McAfee Enterprise Security Manager is a security information and event management (SIEM) solution that delivers actionable intelligence and integrations to prioritize, investigate, and respond to threats.

Connect McAfee ESM with Devo SOAR

Navigate to Automations > Integrations.
Search for McAfee ESM.
Click Details, then the + icon. Enter the required information in the following fields.
Label: Enter a connection name.
Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).
Remote Agent: Run this integration using the Devo SOAR Remote Agent.
Host: Host of the McAfee ESM server.
User: User name to log in with.
Password: Password to log in with.
After you've entered all the details, click Connect.

Actions for McAfee ESM

Get Events

Fetches events based on query provided.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
Query	Query that is used for fetching events.	Required
Time Range	Set the time frame to check for events.	Required

Check GUI Accessible

Checks whether ESM GUI is accessible.

Input Field

Choose a connection that you have previously created to complete the connection.

Status Flags Screenshot

Screenshots Status Flags of ESM Devices.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
Screenshot Timeout	Amount of time (in seconds) to spend retrieving a screenshot (Default is 40 seconds).	Required

Default View Screenshot

Screenshots Default View on ESM Dashboard.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
Screenshot Timeout	Amount of time (in seconds) to spend retrieving a screenshot (Default is 40 seconds).	Required

Review ESM Resources

Reviews ESM Resources such as CPU, RAM, and HDD.

Input Field

Choose a connection that you have previously created to complete the connection.

Get Alarms

Gets alarms triggered for a time range.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
Time Range	Set the time frame to check for triggered alarms.	Required

Review ESM Health Status Flags

Reviews anomaly in ESM Health Status Flags.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
Ignore Disabled Services	Choose option to ignore disabled devices for health check (Default is False).	Required

Review Baselines on ESM

Reviews Event Distribution Widget in Event Summary View with Baselines.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
Ignore Disabled Services	Choose option to ignore disabled devices for health check (Default is False).	Required
Time Range	Set the time frame to get Event Distribution.	Required

Review Tasks Under Task Manager

Reviews tasks/jobs/queries running on ESM listed under Task Manager.

Input Field

Choose a connection that you have previously created to complete the connection.

Review Reports

Reviews Reports generated on ESM.

Input Field

Choose a connection that you have previously created to complete the connection.

Release Notes

v3.0.0 - Updated architecture to support IO via filesystem
v2.0.1 - Added documentation link in the automation library.