McAfee NSM Deprecated

Deprecated. Use McAfee NSM v2 integration instead.

Network Security · McAfee NSM

Details

ID	`McAfee NSM`
Provider	Trellix
Category	Network Security
From Version	5.0.0
Supported Modules	Agentix XSIAM

README

Overview

Use the McAfee NSM integration in Cortex XSOAR to retrieve information about sensors, domains, policies, alerts, and attacks in McAfee NSM.

This integration was integrated and tested with McAfee v9.1.

Configure McAfee NSM on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for McAfee NSM.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- URL (for example: https://192.168.0.1:5000)
- Username
- Use system proxy settings
- Trust any certificate (not secure)
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Get a list of sensors for a domain: nsm-get-sensors
Get all domains: nsm-get-domains
Get alerts: nsm-get-alerts
Update alert information: nsm-update-alerts
Get details for a single alert: nsm-get-alert-details
Get IPS policies in a domain: nsm-get-ips-policies
Get policy details for a single IPS policy: nsm-get-ips-policy-details
Get all attack definitions: nsm-get-attacks

1. Get a list of sensors for a domain

Returns a list of sensors for a specified domain.

Base Command

nsm-get-sensors

Input

Argument Name	Description	Required
domainID	The domain of the sensors. If blank, returns all sensors.	Optional

Context Output

Path	Type	Description
NSM.Sensors.ID	string	Sensor ID
NSM.Sensors.Description	string	Sensor description
NSM.Sensors.DomainID	string	Sensor's domain ID

Command Example

!nsm-get-sensors domainID=0

Context Example

{
    "NSM": {
        "Sensors": {
            "Description": "MCAFEE-NETWORK-SECURITY-PLATFORM",
            "DomainID": 0,
            "ID": 1001,
            "IP Address": "192.168.1.109",
            "IPSPolicyID": 0,
            "Name": "VNSP1"
        }
    }
}

Human Readable Output

2. Get all domains

Returns all domains.

Base Command

nsm-get-domains

Input

Argument Name	Description	Required
domain	Specific domain details. If blank, returns all domains.	Optional

Context Output

Path	Type	Description
NSM.Domains.ID	number	Domain ID
NSM.Domains.Name	string	Domain name

Command Example

!nsm-get-domains domain=0

Context Example

{
    "NSM": {
        "Domains": {
            "ID": 0,
            "Name": "My Company"
        }
    }
}

Human Readable Output

3. Get alerts

Returns alerts according to query parameters.

Base Command

nsm-get-alerts

Input

Argument Name	Description	Required
time_period	Time period	Optional
start_time	Start time in "mm/dd/yyyy HH:MM" format only. Used for custom time only.	Optional
end_time	End time in "mm/dd/yyyy HH:MM" format only. used for custom time only	Optional
state	Alert state	Optional
search	Search string in alert details	Optional
filter	Filter alert by fields. Example: "name:hello;direction:Inbound,Outbound;attackcount:>3,<4".	Optional

Context Output

Path	Type	Description
NSM.Alerts.ID	number	Alert ID
NSM.Alerts.Name	string	Alert name
NSM.Alerts.State	string	Alert state (Acknowledged, Unacknowledged)
NSM.Alerts.CreatedTime	string	Alert creation time
NSM.Alerts.Assignee	string	Alert assignee
NSM.Alerts.AttackSeverity	string	Alert severity
NSM.Alerts.Application	string	The application associated with the alert
NSM.Alerts.EventResult	unknown	Event result
NSM.Alerts.Event	unknown	The event that triggered the alert
NSM.Alerts.Attack	unknown	Alert's attack
NSM.Alerts.Attacker	unknown	The attacker who committed the attack
NSM.Alerts.Target	unknown	The attack's target
NSM.Alerts.MalwareFile	unknown	Malware file used in the attack

Command Example

!nsm-get-alerts state=ANY

4. Update alert information

Update the state or the assignee of specified alerts.

