McAfee ePO v2

McAfee ePolicy Orchestrator
This integration was integrated and tested with version 5.3.2 and 5.10 of McAfee ePO

Permissions

McAfee ePO has a highly flexible and powerful permissions system. The permissions required for the user who uses this integration depend on which operations they need to perform. The API user should have the same permissions a regular user would have in order to access the data via the UI. It is possible to view the exact permissions needed for a specific command by running the !epo-help command. The !epo-help command’s output will include help information for the specific command including required permissions.
More information about McAfee ePO’s permissions model is available here.

Example !epo-help outputs with permission information:

• !epo-help command="repository.findPackages":
  
• !epo-help command="repository.deletePackage":
  

Configure McAfee ePO v2 in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

epo-help

Displays help (information) for ePO commands. If no command argument is specified, returns all ePO commands.

Base Command

epo-help

Input

Context Output

There is no context output for this command.

Command Example

!epo-help command="core.help"

Human Readable Output

ePO Help - core.help

core.help [command] [prefix=<>]
Lists all registered commands and displays help strings. Returns the list of
commands or throws on error.
Parameters:
command (param 1) - If specified, the help string for a specific command is
displayed. If omitted, a list of all commands is displayed.
prefix - if specified, only commands with the given prefix are listed. This is
useful for showing the commands for a single plug-in. This has no effect if the
‘command’ argument is specified.

epo-get-latest-dat

Checks the latest available DAT file version in the public McAfee repository.

Base Command

epo-get-latest-dat

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Command Example

#### Context Example

```json
{
    "McAfee": {
        "ePO": {
            "latestDAT": "10200"
        }
    }
}

Human Readable Output

McAfee ePO Latest DAT file version available is: 10200

epo-get-current-dat

Checks the existing DAT file version in the ePO repository.

Base Command

epo-get-current-dat

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Command Example

#### Context Example

```json
{
    "McAfee": {
        "ePO": {
            "epoDAT": "10200"
        }
    }
}

Human Readable Output

McAfee ePO Current DAT file version in repository is: 10200

epo-command

Executes the ePO command. Receives the mandatory ‘command’ argument, and other optional arguments. Run the ‘epo-help’ command to get a list of available commands. You can control the response format to be text instead of the default json format using resp_type=text, You can also specify the ‘headers’ argument to filter table headers. Example/:/ !epo-command command=system.find searchText=10.0.0.1 headers=EPOBranchNode.AutoID,EPOComputerProperties.ComputerName

Base Command

epo-command

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Command Example

!epo-command command="system.find" searchText="10.0.0.1" headers="EPOBranchNode.AutoID,EPOComputerProperties.ComputerName"

Human Readable Output

ePO command system.find results

EPOBranchNode.AutoID	EPOComputerProperties.ComputerName
2	10.0.0.1
2	10.0.0.11

epo-update-client-dat

Runs a client task to update the DAT file on the given endpoints.

Base Command

epo-update-client-dat

Input

Context Output

There is no context output for this command.

Command Example

!epo-update-client-dat systems="TIE"

Human Readable Output

ePO client DAT update task started: Succeeded

epo-update-repository

Triggers a server task in specific ePO servers to retrieve the latest signatures from the updated server.

Base Command

epo-update-repository

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Command Example

#### Human Readable Output

>ePO repository update started.
>success
>skipped: Current\LMASECORE2000\2.2.0.9309\SpamEngine\0000
>skipped: Current\BOCVSE__1000\657\DAT\0000
>skipped: Current\AMCORDAT1000\1359.1\DAT\0000
>skipped: Current\VIRUSCAN8700\8.7.0\LangPack\0000
>skipped: Current\VIRUSCAN8800\8.8.0\LangPack\0000
>skipped: Current\SUPPMVTCT1000\8.3.0.357\MVTContentUpdate\0000
>skipped: Current\PHCONTENMETA\6006\PHContent\0000
>skipped: Current\MASECORE2000\2.2.0.9309\SpamEngine\0000
>skipped: Current\DBSECDAMMETA\97.3112\DAT\0000
>skipped: Current\MVEDR_R_3000\3.5.2\DAT\0000
>skipped: Current\DBSECDVMMETA\195.2097\DVMCHECKS\0000
>skipped: Current\Findings\1310\FNDContent\0000
>skipped: Current\AUENGINEMETA\1335\BMContent\0000
>skipped: Current\ENDPCNT_1000_LYNX\10.7.0\DAT\0000
>skipped: Current\ENCPTCNT6000\8.0.0.11953\DAT\0000

