category: Analytics & SIEM
provider: Trellix
commonfields:
  id: McAfee ESM-v10
  version: -1
deprecated: true
configuration:
- display: ESM IP (e.g. 78.125.0.209)
  name: ip
  required: true
  type: 0
- defaultvalue: '443'
  display: Port
  name: port
  required: true
  type: 0
- display: Username
  name: credentials
  required: true
  type: 9
- defaultvalue: '10.2'
  display: 'Version: (one of 10.0, 10.1, 10.2, 10.3, 11.1)'
  name: version
  required: true
  type: 0
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- defaultvalue: auto-discovery
  display: ESM time format, e.g., %Y/%m/%d %H:%M:%S. Select "auto-discovery" to attempt to determine the format automatically.
  name: time_format
  type: 0
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- defaultvalue: alarms
  display: 'Fetch Types: cases, alarms, both (relevant only for fetch incident mode)'
  name: fetchTypes
  type: 0
  required: false
- defaultvalue: '0'
  display: 'Start fetch after Case ID: (relevant only for fetch incident mode)'
  name: startingCaseID
  type: 0
  required: false
- defaultvalue: 3 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  name: alarm_fetch_time
  type: 0
  required: false
- defaultvalue: '0'
  display: McAfee ESM Timezone in hours (e.g if ESM timezone is +0300 => then insert 3)
  name: timezone
  type: 0
  required: false
description: Deprecated. Use the McAfee ESM v2 integration instead.
display: McAfee ESM v10 and v11 (Deprecated)
name: McAfee ESM-v10
script:
  commands:
  - description: Get all fields that can be used in query filters, with type information for each field
    name: esm-fetch-fields
  - arguments:
    - auto: PREDEFINED
      description: The time period for the search
      name: timeRange
      predefined:
      - LAST_3_DAYS
      - LAST_2_DAYS
      - LAST_24_HOURS
      - PREVIOUS_DAY
      - CURRENT_DAY
      - LAST_HOUR
      - LAST_30_MINUTES
      - LAST_10_MINUTES
      - LAST_MINUTE
      - CUSTOM
      - PREVIOUS_YEAR
      - CURRENT_YEAR
      - PREVIOUS_QUARTER
      - CURRENT_QUARTER
      - PREVIOUS_MONTH
      - CURRENT_MONTH
      - PREVIOUS_WEEK
      - CURRENT_WEEK
      required: true
    - description: Filter on the query results, should be a json string, of the format EsmFilter (read more on that here - https://<esm-ip>:<esm-port>/rs/esm/help/types/EsmFilter)
      name: filters
      required: true
    - auto: PREDEFINED
      description: 'Query type to preform, by default EVENT (other possible values are : FLOW/ASSET)'
      name: queryType
      predefined:
      - EVENT
      - FLOW
      - ASSETS
    - description: Maximum time to wait (in minutes), default is 30
      name: maxWait
    - description: if timeRange is CUSTOM, start time for the time range (e.g. 2017-06-01T12:48:16.734Z)
      name: customStart
    - description: if timeRange is CUSTOM, end time for the time range (e.g. 2017-06-01T12:48:16.734Z)
      name: customEnd
    - description: The fields that will be selected when this query is executed.