Base Command

nsm-update-alerts

Input

Argument Name	Description	Required
state	Alert state	Optional
time_period	Time period	Optional
start_time	Start time in "mm/dd/yyyy HH:MM" format only. Used for custom time only	Optional
end_time	End time in "mm/dd/yyyy HH:MM" format only. Used for custom time only	Optional
new_state	The new alert state	Optional
new_assignee	The new assignee	Optional
search	Search string in alert details	Optional
filter	Filter alert by fields. Example: "name:hello;direction:Inbound,Outbound;attackcount:>3,<4"	Optional

Context Output

Path	Type	Description
NSM.Alerts.ID	number	Alert ID
NSM.Alerts.Name	string	Alert name
NSM.Alerts.State	string	Alert state (Acknowledged,Unacknowledged)
NSM.Alerts.CreatedTime	string	Alert creation time
NSM.Alerts.Assignee	string	Alert assignee
NSM.Alerts.AttackSeverity	string	Alert severity
NSM.Alerts.Application	string	The application associated with the alert
NSM.Alerts.EventResult	unknown	Event result
NSM.Alerts.Event	unknown	The event that triggered the alert
NSM.Alerts.Attack	unknown	Alert's attack
NSM.Alerts.Attacker	unknown	The attacker who committed the attack
NSM.Alerts.Target	unknown	The attack's Target
NSM.Alerts.MalwareFile	unknown	Malware file used in the attack

Command Example

!nsm-update-alerts start_time="10/10/2018 08:00" state=Acknowledged

5. Get details for a single alert

Returns details for a single, specified alert.

Base Command

nsm-get-alert-details

Input

Argument Name	Description	Required
alert_id	Alert ID	Required
sensor_id	Sensor ID	Required

Context Output

Path	Type	Description
NSM.Alerts.ID	string	Alert ID
NSM.Alerts.Name	string	Alert name
NSM.Alerts.State	string	Alert state (Acknowledged,Unacknowledged)
NSM.Alerts.CreatedTime	date	Alert creation time
NSM.Alerts.Assignee	string	Alert assignee
NSM.Alerts.Description	string	Alert description
NSM.Alerts.EventResult	string	Event result
NSM.Alerts.Event	unknown	Alert event
NSM.Alerts.Attack	unknown	Alert's attack
NSM.Alerts.Attacker	unknown	The attacker who committed the attack
NSM.Alerts.Target	unknown	The attack's target
NSM.Alerts.MalwareFile	string	Malware file used in the attack
NSM.Alerts.Details	unknown	Extra details

Command Example

!nsm-get-alert-details alert_id=0

6. Get IPS policies in a domain

Returns the IPS policies in a domain.

Base Command

nsm-get-ips-policies

Input

Argument Name	Description	Required
domain_id	Domain ID	Required

Context Output

Path	Type	Description
NSM.IPSPolicies.ID	number	IPS policy ID
NSM.IPSPolicies.Name	string	IPS policy name
NSM.IPSPolicies.DomainID	number	IPS policy domain ID
NSM.IPSPolicies.IsEditable	boolean	Whether you can edit the IPS policy
NSM.IPSPolicies.VisibleToChildren	boolean	Whether the IPS Policy is visible to domain's children

Command Example

!nsm-get-ips-policies domain_id=0

Context Example

{
    "NSM": {
        "IPSPolicies": [
            {
                "DomainID": 0,
                "ID": -1,
                "IsEditable": true,
                "Name": "Master Attack Repository",
                "VisibleToChildren": true
            },
            {
                "DomainID": 0,
                "ID": 0,
                "IsEditable": true,
                "Name": "Default Detection",
                "VisibleToChildren": true
            },
            {
                "DomainID": 0,
                "ID": 16,
                "IsEditable": true,
                "Name": "Default Exclude Informational",
                "VisibleToChildren": true
            },
            {
                "DomainID": 0,
                "ID": 17,
                "IsEditable": true,
                "Name": "Default Testing",
                "VisibleToChildren": true
            },
            {
                "DomainID": 0,
                "ID": 18,
                "IsEditable": true,
                "Name": "Default DoS and Reconnaissance Only",
                "VisibleToChildren": true
            },
            {
                "DomainID": 0,
                "ID": 19,
                "IsEditable": true,
                "Name": "Default Prevention",
                "VisibleToChildren": true
            }
        ]
    }
}

Human Readable Output

7. Get policy details for a single IPS policy

Returns policy details for the specified IPS policy.

