McAfee ESM v2

This integration runs queries and receives alarms from McAfee Enterprise Security Manager (ESM). Supports version 10 and above.

Analytics & SIEM · McAfee ESM

Configuration parameters

  • url — Base URL (e.g. https://example.com) (required)
  • credentials — Username (required)
  • version — Version: (one of 10.0, 10.1, 10.2, 10.3, 11.1, 11.3) (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • fetchType — Fetch Types: cases, alarms, both (relevant only for fetch incident mode)
  • startingFetchID — Start fetch after ID: (relevant only for fetch incident mode)
  • fetchLimitCases — Fetch cases limit
  • fetchTime — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  • fetchLimitAlarms — Fetch alarms limit
  • timezone — McAfee ESM Timezone in hours (e.g if ESM timezone is +0300 => then insert 3)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (25)

  • esm-acknowledge-alarms

    Marks triggered alarms, as acknowledged.

  • esm-add-case

    Adds a case to the system.

  • esm-add-case-status

    Adds a status to the specified case.

  • esm-create-watchlist

    Creates a new watchlist.

  • esm-delete-alarms

    Deletes triggered alarms.

  • esm-delete-case-status

    Deletes the status of a case.

  • esm-delete-watchlist

    Deletes a watchlist.

  • esm-edit-case

    Edit the details of an existing case.

  • esm-edit-case-status

    Edits the status of a case.

  • esm-fetch-alarms

    Retrieves a list of triggered alarms.

  • esm-fetch-fields

    Returns all fields that can be used in query filters, including type information for each field.

  • esm-get-alarm-event-details

    Gets the details for the triggered alarm.

  • esm-get-case-detail

    Returns the details of an existing case.

  • esm-get-case-event-list

    Returns case event details.

  • esm-get-case-list

    Returns a list of cases from McAfee ESM.

  • esm-get-case-statuses

    Returns a list of valid case statuses from the system.

  • esm-get-organization-list

    Returns a case organization.

  • esm-get-user-list

    Returns a list of all users.

  • esm-get-watchlists

    Returns a list of watchlists' names and IDs.

  • esm-list-alarm-events

    Gets a list of events related to the alarm.

  • esm-search

    Perform a query against McAfee ESM SIEM.

  • esm-unacknowledge-alarms

    Marks triggered alarms, as unacknowledged.

  • esm-watchlist-add-entry

    Creates a new watchlist entry.

  • esm-watchlist-delete-entry

    Deletes a watchlist entry.

  • esm-watchlist-list-entries

    Returns a list of watchlist entries.