### epo-get-system-tree-group

***
Returns a system tree group.

#### Base Command

`epo-get-system-tree-group`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| search | String to search for in the system tree group. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| McAfee.ePO.SystemTreeGroups.groupId | number | System tree group ID. |
| McAfee.ePO.SystemTreeGroups.groupPath | string | System tree group path. |

#### Command Example

```!epo-get-system-tree-group search="Lost"```

#### Context Example

```json
{
    "McAfee": {
        "ePO": {
            "SystemTreeGroups": {
                "groupId": 3,
                "groupPath": "My Organization\\Lost&Found"
            }
        }
    }
}

Human Readable Output

ePO System Tree groups

Group ID	Group path
3	My Organization\Lost&Found

epo-find-systems

Finds computers within a specified group in the McAfee ePO system tree.

Base Command

epo-find-systems

Input

Context Output

Command Example

!epo-find-systems groupId="2"

Context Example

{
    "Endpoint": [
        {
            "ID": "10.0.0.1"
        },      
        {
            "Domain": "WORKGROUP",
            "ID": "WIN-AQ0LQQOG4Q7",
            "Memory": 8589398016,
            "OS": "Windows Server 2012 R2",
            "OSVersion": "6.3",
            "Processor": "Intel(R) Xeon(R) Silver 4216 CPU @ 2.10GHz",
            "Processors": 4
        }
    ],
    "McAfee": {
        "ePO": {
            "Endpoint": [
                {
                    "AgentGUID": null,
                    "AgentVersion": null,
                    "AutoID": 2,
                    "CPUSerialNum": "",
                    "CPUSpeed": 0,
                    "CPUType": "",
                    "ComputerName": "10.0.0.1",
                    "DefaultLangID": "",
                    "Description": null,
                    "DomainName": "",
                    "ExcludedTags": "",
                    "FreeDiskSpace": 0,
                    "FreeMemory": 0,
                    "Hostname": "",
                    "IPAddress": "",
                    "IPSubnet": null,
                    "IPSubnetMask": null,
                    "IPV4x": null,
                    "IPV6": null,
                    "IPXAddress": "",
                    "LastUpdate": null,
                    "ManagedState": 0,
                    "NetAddress": "",
                    "NumOfCPU": 0,
                    "OSBuildNum": 0,
                    "OSOEMID": "",
                    "OSPlatform": "",
                    "OSServicePackVer": "",
                    "OSType": "",
                    "OSVersion": "",
                    "ParentID": 7,
                    "SubnetAddress": "",
                    "SubnetMask": "",
                    "SystemDescription": null,
                    "SysvolFreeSpace": 0,
                    "SysvolTotalSpace": 0,
                    "Tags": "Scan Now",
                    "TimeZone": "",
                    "TotalDiskSpace": 0,
                    "TotalPhysicalMemory": 0,
                    "UserName": "",
                    "UserProperty1": null,
                    "UserProperty2": null,
                    "UserProperty3": null,
                    "UserProperty4": null,
                },
                {
                    "AgentGUID": "CA0CE11A-DCE8-11E8-0805-000C2994FF62
                    "AutoID": 2,
                    "CPUSerialNum": "N/A",
                    "CPUSpeed": 2095,
                    "CPUType": "Intel(R) Xeon(R) Silver 4216 CPU @ 2.10GHz",
                    "ComputerName": "WIN-AQ0LQQOG4Q7",
                    "DefaultLangID": "0409",
                    "Description": null,
                    "DomainName": "WORKGROUP",
                    "ExcludedTags": "",
                    "FreeDiskSpace": 145005,
                    "FreeMemory": 1195880448,
                    "Hostname": "",
                    "IPAddress": "",
                    "IPV4x": null,
                    "IPXAddress": "N/A",
                    "LastUpdate": "2021-12-16T14:44:41-08:00",
                    "ManagedState": 1,
                    "NetAddress": "",
                    "NumOfCPU": 4,
                    "OSBuildNum": 9600,
                    "OSOEMID": "00252-00112-50691-AA377",
                    "OSPlatform": "Server",
                    "OSServicePackVer": "",
                    "OSType": "Windows Server 2012 R2",
                    "OSVersion": "6.3",
                    "ParentID": 17,
                    "SubnetAddress": "",
                    "SubnetMask": "",
                    "SystemDescription": "N/A",
                    "SysvolFreeSpace": 145005,
                    "SysvolTotalSpace": 204447,
                    "Tags": "Server",
                    "TimeZone": "Pacific Standard Time",
                    "TotalDiskSpace": 204447,
                    "TotalPhysicalMemory": 8589398016,
                    "UserName": "Administrator",
                    "UserProperty1": null,
                    "UserProperty2": null,
                    "UserProperty3": null,
                    "UserProperty4": null,
                }
            ]
        }
    }
}