Base Command

nsm-get-ips-policy-details

Input

Argument Name	Description	Required
policy_id	IPS Policy ID	Required

Context Output

Path	Type	Description
NSM.IPSPolicies.ID	number	IPS policy ID
NSM.IPSPolicies.Name	string	IPS policy Name
NSM.IPSPolicies.Description	string	IPS policy information
NSM.IPSPolicies.CreatedTime	string	Policy creation time
NSM.IPSPolicies.IsEditable	boolean	Whether you can edit the IPS policy
NSM.IPSPolicies.VisibleToChildren	boolean	Whether the IPS Policy is visible to domain's children
NSM.IPSPolicies.Version	number	IPS policy version
NSM.IPSPolicies.InboundRuleSet	unknown	Inbound rule set
NSM.IPSPolicies.OutboundRuleSet	unknown	Outbound rule set
NSM.IPSPolicies.ExploitAttacks	unknown	A list of exploit attacks related to the IPS Policy

Command Example

!nsm-get-ips-policy-details policy_id=0

Human Readable Output

8. Get all attack definitions

Returns all available attack definitions in McAfee NSM.

Base Command

nsm-get-attacks

Input

Argument Name	Description	Required
attack_id	Particular attack ID	Optional

Context Output

Path	Type	Description
NSM.Attacks.ID	string	Attack ID
NSM.Attacks.Name	string	Attack name
NSM.Attacks.Severity	number	Attack severity
NSM.Attacks.Direction	string	Attack direction
NSM.Attacks.Category	string	Attack category

Command Example

!nsm-get-attacks attack_id="0x00000100"

Context Example

{
    "NSM": {
        "Attacks": {
            "Category": "EXPLOIT",
            "Direction": null,
            "ID": "0x00000100",
            "Name": "IP: IP Fragment too Large",
            "Severity": 5
        }
    }
}

Human Readable Output

Troubleshooting

If you receive an 401 Unauthorized error, the user credentials may be incorrect.

Configuration parameters

url — URL (for example: https://192.168.0.1:5000) (required)
credentials — Username
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)

Commands (8)

nsm-get-alert-details
Get a single alert details
nsm-get-alerts
Get alerts
nsm-get-attacks
Get all available attack definitions in NSM
nsm-get-domains
Get all domains
nsm-get-ips-policies
Get IPS Policies in a domain
nsm-get-ips-policy-details
Get the policy details for the specific IPS policy
nsm-get-sensors
get a sensor list of a given domain
nsm-update-alerts
Update state or assignee of alerts

