McAfeeDAM

Details

ID	`McAfeeDAM`
Provider	STG
Category	Database
From Version	5.0.0
Supported Modules	Agentix XSIAM

README

Use McAfee Database Activity Monitoring (DAM) Integration to fetch Alerts (incidents) and query Alerts.

This integration was integrated and developed with version 4.6.x of McAfee DAM.

Configure McAfeeDAM in Cortex

Make sure that the XML API interface is enabled on your McAfee DAM server (Settings > Interfaces > XML API), and that the configured user has read permissions to query DAM Alerts and Sensors (XML API).

Important: The user configured in McAfee DAM must have the Use XML API permission as documented here.

Instructions on how to configure and test the XML API for McAfee DAM are available here.

Parameter	Description	Required
url	URL	True
credentials	Credentials	True
batchSize	Batch size for incident fetch	False
isFetch	Fetch incidents	False
incidentType	Incident type	False
secure	Validate ceritifacte	False
ruleName	Rule Name, If fetch incident is checked, this field is mandatory and will be used to get DAM alerts only triggered by this rule	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Get information for a single alert

Gets a DAM alert from McAfee Database Activity Monitoring by alert ID.

Required Permissions

Alerts Read

Base Command

dam-get-alert-by-id

Input

Argument Name	Description	Required
id	The alert ID.	Required

Context Output

Path	Type	Description
AlertId	unknown	DAM alert ID.
alertAccessedObjects	unknown	DAM accessed objects.
dbUser	unknown	DAM Database User.
Account.Username	unknown	DAM OS user.
database	unknown	DAM database.
sensor	unknown	DAM sensor.
rules	unknown	DAM rules.

Get the latest DAM alerts

Gets the latest DAM alerts by rule name.

Required Permissions

Alerts Read

Base Command

dam-get-latest-by-rule

Input

Argument Name	Description	Required
ruleName	Name of the rule that triggered the alert.	Required
count	Number of alerts to retrieve. The default is 10.	Optional
timeBack	Filter DAM alerts and import alerts that were created only in the last X minutes. The default is the last 10 minutes.	Optional

Context Output

Path	Type	Description
AlertId	unknown	DAM alert ID.
alertAccessedObjects	unknown	DAM accessed objects.
dbUser	unknown	DAM database user.
Account.Username	unknown	DAM OS user.
database	unknown	DAM database.
sensor	unknown	DAM sensor.
rules	unknown	DAM rules.

Configuration parameters

url — URL (required)
credentials — Credentials (required)
batchSize — Batch size for incident fetch
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
secure — Validate ceritifacte
ruleName — Rule Name, If fetch incident is checked, this field is mandatory and will be used to get DAM alerts only triggered by this rule

Commands (2)

dam-get-alert-by-id
Gets a DAM alert from McAfee Database Activity Monitoring by alert ID.
dam-get-latest-by-rule
Gets the latest DAM alerts by rule name.

Source

McAfeeDAM.js McAfeeDAM.yml McAfeeDAM_description.md

Download History Raw

commonfields:
  id: McAfeeDAM
  version: -1
name: McAfeeDAM
display: McAfee DAM
category: Database
sectionorder:
- Connect
- Collect
provider: STG
description: McAfee Database Activity Monitoring.
configuration:
- display: URL
  name: url
  defaultvalue: ""
  type: 0
  required: true
  section: Connect
- display: Credentials
  name: credentials
  defaultvalue: ""
  type: 9
  required: true
  section: Connect
- display: Batch size for incident fetch
  name: batchSize
  defaultvalue: "10"
  type: 0
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: Validate ceritifacte
  name: secure
  defaultvalue: "false"
  type: 8
  required: false
  section: Connect
- display: Rule Name, If fetch incident is checked, this field is mandatory and will be used to get DAM alerts only triggered by this rule
  name: ruleName
  defaultvalue: ""
  type: 0
  required: false
  section: Collect
script:
  script: ''
  type: javascript
  commands:
  - name: dam-get-alert-by-id
    arguments:
    - name: id
      required: true
      default: true
      description: The alert ID.
    outputs:
    - contentPath: id
      contextPath: AlertId
      description: DAM alert ID.
    - contentPath: accessedObjects.object.name
      contextPath: alertAccessedObjects
      description: DAM accessed objects.
    - contentPath: execUser
      contextPath: dbUser
      description: DAM database user.
    - contentPath: osUser
      contextPath: Account.Username
      description: DAM OS user.
    - contentPath: database
      contextPath: database
      description: DAM database.
    - contentPath: identifyingSensor
      contextPath: sensor
      description: DAM sensor.
    - contentPath: rules
      contextPath: rules
      description: DAM rules.
    description: Gets a DAM alert from McAfee Database Activity Monitoring by alert ID.
  - name: dam-get-latest-by-rule
    arguments:
    - name: ruleName
      required: true
      default: true
      description: Name of the rule that triggered the alert.
    - name: count
      description: Number of alerts to retrieve. The default is 10.
    - name: timeBack
      description: Filter DAM alerts and import alerts that where created only in the last X minutes. The default is the last 10 minutes.
    outputs:
    - contentPath: id
      contextPath: AlertId
      description: DAM alert ID.
    - contentPath: accessedObjects.object.name
      contextPath: alertAccessedObjects
      description: DAM accessed objects.
    - contentPath: execUser
      contextPath: dbUser
      description: DAM database user.
    - contentPath: osUser
      contextPath: Account.Username
      description: DAM OS user.
    - contentPath: database
      contextPath: database
      description: DAM database.
    - contentPath: identifyingSensor
      contextPath: sensor
      description: DAM sensor.
    - contentPath: rules
      contextPath: rules
      description: DAM Rules.
    description: Gets the latest DAM alerts by rule name.
  isfetch: true
tests:
- No test
fromversion: 5.0.0