McAfee ePO Repository Compliance Playbook v2

Ensures that ePO servers are updated to the latest McAfee published AV signatures (DAT file version).

McAfee ePO · 12 tasks · 0 inputs · 0 outputs

Details

IDMcAfee ePO Repository Compliance Playbook v2
From Version5.0.0
Tasks12

README

Ensures that ePO servers are updated to the latest McAfee published AV signatures (DAT file version).

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • epo

Scripts

  • Sleep
  • AreValuesEqual

Commands

  • closeInvestigation
  • send-mail
  • epo-update-repository
  • epo-get-current-dat
  • setIncident
  • epo-get-latest-dat

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Commands used

closeInvestigation epo-get-current-dat epo-get-latest-dat epo-update-repository send-mail setIncident

Flowchart

true true start_task start_task Retrieve DAT version and date from McAfee - epo-get-latest-dat Retrieve DAT version and ... epo-get-latest-dat Initiate update task in each local repository - epo-update-repository Initiate update task in e... epo-update-repository Send report to admin with update results - send-mail Send report to admin with... send-mail Send email alert with list of faulty repositories to admin - send-mail Send email alert with lis... send-mail Close the investigation - closeInvestigation Close the investigation closeInvestigation Retrieve DAT version and date from ePO - epo-get-current-dat Retrieve DAT version and ... epo-get-current-dat Check if ePO has latest DAT from McAfee - AreValuesEqual Check if ePO has latest D... AreValuesEqual Wait for 5 minutes - Sleep Wait for 5 minutes Sleep Get ePO current DAT version - epo-get-current-dat Get ePO current DAT version epo-get-current-dat Check if ePO has latest DAT from McAfee - AreValuesEqual Check if ePO has latest D... AreValuesEqual Set incident to High severity - setIncident Set incident to High seve... setIncident