      name: fields
    description: Perform a query against Mcafee ESM SIEM
    name: esm-search
  - arguments:
    - auto: PREDEFINED
      description: The time period for the fetch
      name: timeRange
      predefined:
      - LAST_3_DAYS
      - LAST_2_DAYS
      - LAST_24_HOURS
      - PREVIOUS_DAY
      - CURRENT_DAY
      - LAST_HOUR
      - LAST_30_MINUTES
      - LAST_10_MINUTES
      - LAST_MINUTE
      - CUSTOM
      - PREVIOUS_YEAR
      - CURRENT_YEAR
      - PREVIOUS_QUARTER
      - CURRENT_QUARTER
      - PREVIOUS_MONTH
      - CURRENT_MONTH
      - PREVIOUS_WEEK
      - CURRENT_WEEK
      required: true
    - description: if timeRange is CUSTOM, start time for the time range (e.g. 2017-06-01T12:48:16.734Z)
      name: customStart
    - description: if timeRange is CUSTOM, end time for the time range (e.g. 2017-06-01T12:48:16.734Z)
      name: customEnd
    - auto: PREDEFINED
      description: 'user assigned to handle this triggered alarm (use ''ME'' option to use instance user, or use format EsmUser (read more on that here - https://<esm-ip>:<esm-port>/rs/esm/help/types/EsmUser) '
      name: assignedUser
      predefined:
      - ME
      - ''
    description: Retrieves a list of alarms that have been triggered
    name: esm-fetch-alarms
    outputs:
    - contextPath: Alarm.ID
      description: Alarm ID
      type: number
    - contextPath: Alarm.summary
      description: Alarm summary
      type: string
    - contextPath: Alarm.assignee
      description: Alarm assignee
      type: string
    - contextPath: Alarm.severity
      description: Alarm severity
      type: number
    - contextPath: Alarm.triggeredDate
      description: Alarm triggered date
      type: date
    - contextPath: Alarm.acknowledgedDate
      description: Alarm acknowledged date
      type: date
    - contextPath: Alarm.acknowledgedUsername
      description: Alarm acknowledged username
      type: string
    - contextPath: Alarm.alarmName
      description: Alarm name
      type: string
    - contextPath: Alarm.conditionType
      description: Alarm condition type
      type: number
  - arguments:
    - description: Filter for a case opened before this date. Given in format "<number>         <time unit>",e.g. 1 day,30 minutes,2 weeks,6 months,1 year
      name: since
    description: Get a list of cases from the system
    name: esm-get-case-list
    outputs:
    - contextPath: Case.ID
      description: The ID of the case
      type: number
    - contextPath: Case.Summary
      description: The summary of the case
      type: string
    - contextPath: Case.Status
      description: The status of the case
      type: string
    - contextPath: Case.OpenTime
      description: The open time of the case
      type: date
    - contextPath: Case.Severity
      description: The severity of the case
      type: number
    - contextPath: Case.Assignee
      description: The Assignee of the case
      type: string
    - contextPath: Case.Organization
      description: The organization of the case
      type: string
    - contextPath: Case.EventList
      description: List of case's events
      type: Unknown
    - contextPath: Case.Notes
      description: List of case's notes
      type: unknown
  - arguments:
    - default: true
      description: the name of the case
      name: summary
      required: true
    - defaultValue: Open
      description: the status of the case (use `esm-get-case-statuses` to view all statuses)
      name: status
    - defaultValue: me
      description: who the case is assigned to
      name: assignee
    - defaultValue: '1'
      description: the severity of the case (1 - 100)
      name: severity
    - description: the organization assigned to the case  (use `esm-get-organization-list` to view all ogranizations)
      name: organization
    description: Add a case to the system
    name: esm-add-case
    outputs:
    - contextPath: Case.ID
      description: The ID of the case
      type: number
    - contextPath: Case.Summary
      description: The summary of the case
      type: string
    - contextPath: Case.Status
      description: The status of the case
      type: string
    - contextPath: Case.OpenTime
      description: The open time of the case
      type: date
    - contextPath: Case.Severity
      description: The severity of the case
      type: number
    - contextPath: Case.Assignee
      description: The Assignee of the case
      type: string
    - contextPath: Case.Organization
      description: The organization of the case
      type: string
    - contextPath: Case.EventList
      description: List of case's events
      type: Unknown
    - contextPath: Case.Notes
      description: List of case's notes
      type: Unknown
  - arguments:
    - default: true
      description: the id of the case
      name: id
      required: true
    - description: the name of the case
      name: summary
    - description: the new severity of the case (1 - 100)
      name: severity
    - description: who the case should be assigned to
      name: assignee
    - description: the new status of the case (use `esm-get-case-statuses` to view all statuses)
      name: status
    - description: the organization assigned to the case  (use `esm-get-organization-list` to view all ogranizations)
      name: organization
    description: Edit an existing case
    name: esm-edit-case
    outputs:
    - contextPath: Case.ID
      description: The ID of the case
      type: number
    - contextPath: Case.Summary
      description: The summary of the case
      type: string
    - contextPath: Case.Status
      description: The status of the case
      type: string
    - contextPath: Case.OpenTime
      description: The open time of the case
      type: date
    - contextPath: Case.Severity
      description: The severity of the case
      type: number
    - contextPath: Case.Assignee
      description: The Assignee of the case
      type: string
    - contextPath: Case.Organization
      description: The organization of the case
      type: string
    - contextPath: Case.EventList
      description: List of case's events
      type: Unknown
    - contextPath: Case.Notes
      description: List of case's notes
      type: Unknown
  - description: Get a list of valid case statuses from the system
    name: esm-get-case-statuses
  - arguments:
    - default: true
      description: the name of the case status to edit
      name: original_name
      required: true
    - description: the new name for the case status
      name: new_name
      required: true
    - auto: PREDEFINED
      description: whether the status be shown in case pane
      name: show_in_case_pane
      predefined:
      - 'True'
      - 'False'
    description: Edit a case status
    name: esm-edit-case-status
  - arguments:
    - default: true
      description: the ID of the case
      name: id
      required: true
    description: Get detail on an existing case
    name: esm-get-case-detail
    outputs:
    - contextPath: Case.ID
      description: The ID of the case
      type: number
    - contextPath: Case.Summary
      description: The summary of the case
      type: string
    - contextPath: Case.Status
      description: The status of the case
      type: string
    - contextPath: Case.OpenTime
      description: The open time of the case
      type: date
    - contextPath: Case.Severity
      description: The severity of the case
      type: number
    - contextPath: Case.Assignee
      description: The Assignee of the case
      type: string
    - contextPath: Case.Organization
      description: The organization of the case
      type: string
    - contextPath: Case.EventList
      description: List of case's events
      type: Unknown
    - contextPath: Case.Notes
      description: List of case's notes
      type: Unknown
  - arguments:
    - description: Comma separated  list of event IDs
      name: ids
      required: true
    description: Get case events details
    name: esm-get-case-event-list
    outputs:
    - contextPath: CaseEvents.ID
      description: The ID of the event
      type: string
    - contextPath: CaseEvents.LastTime
      description: The last updated time of the event
      type: date
    - contextPath: CaseEvents.Message
      description: The massage of the event
      type: string
  - arguments:
    - default: true
      description: the name of the case status
      name: name
      required: true
    - auto: PREDEFINED
      defaultValue: 'True'
      description: whether the status be shown in case pane
      name: show_in_case_pane
      predefined:
      - 'True'
      - 'False'
    description: Add a case status
    name: esm-add-case-status
  - arguments:
    - default: true
      description: the name of the case status to delete
      name: name
      required: true
    description: Delete a case status
    name: esm-delete-case-status
  - description: Get case organization
    name: esm-get-organization-list
    outputs:
    - contextPath: Organizations.ID
      description: Organization ID
      type: number
    - contextPath: Organizations.Name
      description: Organization Name
      type: string
  - description: Get a list of all users.
    name: esm-get-user-list
    outputs:
    - contextPath: EsmUser.ID
      description: the ID of the user
      type: number
    - contextPath: EsmUser.Name
      description: the esm user name
      type: string
    - contextPath: EsmUser.Email
      description: the e-mail of the user
      type: string
    - contextPath: EsmUser.SMS
      description: the SMS details of the user
      type: string
    - contextPath: EsmUser.IsMaster
      description: whether the user is a master user
      type: boolean
    - contextPath: EsmUser.IsAdmin
      description: whether the user is an admin
      type: boolean
  - arguments:
    - default: true
      description: list of triggered alarm ids to be marked acknowledged separated with commas
      isArray: true
      name: alarmIds
      required: true
    description: Mark triggered alarms as acknowledged
    name: esm-acknowledge-alarms
  - arguments:
    - default: true
      description: list of triggered alarm ids to be marked unacknowledged separated with commas
      isArray: true
      name: alarmIds
      required: true
    description: Mark triggered alarms as unacknowledged
    name: esm-unacknowledge-alarms
  - arguments:
    - default: true
      description: list of triggered alarm ids to be deleted separated with commas
      isArray: true
      name: alarmIds
      required: true
    description: Delete triggered alarms
    name: esm-delete-alarms
  - arguments:
    - default: true
      description: The event to get the details for. the ID can be taken from esm-list-alarm-events.