Source

McAfeeNSM.js McAfeeNSM.yml

Download History Raw

commonfields:
  id: McAfee NSM
  version: -1
deprecated: true
name: McAfee NSM
display: McAfee NSM (Deprecated)
category: Network Security
provider: Trellix
description: Deprecated. Use McAfee NSM v2 integration instead.
configuration:
- display: 'URL (for example: https://192.168.0.1:5000)'
  name: url
  defaultvalue: ""
  type: 0
  required: true
- display: Username
  name: credentials
  defaultvalue: ""
  type: 9
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: nsm-get-sensors
    arguments:
    - name: domainID
      default: true
      description: The domain of the sensors. If blank, returns all sensors.
    outputs:
    - contextPath: NSM.Sensors.ID
      description: Sensor ID
      type: string
    - contextPath: NSM.Sensors.Description
      description: Sensor Description
      type: string
    - contextPath: NSM.Sensors.DomainID
      description: Sensor's Domain ID
      type: string
    description: get a sensor list of a given domain
  - name: nsm-get-domains
    arguments:
    - name: domain
      default: true
      description: Specific domain details. Leave blank for all domains.
    outputs:
    - contextPath: NSM.Domains.ID
      description: Domain ID
      type: number
    - contextPath: NSM.Domains.Name
      description: Domain Name
      type: string
    description: Get all domains
  - name: nsm-get-alerts
    arguments:
    - name: time_period
      auto: PREDEFINED
      predefined:
      - LAST_5_MINUTES
      - LAST_1_HOUR
      - LAST_6_HOURS
      - LAST_12_HOURS
      - LAST_24_HOURS
      - LAST_7_DAYS
      - LAST_14_DAYS
      - CUSTOM
      description: Time Period
    - name: start_time
      description: Start Time in "mm/dd/yyyy HH:MM" format only. used for custom time only
    - name: end_time
      description: End Time in "mm/dd/yyyy HH:MM" format only. used for custom time only
    - name: state
      auto: PREDEFINED
      predefined:
      - ANY
      - Acknowledged
      - Unacknowledged
      description: Alert State
      defaultValue: ANY
    - name: search
      description: Search string in alert details
    - name: filter
      description: 'Filter alert by fields. example: "name:hello;direction:Inbound,Outbound;attackcount:>3,<4".'
    outputs:
    - contextPath: NSM.Alerts.ID
      description: Alert ID
      type: number
    - contextPath: NSM.Alerts.Name
      description: Alert Name
      type: string
    - contextPath: NSM.Alerts.State
      description: Alert State (Acknowledged,Unacknowledged)
      type: string
    - contextPath: NSM.Alerts.CreatedTime
      description: Alert Creation Time
      type: string
    - contextPath: NSM.Alerts.Assignee
      description: Alert Assignee
      type: string
    - contextPath: NSM.Alerts.AttackSeverity
      description: Alert Severity
      type: string
    - contextPath: NSM.Alerts.Application
      description: The Application assosiated to the alert
      type: string
    - contextPath: NSM.Alerts.EventResult
      description: Event Result
    - contextPath: NSM.Alerts.Event
      description: The Event who triggered the alert
    - contextPath: NSM.Alerts.Attack
      description: Alert's Attack
    - contextPath: NSM.Alerts.Attacker
      description: The Attacker who committed the attack
    - contextPath: NSM.Alerts.Target
      description: The Attack's Target
    - contextPath: NSM.Alerts.MalwareFile
      description: Malware File used in the attack
    description: Get alerts
  - name: nsm-update-alerts
    arguments:
    - name: state
      auto: PREDEFINED
      predefined:
      - ANY
      - Acknowledged
      - Unacknowledged
      description: Alert State
      defaultValue: ANY
    - name: time_period
      auto: PREDEFINED
      predefined:
      - LAST_5_MINUTES
      - LAST_1_HOUR
      - LAST_6_HOURS
      - LAST_12_HOURS
      - LAST_24_HOURS
      - LAST_7_DAYS
      - LAST_14_DAYS
      - CUSTOM
      description: Time Period
    - name: start_time
      description: Start Time in "mm/dd/yyyy HH:MM" format only. used for custom time only
    - name: end_time
      description: End Time in "mm/dd/yyyy HH:MM" format only. used for custom time only
    - name: new_state
      auto: PREDEFINED
      predefined:
      - Acknowledged
      - Unacknowledged
      description: The new alert state
    - name: new_assignee
      description: The new assignee
    - name: search
      description: Search string in alert details
    - name: filter
      description: 'Filter alert by fields. example: "name:hello;direction:Inbound,Outbound;attackcount:>3,<4"'
    outputs:
    - contextPath: NSM.Alerts.ID
      description: Alert ID
      type: number
    - contextPath: NSM.Alerts.Name
      description: Alert Name
      type: string
    - contextPath: NSM.Alerts.State
      description: Alert State (Acknowledged,Unacknowledged)
      type: string
    - contextPath: NSM.Alerts.CreatedTime
      description: Alert Creation Time
