Checklist for the McAfee ePO integration

  • Release version: Xanadu
  • Updated August 1, 2024
  • 3 minutes to read

    • Use this checklist to guide you through all the tasks of the integration. The following checklist includes setup and installation tasks and examples of use cases that include expected results for the integration.

    Before you begin

    Role required: Roles are listed for each step.

    About this task

    Track your progress with the setup, installation, and configuration of the integration with the following table. Complete all the tasks for a step before moving on to the next step. Each row of the table lists tasks and identifies the roles that are required to perform the tasks. Numbered topics of the installation and configuration guide are also referenced.

    Procedure

    Follow the steps in the table in the order that they are presented.
    Table 1. Checklist
    Item Description
    Check box.
    		As a user with the ServiceNow AI Platform® administrator role, set up your ServiceNow AI Platform® instance.
    1. Assign ServiceNow AI Platform® and Security Incident Response roles.
    2. Verify that any ServiceNow Security Incident Response and other plugins that support the integration are installed and activated for your release of the ServiceNow AI Platform.
    3. Install and configure a MID server in your ServiceNow AI Platform® instance.
    4. Create an approval group if you want to process requests submitted from the security incident analyst for the isolate host and initiate malware scan actions.
    For more information, see Set up your ServiceNow AI Platform instance for the McAfee ePO integration.

    Check box.

    		 As McAfee ePO administrator, set up your McAfee ePO console.
    1. Verify that you are using version 5.9 of McAfee ePO.
    2. Install the ServiceNow extension plugin in your McAfee ePO console.
    3. Verify you have created security tags in your McAfee ePO console for the isolate host and initiate malware scan actions.
    For more information, see Set up your McAfee ePO console to integrate with Security Incident Response (SIR).

    For more information and to obtain the extension plugin file, in your ServiceNow AI Platform instance, navigate to Knowledge > Articles > All and, in the Search field, enter, ServiceNow Security Operations Extension for McAfee ePO.

    Check box.

    		 As a user with the ServiceNow AI Platform administrator role, install the McAfee ePO application from the ServiceNow Store, configure a server, and connect to the McAfee ePO console.

    For more information, see Install the application and configure a server for the McAfee ePO integration.
    Check box.
    		As a user with the ServiceNow AI Platform security incident administrator role, edit the security tag names in your ServiceNow AI Platform® instance so that they match the tag names that you created in your McAfee ePO console.

    For more information, see Edit security tags in the ServiceNow AI Platform for the McAfee ePO integration.

    Check box.

    		 As a user with the security incident administrator role, create a profile for McAfee ePO capabilities.

    For information about profiles, see McAfee ePO integration capability profiles. For the steps required to create a profile, see Create a capability profile for the McAfee ePO integration.

    Check box.

    		 As a user with the security incident administrator role, configure a profile and test security incidents.
    1. Review the information about triggering conditions and settings.
    2. Configure a profile.
    3. Test and preview security incidents.
    4. Locate search results and other details on the related lists on the security incident.
    5. Create and Configure different types of profiles and test security incidents for each type.

    For information about triggering conditions and the alternate CI field, see Defining triggering conditions with a Configuration item (CI) field for a McAfee ePO profile. For the steps required to configure a profile, test, and preview security incidents and examples of profile types, see the examples that follow Configuring profiles for the McAfee ePO integration.

    Check box.

    		 As a user with the ServiceNow AI Platform security incident analyst role, submit additional requests for Malware scans and List threat events. For more information, see Trigger McAfee ePO profile manually from a security incident

    In the ServiceNow AI Platform, as a user with an approval role, or, as a member of an approval group, approve requests for isolate host isolation and remove isolation.

    For more information on processing approval requests, see Create an approval group.
    You have successfully completed the set up steps, installed and configured the application, and verified expected results for the integration.