MAR - Endpoint data collection

Use McAfee Active Response to collect data from an endpoint for IR purposes (requires ePO as well). Input: * Hostname (Default: ${Endpoint.Hostname})

McAfee Active Response · 27 tasks · 1 input · 0 outputs

Details

IDMAR - Endpoint data collection
From Version5.0.0
Tasks27

README

Use McAfee Active Response to collect data from an endpoint for IR purposes (requires ePO as well).

Input:

  • Hostname (Default: ${Endpoint.Hostname})

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • McAfee ePO v2
  • McAfee Active Response

Scripts

  • Exists

Commands

  • mar-search-multiple
  • epo-find-system

Playbook Inputs

Name Description Default Value Required
Hostname Hostname to run on. Endpoint.Hostname Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

MAR - Endpoint data collection

Inputs

  • Hostname — Hostname to run on.

Commands used

epo-find-system mar-search-multiple

Flowchart

yes yes Start Start Done Done Is McAfee MAR enabled? - Exists Is McAfee MAR enabled? Exists Get host Processes - mar-search-multiple Get host Processes mar-search-multiple Get host Scheduled tasks - mar-search-multiple Get host Scheduled tasks mar-search-multiple Get host services - mar-search-multiple Get host services mar-search-multiple Get host Command line history - mar-search-multiple Get host Command line his... mar-search-multiple Get host "Current flow" - mar-search-multiple Get host "Current flow" mar-search-multiple Get host DNS cache - mar-search-multiple Get host DNS cache mar-search-multiple Get host environment variables - mar-search-multiple Get host environment vari... mar-search-multiple Get host local groups - mar-search-multiple Get host local groups mar-search-multiple Get host logged in users - mar-search-multiple Get host logged in users mar-search-multiple Get host network shares - mar-search-multiple Get host network shares mar-search-multiple Get host interactive sessions - mar-search-multiple Get host interactive sess... mar-search-multiple Get host network interfaces - mar-search-multiple Get host network interfaces mar-search-multiple Get host's connected USB Storage Devices - mar-search-multiple Get host's connected USB ... mar-search-multiple Get host user profiles - mar-search-multiple Get host user profiles mar-search-multiple Get host installed software - mar-search-multiple Get host installed software mar-search-multiple Get host Network Sessions - mar-search-multiple Get host Network Sessions mar-search-multiple Get host Startup items - mar-search-multiple Get host Startup items mar-search-multiple Collect data from endpoint Collect data from endpoint Users and groups Users and groups Executable Executable Network Network Others Others Is McAfee ePO v2 enabled? Is McAfee ePO v2 enabled? Get host info from ePO v2 - epo-find-system Get host info from ePO v2 epo-find-system

Source

playbook-MAR_-_Endpoint_data_collection.yml
Download History Raw 
id: MAR - Endpoint data collection
version: -1
name: MAR - Endpoint data collection
description: |-
  Use McAfee Active Response to collect data from an endpoint for IR purposes (requires ePO as well).