      type: string
    - contextPath: NSM.Alerts.Assignee
      description: Alert Assignee
      type: string
    - contextPath: NSM.Alerts.AttackSeverity
      description: Alert Severity
      type: string
    - contextPath: NSM.Alerts.Application
      description: The Application assosiated to the alert
      type: string
    - contextPath: NSM.Alerts.EventResult
      description: Event Result
    - contextPath: NSM.Alerts.Event
      description: The Event who triggered the alert
    - contextPath: NSM.Alerts.Attack
      description: Alert's Attack
    - contextPath: NSM.Alerts.Attacker
      description: The Attacker who committed the attack
    - contextPath: NSM.Alerts.Target
      description: The Attack's Target
    - contextPath: NSM.Alerts.MalwareFile
      description: Malware File used in the attack
    description: Update state or assignee of alerts
  - name: nsm-get-alert-details
    arguments:
    - name: alert_id
      required: true
      default: true
      description: Alert ID
    - name: sensor_id
      description: Sensor ID
    outputs:
    - contextPath: NSM.Alerts.ID
      description: Alert ID
      type: string
    - contextPath: NSM.Alerts.Name
      description: Alert Name
      type: string
    - contextPath: NSM.Alerts.State
      description: Alert State (Acknowledged,Unacknowledged)
      type: string
    - contextPath: NSM.Alerts.CreatedTime
      description: Alert Creation Time
      type: date
    - contextPath: NSM.Alerts.Assignee
      description: Alert assignee
      type: string
    - contextPath: NSM.Alerts.Description
      description: Alert Description
      type: string
    - contextPath: NSM.Alerts.EventResult
      description: Event Result
      type: string
    - contextPath: NSM.Alerts.Event
      description: Alert Event
    - contextPath: NSM.Alerts.Attack
      description: Alert's Attack
    - contextPath: NSM.Alerts.Attacker
      description: The Attacker who committed the attack
    - contextPath: NSM.Alerts.Target
      description: The Attack's target
    - contextPath: NSM.Alerts.MalwareFile
      description: Malware File used in the attack
      type: string
    - contextPath: NSM.Alerts.Details
      description: Extra details
    description: Get a single alert details
  - name: nsm-get-ips-policies
    arguments:
    - name: domain_id
      required: true
      default: true
      description: Domain ID
    outputs:
    - contextPath: NSM.IPSPolicies.ID
      description: IPS Policy ID
      type: number
    - contextPath: NSM.IPSPolicies.Name
      description: IPS Policy Name
      type: string
    - contextPath: NSM.IPSPolicies.DomainID
      description: IPS Policy Domain ID
      type: number
    - contextPath: NSM.IPSPolicies.IsEditable
      description: Whether the IPS policy is editable
      type: boolean
    - contextPath: NSM.IPSPolicies.VisibleToChildren
      description: Whether the IPS Policy is visible to domain's children
      type: boolean
    description: Get IPS Policies in a domain
  - name: nsm-get-ips-policy-details
    arguments:
    - name: policy_id
      required: true
      default: true
      description: IPS Policy ID
    outputs:
    - contextPath: NSM.IPSPolicies.ID
      description: IPS Policy ID
      type: number
    - contextPath: NSM.IPSPolicies.Name
      description: IPS Policy Name
      type: string
    - contextPath: NSM.IPSPolicies.Description
      description: IPS Policy information
      type: string
    - contextPath: NSM.IPSPolicies.CreatedTime
      description: Policy creation time
      type: string
    - contextPath: NSM.IPSPolicies.IsEditable
      description: Whether the IPS policy is editable
      type: boolean
    - contextPath: NSM.IPSPolicies.VisibleToChildren
      description: Whether the IPS Policy is visible to domain's children
      type: boolean
    - contextPath: NSM.IPSPolicies.Version
      description: IPS Policy Version
      type: number
    - contextPath: NSM.IPSPolicies.InboundRuleSet
      description: Inbound Rule Set
    - contextPath: NSM.IPSPolicies.OutboundRuleSet
      description: Outbound Rule Set
    - contextPath: NSM.IPSPolicies.ExploitAttacks
      description: A list of exploit attacks related to the IPS Policy
    description: Get the policy details for the specific IPS policy
  - name: nsm-get-attacks
    arguments:
    - name: attack_id
      default: true
      description: Particular Attack ID
    outputs:
    - contextPath: NSM.Attacks.ID
      description: Attack ID
      type: string
    - contextPath: NSM.Attacks.Name
      description: Attack Name
      type: string
    - contextPath: NSM.Attacks.Severity
      description: Attack Severity
      type: number
    - contextPath: NSM.Attacks.Direction
      description: Attack Direction
      type: string
    - contextPath: NSM.Attacks.Category
      description: Attack Category
      type: string
    description: Get all available attack definitions in NSM
fromversion: 5.0.0