Human Readable Output

Endpoint information

Memory	Name	Processors
0	10.0.0.1	0

epo-find-system

Finds systems in the McAfee ePO system tree.

Base Command

epo-find-system

Input

Context Output

Command Example

!epo-find-system searchText="TIE"

Context Example

{
    "Endpoint": {
        "Domain": "(none)",
        "ID": "tie",
        "IPAddress": "192.168.1.102",
        "Memory": 8364199936,
        "OS": "Linux",
        "OSVersion": "4.9",
        "Processor": "Intel(R) Xeon(R) CPU E5-2697A v4 @ 2.60GHz",
        "Processors": 8
    },
    "McAfee": {
        "ePO": {
            "Endpoint": {
                "AgentGUID": "E0F52A7C-A841-11E7-0467-000C2936A49A",
                "AutoID": 3,
                "CPUSerialNum": "N/A",
                "CPUSpeed": 2600,
                "CPUType": "Intel(R) Xeon(R) CPU E5-2697A v4 @ 2.60GHz",
                "ComputerName": "tie",
                "DefaultLangID": "0409",
                "Description": null,
                "DomainName": "(none)",
                "ExcludedTags": "",
                "FreeDiskSpace": 93781,
                "FreeMemory": 240263168,
                "Hostname": "tie",
                "IPV4x": 1084752230,
                "IPXAddress": "N/A",
                "LastUpdate": "2021-12-16T14:19:25-08:00",
                "ManagedState": 1,
                "NetAddress": "000C29B1EE8E",
                "NumOfCPU": 8,
                "OSBuildNum": 0,
                "OSOEMID": "McAfee TIE Platform Server 3.0.0.480",
                "OSPlatform": "Server",
                "OSServicePackVer": "189-1.mlos2.x86_64",
                "OSType": "Linux",
                "OSVersion": "4.9",
                "ParentID": 2,
                "SubnetAddress": "",
                "SubnetMask": "",
                "SystemDescription": "N/A",
                "SysvolFreeSpace": 0,
                "SysvolTotalSpace": 0,
                "Tags": "DXLBROKER, Server, TIESERVER",
                "TimeZone": "UTC",
                "TotalDiskSpace": 104488,
                "TotalPhysicalMemory": 8364199936,
                "UserName": "root",
                "UserProperty1": null,
                "UserProperty2": null,
                "UserProperty3": null,
                "UserProperty4": null,
            }
        }
    }
}

Human Readable Output

Systems in the System Tree

Name	Domain	Hostname	IPAddress	OS	OSVersion	Processor	Processors	Memory
tie	(none)	tie	192.168.1.102	Linux	4.9	Intel(R) Xeon(R) CPU E5-2697A v4 @ 2.60GHz	8	8364199936

epo-wakeup-agent

Wakes up an agent.

Base Command

epo-wakeup-agent

Input

Context Output

There is no context output for this command.

Command Example

!epo-wakeup-agent names="TIE"

Human Readable Output

ePO agents was awaken

Completed	Failed	Expired
1	0	0

epo-apply-tag

Applies a tag to the specified host names.

Base Command

epo-apply-tag

Input

Context Output

There is no context output for this command.

Command Example

!epo-apply-tag names="TIE" tagName="Server"

Human Readable Output

ePO could not find server or server already assigned to the given tag.

epo-clear-tag

Clears a tag from the specified host names.

Base Command

epo-clear-tag

Input

Context Output

There is no context output for this command.

Command Example

!epo-clear-tag names="TIE" tagName="MARSERVER"

Human Readable Output

ePO could not find server or server already assigned to the given tag.

epo-list-tag

List tags that contain the searchText. If no searchText is specified, list all tags available in the ePO system.