      name: eventId
      required: true
    description: Gets the details for the triggered alarm
    name: esm-get-alarm-event-details
    outputs:
    - contextPath: EsmAlarmEvent.ID
      description: Event ID
      type: string
    - contextPath: EsmAlarmEvent.SubType
      description: Event Type
      type: string
    - contextPath: EsmAlarmEvent.Severity
      description: Event Severity
      type: number
    - contextPath: EsmAlarmEvent.Message
      description: Event Message
      type: string
    - contextPath: EsmAlarmEvent.LastTime
      description: Event Time
      type: date
    - contextPath: EsmAlarmEvent.SrcIP
      description: Source IP of the event
      type: string
    - contextPath: EsmAlarmEvent.DstIP
      description: Destination IP of the event
      type: string
    - contextPath: EsmAlarmEvent.Cases
      description: A list of related cases to the event
      type: Unknown
    - contextPath: EsmAlarmEvent.Cases.ID
      description: Case ID
      type: string
    - contextPath: EsmAlarmEvent.Cases.OpenTime
      description: Case creation time
      type: date
    - contextPath: EsmAlarmEvent.Cases.Severity
      description: Case severity
      type: number
    - contextPath: EsmAlarmEvent.Cases.Status
      description: Case status
      type: string
    - contextPath: EsmAlarmEvent.Cases.Summary
      description: Case summary
      type: string
    - contextPath: EsmAlarmEvent.DstMac
      description: Destination MAC of the event
      type: string
    - contextPath: EsmAlarmEvent.SrcMac
      description: Source MAC of the event
      type: string
    - contextPath: EsmAlarmEvent.DstPort
      description: Destination port of the event
      type: string
    - contextPath: EsmAlarmEvent.SrcPort
      description: Source port of the event
      type: string
    - contextPath: EsmAlarmEvent.FirstTime
      description: The first time for the event
      type: date
    - contextPath: EsmAlarmEvent.NormalizedDescription
      description: Normalized description of the event
      type: string
  - arguments:
    - default: true
      description: The alarm to get the details for. the ID can be taken from the esm-fetch-alarms
      name: alarmId
      required: true
    description: Gets an event list related to the alarm
    name: esm-list-alarm-events
    outputs:
    - contextPath: EsmAlarmEvent.ID
      description: Event ID
      type: string
    - contextPath: EsmAlarmEvent.SubType
      description: Event Type
      type: string
    - contextPath: EsmAlarmEvent.Severity
      description: Event Severity
      type: number
    - contextPath: EsmAlarmEvent.Message
      description: Event Message
      type: string
    - contextPath: EsmAlarmEvent.LastTime
      description: Event Time
      type: date
    - contextPath: EsmAlarmEvent.SrcIP
      description: Source IP of the event
      type: string
    - contextPath: EsmAlarmEvent.DstIP
      description: Destination IP of the event
      type: string
    - contextPath: EsmAlarmEvent.Cases
      description: A list of related cases to the event
      type: Unknown
    - contextPath: EsmAlarmEvent.Cases.ID
      description: Case ID
      type: string
    - contextPath: EsmAlarmEvent.Cases.OpenTime
      description: Case creation time
      type: date
    - contextPath: EsmAlarmEvent.Cases.Severity
      description: Case severity
      type: number
    - contextPath: EsmAlarmEvent.Cases.Status
      description: Case status
      type: string
    - contextPath: EsmAlarmEvent.Cases.Summary
      description: Case summary
      type: string
  isfetch: true
  script: '-'
  type: python
  subtype: python2
  dockerimage: demisto/python:2.7.18.20958
tests:
- No tests
fromversion: 5.0.0