command. Run the ''epo-help'' command to get a list of available commands. For example/:/ !epo-advanced-command command=clienttask.find commandArgs=searchText:On-demand. You can also specify the ''headers'' argument to filter table headers, for example/:/ !epo-command command=system.find searchText=10.0.0.1 headers=EPOBranchNode.AutoID,EPOComputerProperties.ComputerName.

  • epo-apply-tag

    Applies a tag to hostnames.

  • epo-clear-tag

    Clears a tag from hostnames.

  • epo-command

    Executes the ePO command. Receives the mandatory ''command'' argument, and other optional arguments. Run the ''epo-help'' command to get a list of available commands. You can also specify the ''headers'' argument to filter table headers. Example/:/ !epo-command command=system.find searchText=10.0.0.1 headers=EPOBranchNode.AutoID,EPOComputerProperties.ComputerName

  • epo-find-system

    Finds systems in the system tree.

  • epo-find-systems

    Finds computers within a specified group in the ePO tree.

  • epo-get-current-dat

    Checks the existing DAT file version in ePO.

  • epo-get-latest-dat

    Checks the latest DAT file in the McAfee repository.

  • epo-get-system-tree-group

    Returns system tree groups.

  • epo-get-tables

    Returns an ePO table.

  • epo-get-version

    Gets the ePO version. This requires global admin permissions.

  • epo-help

    Prints help (information) for ePO commands. If no command argument is specified, returns all ePO commands.

  • epo-move-system

    Moves a system to a different group.

  • epo-query-table

    Queries an ePO table.

  • epo-update-client-dat

    Runs a client task to update the DAT file.

  • epo-update-repository

    Triggers a server task in specific ePO servers to retrieve the latest signatures from the update server.

  • epo-wakeup-agent

    Wakes up an agent.

