McAfeeNSMv2

Assign a policy to a specific device.

Assign a policy to a specific interface.

Adds a new firewall policy and access rules. You have to provide at lease one of the source/destination rule objects. If you provide the id or type of the source/destination rule object, you must provide the matching type or id the source/destination rule object as well.

Adds a new rule object. If the type is “Endpoint IP V.X” or “Network IP V.X”, only the argument “address_ip_v.X” must contain a value. If the type is “Range IP V.X”, only the arguments “from_address_ip_v.X”, “to_address_ip_v.X” must contain a value. Where X is 4 or 6 respectively.

Deletes the specified firewall policy.

Deletes a rule object.

Deploy the pending changes. Note: In order to avoid extra run time, it is recommended to deploy only the changes that are pending. To get the pending changes, use the !nsm-get-device-configuration command.

Exports the captured PCAP file.

Retrieves the relevant alert details.

Retrieves the alerts.

If an attack is given, the command returns the details for the specific attack. Otherwise, gets all available attack definitions in the Manager UI. This command can take a few minutes. If you get a timeout error, increase the timeout by using the parameter "execution-timeout".

Provides configuration information of a given device.

If a domain ID is given, the command returns the details of the specific domain. Otherwise, gets all available domains.

Gets the firewall policy details.

Gets all the IPS policies defined in the specific domain.

Gets all the IPS policies defined in the specific domain.

Gets the details of a rule object.

Gets the list of sensors available in the specified domain. If the domain is not specified, details of all the sensors in all ADs will be provided.

List the interfaces related to a given device.

List all the policies assigned to a domain or a specific device.

List the devices related to a given domain.

Gets the list of firewall policies defined in a particular domain.

Gets the list of rule objects defined in a particular domain.

List all the policies assigned to all interfaces or a specific interface.

Retrieves the list of captured PCAP files.

Update state or assignee of alerts. It is required to provide at least one of them. If none of the alerts match the time_period they won't be updated.

Updates the firewall policy details. If the argument is_overwrite=true, the new values of the provided addresses will replace the existing values, otherwise the addresses will be added to them. If you want to delete a rule, enter is_overwrite=true and the relevant rule_object_id=-1. If is_overwrite=false and there is no value in one of the rules (source or destination), their value will be as before. If is_overwrite=true, at least one of the rules (source or destination) must be provided. If you provide the id or type of the source/destination rule object, you must provide the matching type or id the source/destination rule object as well.

Updates a Rule object. In case of address rule update, if the rule type is “Endpoint IP V.X” or “Network IP V.X”, only the argument “address_ip_v.X” should contain a value. If the type is “Range IP V.X”, only the arguments “from_address_ip_v.X”, “to_address_ip_v.X” should contain a value, where X is 4 or 6 respectively.