McAfeeNSMv2

McAfee Network Security Manager gives you real-time visibility and control over all McAfee intrusion prevention systems deployed across your network.

Category

Utilities

Pack

McAfeeNSM

Configuration parameters

• url — URL (for example: https://192.168.0.1:5000) (required)
• credentials — User Name (required)
• version — Product Version
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings

Commands (28)

• nsm-assign-device-policy — Assign a policy to a specific device.
• nsm-assign-interface-policy — Assign a policy to a specific interface.
• nsm-create-firewall-policy — Adds a new firewall policy and access rules. You have to provide at lease one of the source/destination rule objects. If you provide the id or type of the source/destination rule object, you must provide the matching type or id the source/destination rule object as well.
• nsm-create-rule-object — Adds a new rule object. If the type is “Endpoint IP V.X” or “Network IP V.X”, only the argument “address_ip_v.X” must contain a value. If the type is “Range IP V.X”, only the arguments “from_address_ip_v.X”, “to_address_ip_v.X” must contain a value. Where X is 4 or 6 respectively.
• nsm-delete-firewall-policy — Deletes the specified firewall policy.
• nsm-delete-rule-object — Deletes a rule object.
• nsm-deploy-device-configuration — Deploy the pending changes. Note: In order to avoid extra run time, it is recommended to deploy only the changes that are pending. To get the pending changes, use the !nsm-get-device-configuration command.
• nsm-export-pcap-file — Exports the captured PCAP file.
• nsm-get-alert-details — Retrieves the relevant alert details.
• nsm-get-alerts — Retrieves the alerts.
• nsm-get-attacks — If an attack is given, the command returns the details for the specific attack. Otherwise, gets all available attack definitions in the Manager UI. This command can take a few minutes. If you get a timeout error, increase the timeout by using the parameter "execution-timeout".
• nsm-get-device-configuration — Provides configuration information of a given device.
• nsm-get-domains — If a domain ID is given, the command returns the details of the specific domain. Otherwise, gets all available domains.
• nsm-get-firewall-policy — Gets the firewall policy details.
• nsm-get-ips-policies — Gets all the IPS policies defined in the specific domain.
• nsm-get-ips-policy-details — Gets all the IPS policies defined in the specific domain.
• nsm-get-rule-object — Gets the details of a rule object.
• nsm-get-sensors — Gets the list of sensors available in the specified domain. If the domain is not specified, details of all the sensors in all ADs will be provided.
• nsm-list-device-interface — List the interfaces related to a given device.
• nsm-list-device-policy — List all the policies assigned to a domain or a specific device.
• nsm-list-domain-device — List the devices related to a given domain.
• nsm-list-domain-firewall-policy — Gets the list of firewall policies defined in a particular domain.
• nsm-list-domain-rule-object — Gets the list of rule objects defined in a particular domain.
• nsm-list-interface-policy — List all the policies assigned to all interfaces or a specific interface.
• nsm-list-pcap-file — Retrieves the list of captured PCAP files.
• nsm-update-alerts — Update state or assignee of alerts. It is required to provide at least one of them. If none of the alerts match the time_period they won't be updated.
• nsm-update-firewall-policy — Updates the firewall policy details. If the argument is_overwrite=true, the new values of the provided addresses will replace the existing values, otherwise the addresses will be added to them. If you want to delete a rule, enter is_overwrite=true and the relevant rule_object_id=-1. If is_overwrite=false and there is no value in one of the rules (source or destination), their value will be as before. If is_overwrite=true, at least one of the rules (source or destination) must be provided. If you provide the id or type of the source/destination rule object, you must provide the matching type or id the source/destination rule object as well.
• nsm-update-rule-object — Updates a Rule object. In case of address rule update, if the rule type is “Endpoint IP V.X” or “Network IP V.X”, only the argument “address_ip_v.X” should contain a value. If the type is “Range IP V.X”, only the arguments “from_address_ip_v.X”, “to_address_ip_v.X” should contain a value, where X is 4 or 6 respectively.