Install the application and configure a server for the McAfee ePO integration

Before you invoke the workflows for the integration, install and configure the McAfee ePO application from the ServiceNow Store on your ServiceNow AI Platform instance. The configuration is required to connect to the McAfee ePO console.

Before you begin

Role required: ServiceNow AI Platform administrator (admin)

About this task

The integration supports multiple servers, however, to avoid conflicts in profiles that share the same triggering conditions, you cannot share a McAfee ePO capability with multiple profiles that use the same McAfee ePO server. For example, as shown in the following figure, you can have capability 1 in more than one profile as long as each McAfee ePO server is mapped to a unique profile that has capability 1.

Figure 1. McAfee Shared Profile limitations

Procedure

1. Download the McAfee ePO for Security Operations from the ServiceNow Store and install it.
2. Navigate to Security Operations > Integrations > Integration Configurations.
3. Search for the McAfee ePO for Security Operations integration tile, and click Configure.

   

4. On the form, fill in the fields.

   Table 1. McAfee ePO Integration Configuration

   Field	Description
   Name	Name of the integration, for example, demo-1.
   ePO Server Name	Name for the McAfee ePO server. If you use one server, an example is, McAfee HQ (McAfee Head Quarters). This name is how the server and related credentials are recognized. If your organization requires support for multiple servers, enter the name for each server and repeat the process.
   McAfee ePO REST API URL	Base URL hosting the McAfee ePO REST API. Enter the URL with the https:// protocol, for example, https://corp.epo_server:8443.
   API account username	Unique account username, for example, ServiceNow API.
   API account password	Unique password for the API account.
   MID Server	Select the name of the MID Server that you configured during the setup of your ServiceNow AI Platform instance. You can select a specific MID Server from the list or select Any to enable an auto-selection of a valid MID Server from the list for this integration. Note: The MID Server selected during this configuration time applies throughout this integration. Only MID Servers that are active and validated are displayed on this list. By default, the value is set to Any. An example name is, secops_local_midserver.

   Figure 2. McAfee ePO Integration Configuration

   

5. Click Submit.
   The McAfee ePO Configurations list is displayed with your new configuration record. You have successfully completed the configuration for a McAfee ePO server.

   Note:

   If your organization requires support for multiple servers, then repeat the steps.

Previous topic: Set up your McAfee ePO console to integrate with Security Incident Response (SIR)

Next topic: Edit security tags in the ServiceNow AI Platform for the McAfee ePO integration