Source

Epo.js Epo.yml Epo_description.md
Download History Raw 
commonfields:
  id: epo
  version: -1
name: epo
display: McAfee ePO (Deprecated)
category: Endpoint
provider: Trellix
description: Deprecated. Use McAfee ePO v2 instead.
configuration:
- display: https://<address>:port
  name: address
  defaultvalue: ''
  type: 0
  required: true
- display: Username
  name: authentication
  defaultvalue: ''
  type: 9
  required: true
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: ''
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  defaultvalue: ''
  type: 8
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: epo-help
    arguments:
    - name: search
      default: true
      description: String to search for in help.
    - name: command
      description: Command for which to print help.
    description: Prints help (information) for ePO commands. If no command argument is specified, returns all ePO commands.
  - name: epo-get-latest-dat
    arguments: []
    outputs:
    - contentPath: mcAfeeLatestDatVersion
      contextPath: McAfee.ePO.latestDAT
      description: Latest McAfee DAT file version.
      type: number
    description: Checks the latest DAT file in the McAfee repository.
  - name: epo-get-current-dat
    arguments: []
    outputs:
    - contextPath: McAfee.ePO.epoDAT
      description: Current McAfee DAT file in ePO repository
      type: number
    description: Checks the existing DAT file version in ePO.
  - name: epo-update-client-dat
    arguments:
    - name: systems
      required: true
      description: A CSV list of IP addresses or system names.
    - name: retryAttempts
      description: Number of times the server will attempt to send the task to the client. Default is 1 retry.
    - name: retryIntervalInSeconds
      description: Retry interval in seconds. Default is 30.
    - name: abortAfterMinutes
      description: The threshold (in minutes) after which attempts to send the task to the client are aborted. Default is 5.
    - name: stopAfterMinutes
      description: The threshold (in minutes) that the client task is allowed to run. Defaults to 20.
    - name: randomizationInterval
      description: Duration (in minutes) over which to randomly spread task execution. Default is 0 (executes on all clients immediately).
    description: Runs a client task to update the DAT file.
  - name: epo-update-repository
    arguments: []
    description: Triggers a server task in specific ePO servers to retrieve the latest signatures from the update server.
  - name: epo-get-system-tree-group
    arguments:
    - name: search
      description: String to search for in the system tree group.
    outputs:
    - contextPath: McAfee.ePO.SystemTreeGroups.groupId
      description: System tree group ID.
      type: number
    - contextPath: McAfee.ePO.SystemTreeGroups.groupPath
      description: System tree group path.
      type: string
    description: Returns system tree groups.
  - name: epo-find-systems
    arguments:
    - name: groupId
      required: true
      description: System tree group ID.
    - name: verbose
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Whether to return all system data.
    outputs:
    - contextPath: Endpoint.Name
      description: Endpoint name
      type: string
    - contextPath: Endpoint.Domain
      description: Endpoint domain.
      type: string
    - contextPath: Endpoint.Hostname
      description: Endpoint hostname.
      type: string
    - contextPath: Endpoint.IPAddress
      description: Endpoint IP address.
      type: string
    - contextPath: Endpoint.OS
      description: Endpoint OS.
      type: string
    - contextPath: Endpoint.OSVersion
      description: Endpoint OS version.
      type: string
    - contextPath: Endpoint.Processor
      description: Processor model.
      type: string
    - contextPath: Endpoint.Processors
      description: Number of processors.
      type: number
    - contextPath: Endpoint.Memory
      description: Endpoint memory.
      type: number
    - contextPath: McAfee.ePO.Endpoint.Name
      description: Endpoint name.
      type: string
    - contextPath: McAfee.ePO.Endpoint.Domain
      description: Endpoint domain.
      type: string
    - contextPath: McAfee.ePO.Endpoint.Hostname
      description: Endpoint hostname.
      type: string
    - contextPath: McAfee.ePO.Endpoint.IPAddress
      description: Endpoint IP address.
      type: string
    - contextPath: McAfee.ePO.Endpoint.OS
      description: Endpoint OS.
      type: string
    - contextPath: McAfee.ePO.Endpoint.OSVersion
      description: Endpoint OS version.
      type: string
    - contextPath: McAfee.ePO.Endpoint.Processor
      description: Processor model.
      type: string
    - contextPath: McAfee.ePO.Endpoint.Processors
      description: Number of processors.
      type: number
    - contextPath: McAfee.ePO.Endpoint.Memory
      description: Endpoint memory.
      type: number
    description: Finds computers within a specified group in the ePO tree.
  - name: epo-command
    arguments: []
    description: Executes the ePO command. Receives the mandatory ''command'' argument, and other optional arguments. Run the ''epo-help'' command to get a list of available commands. You can also specify the ''headers'' argument to filter table headers. Example/:/ !epo-command command=system.find searchText=10.0.0.1 headers=EPOBranchNode.AutoID,EPOComputerProperties.ComputerName
  - name: epo-advanced-command
    arguments:
    - name: command
      required: true
      description: The command to execute. Run either th core.help command or the !epo-help to get all available commands.
    - name: commandArgs
      required: true
      description: CSV list of key value pairs as additional arguments to pass, for example, "argName1:argValue1,argName2:argValue2".
    description: Executes the ePO command. Run the ''epo-help'' command to get a list of available commands. For example/:/  !epo-advanced-command command=clienttask.find commandArgs=searchText:On-demand. You can also specify the ''headers'' argument to filter table headers, for example/:/ !epo-command command=system.find searchText=10.0.0.1 headers=EPOBranchNode.AutoID,EPOComputerProperties.ComputerName.
  - name: epo-wakeup-agent
    arguments:
    - name: names
      required: true
      description: Agent hostname.
    description: Wakes up an agent.
  - name: epo-apply-tag
    arguments:
    - name: names
      required: true
      description: Hostnames on which to apply tags.
    - name: tagName
      required: true
      description: Tag name.
    description: Applies a tag to hostnames.
  - name: epo-clear-tag
    arguments:
    - name: names
      required: true
      description: Hostnames from which to clear tags.
    - name: tagName
      required: true
      description: Tag name.
    description: Clears a tag from hostnames.
  - name: epo-query-table
    arguments:
    - name: target
      required: true
      description: Table name
    - name: select
      description: 'The columns to select, in SQUID syntax. Example: "(select EPOEvents.AutoID EPOEvents.DetectedUTC EPOEvents.ReceivedUTC)"'
    - name: where
      description: 'Filter results, in SQUID syntax. Example: "(where ( eq ( OrionTaskLogTask .UserName "ga" )))"'
    - name: order
      description: 'Order in which to return the results, in SQUID syntax. Example: "(order (asc OrionTaskLogTask.StartDate) )")'
    - name: group
      description: 'Group the results, in SQUID Syntax. Example: "(group EPOBranchNode.NodeName)"'
    - name: joinTables
      description: Perform join, in SQUID syntax.
    - name: query_name
      description: Name for the query to appear in the context
    outputs:
    - contextPath: McAfee.ePO.Query
      description: Query result.
    description: Queries an ePO table.
  - name: epo-get-tables
    arguments:
    - name: table
      description: Name of the table.
    description: Returns an ePO table.
  - name: epo-find-system
    arguments:
    - name: searchText
      description: Hostname to search.
    - name: verbose
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Whether to print all system data.
      isArray: true
    outputs:
    - contextPath: Endpoint.Name
      description: Endpoint name.
      type: string
    - contextPath: Endpoint.Domain
      description: Endpoint domain.
      type: string
    - contextPath: Endpoint.Hostname
      description: Endpoint hostname.
      type: string
    - contextPath: Endpoint.IPAddress
      description: Endpoint IP address.
      type: string
    - contextPath: Endpoint.OS
      description: Endpoint OS.
      type: string
    - contextPath: Endpoint.OSVersion
      description: Endpoint OS version.
      type: string
    - contextPath: Endpoint.Processor
      description: Processor model.
      type: string
    - contextPath: Endpoint.Processors
      description: Number of processors.
      type: number
    - contextPath: Endpoint.Memory
      description: Endpoint memory. '
      type: number
    - contextPath: McAfee.ePO.Endpoint.Name
      description: Endpoint name.
      type: string
    - contextPath: McAfee.ePO.Endpoint.Domain
      description: Endpoint domain.
      type: string
    - contextPath: McAfee.ePO.Endpoint.Hostname
      description: Endpoint hostname.
      type: string
    - contextPath: McAfee.ePO.Endpoint.IPAddress
      description: Endpoint IP address.
      type: string
    - contextPath: McAfee.ePO.Endpoint.OS
      description: Endpoint OS
      type: string
    - contextPath: McAfee.ePO.Endpoint.OSVersion
      description: Endpoint OS version
      type: string
    - contextPath: McAfee.ePO.Endpoint.Processor
      description: Processor model.
      type: string
    - contextPath: McAfee.ePO.Endpoint.Processors
      description: Number of processors.
      type: number
    - contextPath: McAfee.ePO.Endpoint.Memory
      description: Endpoint memory.
      type: number
    description: Finds systems in the system tree.
  - name: epo-get-version
    arguments: []
    outputs:
    - contextPath: McAfee.ePO.Version
      description: ePO version
      type: string
    description: Gets the ePO version. This requires global admin permissions.
  - name: epo-move-system
    arguments:
    - name: names
      required: true
      description: Asset name.
    - name: parentGroupId
      required: true
      description: Group ID.
    description: Moves a system to a different group.
tests:
- No Test
fromversion: 5.0.0
deprecated: true