Base Command

epo-list-tag

Input

Context Output

Command Example

!epo-list-tag searchText="server"

Context Example

{
    "McAfee": {
        "ePO": {
            "Tags": [
                {
                    "tagId": 1,
                    "tagName": "Server",
                    "tagNotes": "Default tag for systems identified as a Server"
                },
                {
                    "tagId": 4,
                    "tagName": "TIESERVER",
                    "tagNotes": "Apply Tag to TIEServers"
                },
                {
                    "tagId": 5,
                    "tagName": "MARSERVER",
                    "tagNotes": "Apply Tag to Active Response Server"
                }
            ]
        }
    }
}

Human Readable Output

ePO Tags

tagId	tagName	tagNotes
1	Server	Default tag for systems identified as a Server
4	TIESERVER	Apply Tag to TIEServers
5	MARSERVER	Apply Tag to Active Response Server

epo-get-tables

Returns the ePO table of the table argument that is specified. If no table argument is specified, returns all ePO tables.

Base Command

epo-get-tables

Input

Context Output

There is no context output for this command.

Command Example

!epo-get-tables table="Client Events"

Human Readable Output

ePO tables

name	target	type	databaseType	description	columns	relatedTables	foreignKeys
Client Events	EPOProductEvents	target		Retrieves information on client events from managed systems.	Name Type Select? Condition? GroupBy? Order? Number? ————- ————– ——- ———- ——– —— ——- AutoID long False False False True True AgentGUID string True False False True False NodeID int False False False True True TVDEventID eventIdInt True True True True True TVDSeverity enum True True True True False ReceivedUTC timestamp True True True True False DetectedUTC timestamp True True True True False HostName string True True True True False UserName string True True True True False IPV6 ipv6 True True True True False ProductCode string False False False True False version productVersion True True True True False SPHotFix string True True True True False ExtraDATNames string True True True True False Type string_lookup True True True True False Error enum True True True True False Locale int True True True True True SiteName string True True True True False InitiatorID string True True True True False InitiatorType string_lookup True True True True False TenantId int False False False True True	Name —————— EPOLeafNode EPOSoftwareView EPOEventFilterDesc	Source table Source Columns Destination table Destination columns Allows inverse? One-to-one? Many-to-one? —————- ————– —————– ——————- ————— ———– ———— EPOProductEvents AgentGUID EPOLeafNode AgentGUID False False True EPOProductEvents TVDEventID EPOEventFilterDesc EventId False False True EPOProductEvents ProductCode EPOSoftwareView ProductCode False False True

epo-query-table

Queries an ePO table.

Base Command

epo-query-table

Input

Context Output

Command Example

!epo-query-table target="FW_Rule" query_name="Test Query"

Context Example

{
    "McAfee": {
        "ePO": {
            "Query": {
                "Test Query": [
                        {
                            "FW_Rule.action": "JUMP",
                            "FW_Rule.direction": "EITHER",
                            "FW_Rule.enabled": 1,
                            "FW_Rule.intrusion": false,
                            "FW_Rule.lastModified": "2014-06-20T11:42:38-07:00",
                            "FW_Rule.lastModifyingUsername": "system",
                            "FW_Rule.localServiceList": "",
                            "FW_Rule.mediaFlags": 7,
                            "FW_Rule.name": "Outlook",
                            "FW_Rule.note": "",
                            "FW_Rule.remoteServiceList": "",
                            "FW_Rule.schedule_end": "0:00",
                            "FW_Rule.schedule_offHours": "NONE",
                            "FW_Rule.schedule_start": "0:00",
                            "FW_Rule.trafficLogged": false,
                            "FW_Rule.transportProtocol": 1024
                        },
                        {
                            "FW_Rule.action": "ALLOW",
                            "FW_Rule.direction": "IN",
                            "FW_Rule.enabled": 1,
                            "FW_Rule.intrusion": false,
                            "FW_Rule.lastModified": "2010-03-29T11:54:22-07:00",
                            "FW_Rule.lastModifyingUsername": "admin",
                            "FW_Rule.localServiceList": "0",
                            "FW_Rule.mediaFlags": 7,
                            "FW_Rule.name": "Allow ICMP Echo Reply Incoming for Services",
                            "FW_Rule.note": "",
                            "FW_Rule.remoteServiceList": "",
                            "FW_Rule.schedule_end": "0:00",
                            "FW_Rule.schedule_offHours": "NONE",
                            "FW_Rule.schedule_start": "0:00",
                            "FW_Rule.trafficLogged": false,
                            "FW_Rule.transportProtocol": 1
                        },
                        {
                            "FW_Rule.action": "BLOCK",
                            "FW_Rule.direction": "IN",
                            "FW_Rule.enabled": 1,
                            "FW_Rule.intrusion": false,
                            "FW_Rule.lastModified": "2009-10-22T17:32:08-07:00",
                            "FW_Rule.lastModifyingUsername": "admin",
                            "FW_Rule.localServiceList": "",
                            "FW_Rule.mediaFlags": 7,
                            "FW_Rule.name": "Block System TCP Incoming",
                            "FW_Rule.note": "",
                            "FW_Rule.remoteServiceList": "",
                            "FW_Rule.schedule_end": "0:00",
                            "FW_Rule.schedule_offHours": "NONE",
                            "FW_Rule.schedule_start": "0:00",
                            "FW_Rule.trafficLogged": false,
                            "FW_Rule.transportProtocol": 6
                        }
                    ]
                }
            }
        }
    }
}