  Input:
  * Hostname (Default: ${Endpoint.Hostname})
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 14834984-3a59-4eed-8de7-54179611c63d
    type: start
    task:
      id: 14834984-3a59-4eed-8de7-54179611c63d
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 705,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: fed35557-6859-44e6-817a-ee0538819714
    type: title
    task:
      id: fed35557-6859-44e6-817a-ee0538819714
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 71f42a72-b2e7-479a-86e7-bc6ff218671e
    type: condition
    task:
      id: 71f42a72-b2e7-479a-86e7-bc6ff218671e
      version: -1
      name: Is McAfee MAR enabled?
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
      description: Is the McAfee MAR integration installed and configured?
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "26"
    scriptarguments:
      value:
        simple: ${modules(val.brand=="McAfee Active Response")}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1122,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: d3c21d0d-fc2a-4ba5-8bb9-da70f49ae96c
    type: regular
    task:
      id: d3c21d0d-fc2a-4ba5-8bb9-da70f49ae96c
      version: -1
      name: Get host Processes
      script: McAfee Active Response|||mar-search-multiple
      type: regular
      iscommand: true
      brand: McAfee Active Response
      description: Search endpoint data crossed by multiple collectors.
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      collector:
        simple: Processes
      collectors:
        simple: HostInfo,Processes
      filter-by:
        simple: hostname
      filter-operator:
        simple: Equals
      filter-value:
        complex:
          root: inputs.Hostname
      filter_collector:
        simple: HostInfo
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 835
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 98827aec-511a-4f30-8fdb-04240496380d
    type: regular
    task:
      id: 98827aec-511a-4f30-8fdb-04240496380d
      version: -1
      name: Get host Scheduled tasks
      script: McAfee Active Response|||mar-search-multiple
      type: regular
      iscommand: true
      brand: McAfee Active Response
      description: Search endpoint data crossed by multiple collectors.
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      collector:
        simple: Processes
      collectors:
        simple: HostInfo,ScheduledTasks
      filter-by:
        simple: hostname
      filter-operator:
        simple: Equals
      filter-value:
        complex:
          root: inputs.Hostname
      filter_collector:
        simple: HostInfo
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 38ad462f-1c16-4c4a-8cd8-446e19c24694
    type: regular
    task:
      id: 38ad462f-1c16-4c4a-8cd8-446e19c24694
      version: -1
      name: Get host services
      script: McAfee Active Response|||mar-search-multiple
      type: regular
      iscommand: true
      brand: McAfee Active Response
      description: Search endpoint data crossed by multiple collectors.
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      collector:
        simple: Processes
      collectors:
        simple: HostInfo,Services
      filter-by:
        simple: hostname
      filter-operator:
        simple: Equals
      filter-value:
        complex:
          root: inputs.Hostname
      filter_collector:
        simple: HostInfo
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 6e9fb885-21b5-417d-800c-e02aa81cb91f
    type: regular
    task:
      id: 6e9fb885-21b5-417d-800c-e02aa81cb91f
      version: -1
      name: Get host Command line history
      script: McAfee Active Response|||mar-search-multiple
      type: regular
      iscommand: true
      brand: McAfee Active Response
      description: Search endpoint data crossed by multiple collectors.
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      collector:
        simple: Processes
      collectors:
        simple: HostInfo,CommandLineHistory
      filter-by:
        simple: hostname
      filter-operator:
        simple: Equals
      filter-value:
        complex:
          root: inputs.Hostname
      filter_collector:
        simple: HostInfo
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 1185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 69f8efa1-8783-4165-8ce4-2f5e0f3db937
    type: regular
    task:
      id: 69f8efa1-8783-4165-8ce4-2f5e0f3db937
      version: -1
      name: Get host "Current flow"
      script: McAfee Active Response|||mar-search-multiple
      type: regular
      iscommand: true
      brand: McAfee Active Response
      description: Search endpoint data crossed by multiple collectors.
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      collector:
        simple: Processes
      collectors:
        simple: HostInfo,CurrentFlow
      filter-by:
        simple: hostname
      filter-operator:
        simple: Equals
      filter-value:
        complex:
          root: inputs.Hostname
      filter_collector:
        simple: HostInfo
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1042.5,
          "y": 660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 08612fec-a2cb-4b1c-8a10-e8148722075f
    type: regular
    task:
      id: 08612fec-a2cb-4b1c-8a10-e8148722075f
      version: -1
      name: Get host DNS cache
      script: McAfee Active Response|||mar-search-multiple
      type: regular
      iscommand: true
      brand: McAfee Active Response
      description: Search endpoint data crossed by multiple collectors.
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      collector:
        simple: Processes
      collectors:
        simple: HostInfo,DNSCache
      filter-by:
        simple: hostname
      filter-operator:
        simple: Equals
      filter-value:
        complex:
          root: inputs.Hostname
      filter_collector:
        simple: HostInfo
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1042.5,
          "y": 835
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 5479417e-4e95-422a-8e92-4f585f40fd50
    type: regular
    task:
      id: 5479417e-4e95-422a-8e92-4f585f40fd50
      version: -1
      name: Get host environment variables
      script: McAfee Active Response|||mar-search-multiple
      type: regular
      iscommand: true
      brand: McAfee Active Response
      description: Search endpoint data crossed by multiple collectors.
    nexttasks:
      '#none#':
      - "21"
    scriptarguments:
      collector:
        simple: Processes
      collectors:
        simple: HostInfo,EnvironmentVariables
      filter-by:
        simple: hostname
      filter-operator:
        simple: Equals
      filter-value:
        complex:
          root: inputs.Hostname
      filter_collector:
        simple: HostInfo
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1902.5,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: cd3926a0-6157-4ef3-8fd1-86b6cbd79e7c
    type: regular
    task:
      id: cd3926a0-6157-4ef3-8fd1-86b6cbd79e7c
      version: -1
      name: Get host local groups
      script: McAfee Active Response|||mar-search-multiple
      type: regular
      iscommand: true
      brand: McAfee Active Response
      description: Search endpoint data crossed by multiple collectors.
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      collector:
        simple: Processes
      collectors:
        simple: HostInfo,LocalGroups
      filter-by:
        simple: hostname
      filter-operator:
        simple: Equals
      filter-value:
        complex:
          root: inputs.Hostname
      filter_collector:
        simple: HostInfo
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1472.5,
          "y": 1185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 0287ca41-8587-4bb2-84d6-4824b5133df1
    type: regular
    task:
      id: 0287ca41-8587-4bb2-84d6-4824b5133df1
      version: -1
      name: Get host logged in users
      script: McAfee Active Response|||mar-search-multiple
      type: regular
      iscommand: true
      brand: McAfee Active Response
      description: Search endpoint data crossed by multiple collectors.
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      collector:
        simple: Processes
      collectors:
        simple: HostInfo,LoggedInUsers
      filter-by:
        simple: hostname
      filter-operator:
        simple: Equals
      filter-value:
        complex:
          root: inputs.Hostname
      filter_collector:
        simple: HostInfo
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1472.5,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: c781977e-2b17-4273-86c2-246912262601
    type: regular
    task:
      id: c781977e-2b17-4273-86c2-246912262601
      version: -1
      name: Get host network shares
      script: McAfee Active Response|||mar-search-multiple
      type: regular
      iscommand: true
      brand: McAfee Active Response
      description: Search endpoint data crossed by multiple collectors.
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      collector:
        simple: Processes
      collectors:
        simple: HostInfo,NetworkShares
      filter-by:
        simple: hostname
      filter-operator:
        simple: Equals
      filter-value:
        complex:
          root: inputs.Hostname
      filter_collector:
        simple: HostInfo
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1042.5,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: ebfbc02e-b674-4899-8586-ea8621533c3b
    type: regular
    task:
      id: ebfbc02e-b674-4899-8586-ea8621533c3b
      version: -1
      name: Get host interactive sessions
      script: McAfee Active Response|||mar-search-multiple
      type: regular
      iscommand: true
      brand: McAfee Active Response
      description: Search endpoint data crossed by multiple collectors.
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      collector:
        simple: Processes
      collectors:
        simple: HostInfo,InteractiveSessions
      filter-by:
        simple: hostname
      filter-operator:
        simple: Equals
      filter-value:
        complex:
          root: inputs.Hostname
      filter_collector:
        simple: HostInfo
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1042.5,
          "y": 1185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 79f385d1-1aa0-47f9-84de-f0b579492151
    type: regular
    task:
      id: 79f385d1-1aa0-47f9-84de-f0b579492151
      version: -1
      name: Get host network interfaces
      script: McAfee Active Response|||mar-search-multiple
      type: regular
      iscommand: true
      brand: McAfee Active Response
      description: Search endpoint data crossed by multiple collectors.
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      collector:
        simple: Processes
      collectors:
        simple: HostInfo,NetworkInterfaces
      filter-by:
        simple: hostname
      filter-operator:
        simple: Equals
      filter-value:
        complex:
          root: inputs.Hostname
      filter_collector:
        simple: HostInfo
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1042.5,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: c35f205c-5c9a-4846-85b9-0a11e1b9f5ad
    type: regular
    task:
      id: c35f205c-5c9a-4846-85b9-0a11e1b9f5ad
      version: -1
      name: Get host's connected USB Storage Devices
      script: McAfee Active Response|||mar-search-multiple
      type: regular
      iscommand: true
      brand: McAfee Active Response
      description: Search endpoint data crossed by multiple collectors.
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      collector:
        simple: Processes
      collectors:
        simple: HostInfo,UsbConnectedStorageDevices
      filter-by:
        simple: hostname
      filter-operator:
        simple: Equals
      filter-value:
        complex:
          root: inputs.Hostname
      filter_collector:
        simple: HostInfo
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1902.5,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: cac5062b-32b7-4789-8f25-c28ea0e40873
    type: regular
    task:
      id: cac5062b-32b7-4789-8f25-c28ea0e40873
      version: -1
      name: Get host user profiles
