MAR - Endpoint data collection

Use McAfee Active Response to collect data from an endpoint for IR purposes (requires ePO as well). Input: * Hostname (Default: ${Endpoint.Hostname})

McAfee Active Response · 27 tasks · 1 input · 0 outputs

Inputs

  • Hostname — Hostname to run on.

Commands used

epo-find-system mar-search-multiple

Flowchart

yes yes Start Start Done Done Is McAfee MAR enabled? - Exists Is McAfee MAR enabled? Exists Get host Processes - mar-search-multiple Get host Processes mar-search-multiple Get host Scheduled tasks - mar-search-multiple Get host Scheduled tasks mar-search-multiple Get host services - mar-search-multiple Get host services mar-search-multiple Get host Command line history - mar-search-multiple Get host Command line his... mar-search-multiple Get host "Current flow" - mar-search-multiple Get host "Current flow" mar-search-multiple Get host DNS cache - mar-search-multiple Get host DNS cache mar-search-multiple Get host environment variables - mar-search-multiple Get host environment vari... mar-search-multiple Get host local groups - mar-search-multiple Get host local groups mar-search-multiple Get host logged in users - mar-search-multiple Get host logged in users mar-search-multiple Get host network shares - mar-search-multiple Get host network shares mar-search-multiple Get host interactive sessions - mar-search-multiple Get host interactive sess... mar-search-multiple Get host network interfaces - mar-search-multiple Get host network interfaces mar-search-multiple Get host's connected USB Storage Devices - mar-search-multiple Get host's connected USB ... mar-search-multiple Get host user profiles - mar-search-multiple Get host user profiles mar-search-multiple Get host installed software - mar-search-multiple Get host installed software mar-search-multiple Get host Network Sessions - mar-search-multiple Get host Network Sessions mar-search-multiple Get host Startup items - mar-search-multiple Get host Startup items mar-search-multiple Collect data from endpoint Collect data from endpoint Users and groups Users and groups Executable Executable Network Network Others Others Is McAfee ePO v2 enabled? Is McAfee ePO v2 enabled? Get host info from ePO v2 - epo-find-system Get host info from ePO v2 epo-find-system