Human Readable Output

ePO Table Query

FW_Rule.localServiceList	FW_Rule.trafficLogged	FW_Rule.lastModifyingUsername	FW_Rule.transportProtocol	FW_Rule.remoteServiceList	FW_Rule.name	FW_Rule.schedule_offHours	FW_Rule.note	FW_Rule.schedule_start	FW_Rule.mediaFlags	FW_Rule.intrusion	FW_Rule.schedule_end	FW_Rule.action	FW_Rule.direction	FW_Rule.lastModified	FW_Rule.enabled
	false	system	1024		Outlook	NONE		0:00	7	false	0:00	JUMP	EITHER	2014-06-20T11:42:38-07:00	1
0	false	admin	1		Allow ICMP Echo Reply Incoming for Services	NONE		0:00	7	false	0:00	ALLOW	IN	2010-03-29T11:54:22-07:00	1
	false	admin	6		Block System TCP Incoming	NONE		0:00	7	false	0:00	BLOCK	IN	2009-10-22T17:32:08-07:00	1

epo-get-version

Returns the ePO version.

Base Command

epo-get-version

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Command Example

#### Context Example

```json
{
    "McAfee": {
        "ePO": {
            "Version": "5.3.2"
        }
    }
}

Human Readable Output

ePO version is: 5.3.2

epo-move-system

Moves a system to a different group in the McAfee ePO.

Base Command

epo-move-system

Input

Context Output

There is no context output for this command.

Command Example

!epo-move-system names="TIE" parentGroupId="3"

Human Readable Output

System(s) TIE moved successfully to GroupId 3

epo-advanced-command

Executes the ePO command. Run the ‘epo-help’ command to get a list of available commands. For example/:/ !epo-advanced-command command=clienttask.find commandArgs=searchText:On-Demand. You can specify the ‘headers’ argument to filter table headers, for example/:/ !epo-command command=system.find searchText=10.0.0.1 headers=EPOBranchNode.AutoID,EPOComputerProperties.ComputerName.

Base Command

epo-advanced-command

Input

Context Output

There is no context output for this command.

Command Example

!epo-advanced-command command="clienttask.find" commandArgs="searchText:On-Demand"

Human Readable Output

ePO command clienttask.find results

objectName	productId	productName	objectId	typeName	typeId
On-Demand Scan - Full Scan	ENDP_AM_1000	Endpoint Security Threat Prevention	26	Endpoint Security Threat Prevention: Policy Based On-Demand Scan	11
On-Demand Scan - Quick Scan	ENDP_AM_1000	Endpoint Security Threat Prevention	27	Endpoint Security Threat Prevention: Policy Based On-Demand Scan	11

epo-find-client-task

Finds client tasks.

Base Command

epo-find-client-task

Input

Context Output

Command Example

!epo-find-client-task searchText="On-Demand"

Context Example

{
    "McAfee": {
        "ePO": {
            "ClientTask": [
                {
                    "objectId": 26,
                    "objectName": "On-Demand Scan - Full Scan",
                    "productId": "ENDP_AM_1000",
                    "productName": "Endpoint Security Threat Prevention ",
                    "typeId": 11,
                    "typeName": "Endpoint Security Threat Prevention: Policy Based On-Demand Scan"
                },
                {
                    "objectId": 27,
                    "objectName": "On-Demand Scan - Quick Scan",
                    "productId": "ENDP_AM_1000",
                    "productName": "Endpoint Security Threat Prevention ",
                    "typeId": 11,
                    "typeName": "Endpoint Security Threat Prevention: Policy Based On-Demand Scan"
                }
            ]
        }
    }
}

Human Readable Output

ePO Client Tasks

productName	objectName	productId	typeId	objectId	typeName