      script: McAfee Active Response|||mar-search-multiple
      type: regular
      iscommand: true
      brand: McAfee Active Response
      description: Search endpoint data crossed by multiple collectors.
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      collector:
        simple: Processes
      collectors:
        simple: HostInfo,UserProfiles
      filter-by:
        simple: hostname
      filter-operator:
        simple: Equals
      filter-value:
        complex:
          root: inputs.Hostname
      filter_collector:
        simple: HostInfo
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1472.5,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 00e3cf95-5dda-411c-8ec5-027ba3348a21
    type: regular
    task:
      id: 00e3cf95-5dda-411c-8ec5-027ba3348a21
      version: -1
      name: Get host installed software
      script: McAfee Active Response|||mar-search-multiple
      type: regular
      iscommand: true
      brand: McAfee Active Response
      description: Search endpoint data crossed by multiple collectors.
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      collector:
        simple: Processes
      collectors:
        simple: HostInfo,Software
      filter-by:
        simple: hostname
      filter-operator:
        simple: Equals
      filter-value:
        complex:
          root: inputs.Hostname
      filter_collector:
        simple: HostInfo
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 4afc3a44-f5f9-462a-8f41-dc697c9366e2
    type: regular
    task:
      id: 4afc3a44-f5f9-462a-8f41-dc697c9366e2
      version: -1
      name: Get host Network Sessions
      script: McAfee Active Response|||mar-search-multiple
      type: regular
      iscommand: true
      brand: McAfee Active Response
      description: Search endpoint data crossed by multiple collectors.
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      collector:
        simple: Processes
      collectors:
        simple: HostInfo,NetworkSessions
      filter-by:
        simple: hostname
      filter-operator:
        simple: Equals
      filter-value:
        complex:
          root: inputs.Hostname
      filter_collector:
        simple: HostInfo
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1042.5,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: e7fcd15d-3273-4163-803e-26d5e76f712e
    type: regular
    task:
      id: e7fcd15d-3273-4163-803e-26d5e76f712e
      version: -1
      name: Get host Startup items
      script: McAfee Active Response|||mar-search-multiple
      type: regular
      iscommand: true
      brand: McAfee Active Response
      description: Search endpoint data crossed by multiple collectors.
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      collector:
        simple: Processes
      collectors:
        simple: HostInfo,Startup
      filter-by:
        simple: hostname
      filter-operator:
        simple: Equals
      filter-value:
        complex:
          root: inputs.Hostname
      filter_collector:
        simple: HostInfo
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 41252036-b29b-4a75-82e7-68fe3fa9b0a5
    type: title
    task:
      id: 41252036-b29b-4a75-82e7-68fe3fa9b0a5
      version: -1
      name: Collect data from endpoint
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
      - "28"
      - "29"
      - "30"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1257.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 23bbdc19-0b43-4b5e-8d2b-939183909e09
    type: title
    task:
      id: 23bbdc19-0b43-4b5e-8d2b-939183909e09
      version: -1
      name: Users and groups
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1472.5,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: bf8c2f0a-d98b-4059-82db-a9f06f937177
    type: title
    task:
      id: bf8c2f0a-d98b-4059-82db-a9f06f937177
      version: -1
      name: Executable
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: abee0804-81a8-45da-8fab-a3792b165c49
    type: title
    task:
      id: abee0804-81a8-45da-8fab-a3792b165c49
      version: -1
      name: Network
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1042.5,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: c5ff2c93-f30c-45eb-87b7-bcd676d1e7a2
    type: title
    task:
      id: c5ff2c93-f30c-45eb-87b7-bcd676d1e7a2
      version: -1
      name: Others
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1902.5,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: e5454d6d-61e8-46ea-8815-7db0da08666a
    type: condition
    task:
      id: e5454d6d-61e8-46ea-8815-7db0da08666a
      version: -1
      name: Is McAfee ePO v2 enabled?
      description: Is the McAfee ePO v2 integration configured and active?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "32"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: McAfee ePO v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": -100,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 37b2b961-94ff-4a4a-8e00-99cb34635feb
    type: regular
    task:
      id: 37b2b961-94ff-4a4a-8e00-99cb34635feb
      version: -1
      name: Get host info from ePO v2
      description: Finds systems in the McAfee ePO system tree.
      script: McAfee ePO v2|||epo-find-system
      type: regular
      iscommand: true
      brand: McAfee ePO v2
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      searchText:
        complex:
          root: inputs.Hostname
      verbose:
        simple: "false"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -100,
          "y": 455
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "31_32_yes": 0.55,
      "31_3_#default#": 0.22,
      "4_3_#default#": 0.1
    },
    "paper": {
      "dimensions": {
        "height": 1725,
        "width": 2382.5,
        "x": -100,
        "y": 50
      }
    }
  }
inputs:
- key: Hostname
  value:
    complex:
      root: Endpoint
      accessor: Hostname
  required: false
  description: Hostname to run on.
  playbookInputQuery:
outputs: []
tests:
- Endpoint data collection test
- MAR - Endpoint data collection test
- McAfee-MAR_Test
fromversion: 5.0.0