Source

playbook-McAfee_ePO_Repository_Compliance_v2.yml
Download History Raw 
id: McAfee ePO Repository Compliance Playbook v2
version: -1
name: McAfee ePO Repository Compliance Playbook v2
description: Ensures that ePO servers are updated to the latest McAfee published AV
  signatures (DAT file version).
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: f55dc10b-4a12-44aa-892f-95d8df1ddcf0
    type: start
    task:
      id: f55dc10b-4a12-44aa-892f-95d8df1ddcf0
      version: -1
      name: start_task
      type: start
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '11'
      - '2'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 50,\n    \"y\": 40\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '2':
    id: '2'
    taskid: c45128e8-7780-4bfb-8a9e-c0cd10bdb531
    type: regular
    task:
      id: c45128e8-7780-4bfb-8a9e-c0cd10bdb531
      version: -1
      name: Retrieve DAT version and date from McAfee
      script: '|||epo-get-latest-dat'
      type: regular
      iscommand: true
      brand: ""
      description: Checks the latest DAT file version available in the public McAfee
        repository.
    nexttasks:
      '#none#':
      - '12'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 294,
          "y": 186
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '4':
    id: '4'
    taskid: 6c06d8bd-d1a5-441e-88c2-a7319b80df56
    type: regular
    task:
      id: 6c06d8bd-d1a5-441e-88c2-a7319b80df56
      version: -1
      name: Initiate update task in each local repository
      script: '|||epo-update-repository'
      type: regular
      iscommand: true
      brand: ""
      description: Update local ePO repository.
    nexttasks:
      '#none#':
      - '13'
    scriptarguments:
      repos:
        simple: ${olddatrepos}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 504,\n    \"y\": 554\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '5':
    id: '5'
    taskid: fbb4e798-be73-46e3-89af-9985a1566e05
    type: regular
    task:
      id: fbb4e798-be73-46e3-89af-9985a1566e05
      version: -1
      name: Send report to admin with update results
      description: Sends an email using EWS.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '10'
    scriptarguments:
      body:
        simple: ePO Update Successful.
      subject:
        simple: 'Demisto: ePO Update Results'
      to:
        simple: ${incident.labels.adminEmail}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 335,\n    \"y\": 1207\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '7':
    id: '7'
    taskid: feec4ac4-4724-4ab6-8494-3daaaeaa2e81
    type: regular
    task:
      id: feec4ac4-4724-4ab6-8494-3daaaeaa2e81
      version: -1
      name: Send email alert with list of faulty repositories to admin
      description: Sends an email using EWS.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '16'
    scriptarguments:
      body:
        simple: ePO Update Error. Please review status of Cortex XSOAR incident ${incident.id}
          - ${incident.name}
      subject:
        simple: 'Demisto: Faulty ePO Repositories Alert'
      to:
        simple: ${incident.labels.adminEmail}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 753,\n    \"y\": 1207\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '10':
    id: '10'
    taskid: 677fdb8a-d2a0-4df8-8bfb-6ed20e8c964b
    type: regular
    task:
      id: 677fdb8a-d2a0-4df8-8bfb-6ed20e8c964b
      version: -1
      name: Close the investigation
      description: Closes the incident.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 56,\n    \"y\": 1386\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '11':
    id: '11'
    taskid: 569fe669-4998-4b3f-88d7-cb174d4e7ee7
    type: regular
    task:
      id: 569fe669-4998-4b3f-88d7-cb174d4e7ee7
      version: -1
      name: Retrieve DAT version and date from ePO
      description: Checks the existing DAT file version in ePO.
      script: '|||epo-get-current-dat'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - '12'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": -175,\n    \"y\": 186\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '12':
    id: '12'
    taskid: a70722fd-f27d-40e3-84ff-214f4d1991e3
    type: condition
    task:
      id: a70722fd-f27d-40e3-84ff-214f4d1991e3
      version: -1
      name: Check if ePO has latest DAT from McAfee
      description: Check whether the values provided in arguments are equal.
      scriptName: AreValuesEqual
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '4'
      yes:
      - '10'
    scriptarguments:
      left:
        simple: ${mcafee.latestDAT}
      right:
        simple: ${mcafee.epoDAT=val.substr(0,val.indexOf('.'))}
    results:
    - AreValuesEqual
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 50,\n    \"y\": 375\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '13':
    id: '13'
    taskid: a1e2e5f3-54bf-4655-84f7-78693c872f13
    type: regular
    task:
      id: a1e2e5f3-54bf-4655-84f7-78693c872f13
      version: -1
      name: Wait for 5 minutes
      description: Sleep for X seconds. Default is 300 seconds (5 minutes).
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '14'
    scriptarguments:
      seconds:
        simple: '300'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 504,\n    \"y\": 713\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '14':
    id: '14'
    taskid: d0a5dcd2-45e8-426b-8694-76af33a88860
    type: regular
    task:
      id: d0a5dcd2-45e8-426b-8694-76af33a88860
      version: -1
      name: Get ePO current DAT version
      description: Checks the existing DAT file version in ePO.
      script: '|||epo-get-current-dat'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - '15'
    scriptarguments:
      extend-context:
        simple: mcafee.newEpoDAT=productDetectionProductVersion
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 504,\n    \"y\": 867\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '15':
    id: '15'
    taskid: f08dbb83-fe3f-4cf8-8ee5-c96233add408
    type: condition
    task:
      id: f08dbb83-fe3f-4cf8-8ee5-c96233add408
      version: -1
      name: Check if ePO has latest DAT from McAfee
      description: Check whether the values provided in arguments are equal.
      scriptName: AreValuesEqual
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '7'
      yes:
      - '5'
    scriptarguments:
      left:
        simple: ${mcafee.latestDAT}
      right:
        simple: ${mcafee.newEpoDAT=val.substr(1,val.indexOf('.'))}
    results:
    - AreValuesEqual
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 504,\n    \"y\": 1033\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '16':
    id: '16'
    taskid: ba4fc06e-e52f-4ca9-82a3-119a057f8113
    type: regular
    task:
      id: ba4fc06e-e52f-4ca9-82a3-119a057f8113
      version: -1
      name: Set incident to High severity
      description: Sets the incident severity to High.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    scriptarguments:
      severity:
        simple: High
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 753,\n    \"y\": 1386\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: "{\n  \"linkLabelsPosition\": {\n    \"12_10_yes\": 0.16,\n    \"12_4_#default#\"\
  : 0.62,\n    \"15_5_yes\": 0.56,\n    \"15_7_#default#\": 0.5\n  },\n  \"paper\"\
  : {\n    \"dimensions\": {\n      \"height\": 1441,\n      \"width\": 1308,\n  \
  \    \"x\": -175,\n      \"y\": 40\n    }\n  }\n}"
inputs: []
outputs: []
fromversion: 5.0.0
tests:
- No tests (auto formatted)
system: true