Endpoint Security Threat Prevention	On-Demand Scan - Full Scan	ENDP_AM_1000	11	26	Endpoint Security Threat Prevention: Policy Based On-Demand Scan
Endpoint Security Threat Prevention	On-Demand Scan - Quick Scan	ENDP_AM_1000	11	27	Endpoint Security Threat Prevention: Policy Based On-Demand Scan

epo-find-policy

Finds policy.

Base Command

epo-find-policy

Input

Context Output

There is no context output for this command.

Command Example

!epo-find-policy searchText="On-Access"

Context Example

{
    "McAfee": {
        "ePO": {
            "Policy": [
                {
                    "featureId": "ENDP_AM_1000",
                    "featureName": " Policy Category",
                    "objectId": 84,
                    "objectName": "McAfee Default",
                    "objectNotes": "",
                    "productId": "ENDP_AM_1000",
                    "productName": "Endpoint Security Threat Prevention ",
                    "typeId": 40,
                    "typeName": "On-Access Scan"
                },
                {
                    "featureId": "ENDP_AM_1000",
                    "featureName": " Policy Category",
                    "objectId": 86,
                    "objectName": "On-Access Scan for Exchange",
                    "objectNotes": "",
                    "productId": "ENDP_AM_1000",
                    "productName": "Endpoint Security Threat Prevention ",
                    "typeId": 40,
                    "typeName": "On-Access Scan"
                },
                {
                    "featureId": "ENDP_AM_1000",
                    "featureName": " Policy Category",
                    "objectId": 90,
                    "objectName": "My Default",
                    "objectNotes": "",
                    "productId": "ENDP_AM_1000",
                    "productName": "Endpoint Security Threat Prevention ",
                    "typeId": 40,
                    "typeName": "On-Access Scan"
                }
            ]
        }
    }
}

Human Readable Output

ePO Policies

objectName	featureName	productId	productName	objectId	typeName	featureId	typeId
McAfee Default	Policy Category	ENDP_AM_1000	Endpoint Security Threat Prevention	84	On-Access Scan	ENDP_AM_1000	40
On-Access Scan for Exchange	Policy Category	ENDP_AM_1000	Endpoint Security Threat Prevention	86	On-Access Scan	ENDP_AM_1000	40
My Default	Policy Category	ENDP_AM_1000	Endpoint Security Threat Prevention	90	On-Access Scan	ENDP_AM_1000	40

epo-assign-policy-to-group

Assigns a policy to the specified group or resets the group’s inheritance for the specified policy.

Base Command

epo-assign-policy-to-group

Input

Context Output

There is no context output for this command.

Command Example

!epo-assign-policy-to-group groupId="2" productId="ENDP_AM_1000" objectId="86"

Human Readable Output

Policy productId:ENDP_AM_1000 objectId:86 assigned successfully to GroupId 2

epo-assign-policy-to-system

Assigns a policy to a supplied list of systems or resets the systems’ inheritance for the specified policy.

Base Command

epo-assign-policy-to-system

Input

Context Output

There is no context output for this command.

Command Example

!epo-assign-policy-to-system names="TIE" productId="ENDP_AM_1000" typeId="40" objectId="84"

Human Readable Output

ePO Policies

status	name	message	id
0	TIE	Assign policy succeeded	2

epo-list-issues

List the issue for the ID that is specified. If no ID is specified, list all issues in the McAfee ePO system.

Base Command

epo-list-issues

Input

Context Output

Command Example

#### Context Example

