McAfee ESM v2

This integration runs queries and receives alarms from McAfee Enterprise Security Manager (ESM). Supports version 10 and above.

Category

Analytics & SIEM

Pack

McAfee_ESM

Configuration parameters

• url — Base URL (e.g. https://example.com) (required)
• credentials — Username (required)
• version — Version: (one of 10.0, 10.1, 10.2, 10.3, 11.1, 11.3) (required)
• isFetch — Fetch incidents
• incidentType — Incident type
• incidentFetchInterval — Incidents Fetch Interval
• fetchType — Fetch Types: cases, alarms, both (relevant only for fetch incident mode)
• startingFetchID — Start fetch after ID: (relevant only for fetch incident mode)
• fetchLimitCases — Fetch cases limit
• fetchTime — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
• fetchLimitAlarms — Fetch alarms limit
• timezone — McAfee ESM Timezone in hours (e.g if ESM timezone is +0300 => then insert 3)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings

Commands (25)

• esm-acknowledge-alarms — Marks triggered alarms, as acknowledged.
• esm-add-case — Adds a case to the system.
• esm-add-case-status — Adds a status to the specified case.
• esm-create-watchlist — Creates a new watchlist.
• esm-delete-alarms — Deletes triggered alarms.
• esm-delete-case-status — Deletes the status of a case.
• esm-delete-watchlist — Deletes a watchlist.
• esm-edit-case — Edit the details of an existing case.
• esm-edit-case-status — Edits the status of a case.
• esm-fetch-alarms — Retrieves a list of triggered alarms.
• esm-fetch-fields — Returns all fields that can be used in query filters, including type information for each field.
• esm-get-alarm-event-details — Gets the details for the triggered alarm.
• esm-get-case-detail — Returns the details of an existing case.
• esm-get-case-event-list — Returns case event details.
• esm-get-case-list — Returns a list of cases from McAfee ESM.
• esm-get-case-statuses — Returns a list of valid case statuses from the system.
• esm-get-organization-list — Returns a case organization.
• esm-get-user-list — Returns a list of all users.
• esm-get-watchlists — Returns a list of watchlists' names and IDs.
• esm-list-alarm-events — Gets a list of events related to the alarm.
• esm-search — Perform a query against McAfee ESM SIEM.
• esm-unacknowledge-alarms — Marks triggered alarms, as unacknowledged.
• esm-watchlist-add-entry — Creates a new watchlist entry.
• esm-watchlist-delete-entry — Deletes a watchlist entry.
• esm-watchlist-list-entries — Returns a list of watchlist entries.