```json
{
    "McAfee": {
        "ePO": {
            "Issue": [
                {
                    "activityLog": [
                        {
                            "date": "2021-05-09T03:36:56-07:00",
                            "details": "",
                            "id": 1,
                            "issueId": 1,
                            "title": "Issue Created",
                            "username": "admin"
                        }
                    ],
                    "assignee": null,
                    "assigneeName": "dxl",
                    "createdDate": "2021-05-09T03:36:56-07:00",
                    "creatorName": "admin",
                    "description": "aaaa",
                    "dueDate": null,
                    "id": 1,
                    "name": "aaaa",
                    "priority": "MEDIUM",
                    "resolution": "NONE",
                    "severity": "LOWEST",
                    "state": "NEW",
                    "subtype": null,
                    "ticketId": null,
                    "ticketServerName": null,
                    "type": "issue.type.untyped"
                },
                {
                    "activityLog": [
                        {
                            "date": "2021-11-23T00:46:25-08:00",
                            "details": "",
                            "id": 2,
                            "issueId": 2,
                            "title": "Issue Created",
                            "username": "admin"
                        },
                        {
                            "date": "2021-11-23T23:26:20-08:00",
                            "details": "assignee changed from test_api to admin",
                            "id": 3,
                            "issueId": 2,
                            "title": "Issue Changed",
                            "username": "admin"
                        },
                        {
                            "date": "2021-11-23T23:32:08-08:00",
                            "details": "yakovi",
                            "id": 4,
                            "issueId": 2,
                            "title": "User Comment",
                            "username": "admin"
                        }
                    ],
                    "assignee": null,
                    "assigneeName": "admin",
                    "createdDate": "2021-11-23T00:46:25-08:00",
                    "creatorName": "admin",
                    "description": "test1",
                    "dueDate": null,
                    "id": 2,
                    "name": "Wissam",
                    "priority": "HIGH",
                    "resolution": "NONE",
                    "severity": "MEDIUM",
                    "state": "NEW",
                    "subtype": null,
                    "ticketId": null,
                    "ticketServerName": null,
                    "type": "issue.type.untyped"
                }
            ]
        }
    }
}

Human Readable Output

ePO Issue List

ticketId	dueDate	createdDate	creatorName	resolution	subtype	assigneeName	description	priority	type	ticketServerName	name	assignee	severity	activityLog	id	state
		2021-05-09T03:36:56-07:00	admin	NONE		dxl	aaaa	MEDIUM	issue.type.untyped		aaaa		LOWEST	{‘date’: ‘2021-05-09T03:36:56-07:00’, ‘details’: ‘’, ‘id’: 1, ‘issueId’: 1, ‘title’: ‘Issue Created’, ‘username’: ‘admin’}	1	NEW
		2021-11-23T00:46:25-08:00	admin	NONE		admin	test1	HIGH	issue.type.untyped		Wissam		MEDIUM	{‘date’: ‘2021-11-23T00:46:25-08:00’, ‘details’: ‘’, ‘id’: 2, ‘issueId’: 2, ‘title’: ‘Issue Created’, ‘username’: ‘admin’}, {‘date’: ‘2021-11-23T23:26:20-08:00’, ‘details’: ‘assignee changed from test_api to admin’, ‘id’: 3, ‘issueId’: 2, ‘title’: ‘Issue Changed’, ‘username’: ‘admin’}, {‘date’: ‘2021-11-23T23:32:08-08:00’, ‘details’: ‘yakovi’, ‘id’: 4, ‘issueId’: 2, ‘title’: ‘User Comment’, ‘username’: ‘admin’}	2	NEW

epo-delete-issue

Delete an issue.

Base Command

epo-delete-issue

Input

Context Output

There is no context output for this command.

Command Example

!epo-delete-issue id=8

Human Readable Output

Issue with id=0 was deleted

epo-create-issue

Create an issue.

Base Command

epo-create-issue

Input

Context Output

Command Example

!epo-create-issue name="test-epo-integration" description="automatically generated by epo integration" assignee_name="admin"

Context Example

{
    "McAfee": {
        "ePO": {
            "Issue": {
                
                    "description": "automatically generated by epo integration",
                    "id": 35,
                    "name": "test-epo-integration"
            }
        }
    }
}

Human Readable Output

Issue with the following ID: 35 was created successfully

epo-update-issue

Update an issue.

Base Command

epo-update-issue

Input

Context Output

There is no context output for this command.

Command Example

!epo-update-issue id=10 name="test" description="testing epo integration" state="NEW"

Human Readable Output

Issue with id=10 was updated