Set up your McAfee ePO console to integrate with Security Incident Response (SIR)

The following section lists the setup steps that you are required to complete in your McAfee ePO console prior to installing the application from the ServiceNow Store for the integration.

始める前に

Role required: McAfee ePO administrator

As a user with the McAfee ePO administrator permission, verify that you have installed the Servicenow.zip extension plugin in your McAfee ePO console. This extension plugin is required for the integration. For more information and to obtain the plugin, in your ServiceNow AI Platform instance, navigate to Knowledge > Articles > All. In the Search field, enter, ServiceNow Security Operations Extension for McAfee ePO.

このタスクについて

The ServiceNow extension plugin connects your ServiceNow AI Platform instance to your McAfee ePO console. This connection allows you to reference the security tags you that create in your McAfee ePO console for the isolate host and initiate malware scan actions to the capability profiles in your ServiceNow AI Platform instance.

The security tags in your McAfee ePO console must match the security tags in the capability records in your ServiceNow AI Platform instance.

The following steps show you how to install the extension plugin, create a security tag in your McAfee ePO console, and assign an action to the tag. For more information about the security tags in the McAfee ePO console, see the McAfee Product Documentation website.

注:

The figures in the following section are from the McAfee ePO console.

手順

1. If you have not installed the ServiceNow extension plugin on your McAfee ePO console, follow these steps to install it.
   1. Log in to your McAfee ePO console with your McAfee user name and password.

      

2. If the page shown in the following figure is not displayed, in the top left of banner of the home page, click the menu icon to display it.

   

3. In the Software section, click the Extensions link.

   

4. On the Extensions page that is displayed, click Install Extension.

   

5. In the Install Extension dialog, click Choose File, navigate to the Servicenow.zip file on your system, and click OK to download it.

   

   After the download is completed, the Software Extensions page is displayed with the ServiceNow Extension plugin listed.

   

   You have successfully installed the ServiceNow plugin Extension on your McAfee ePO console.

6. If you have not created security tags in McAfee ePO console for the initiate malware scan and isolate host actions, follow these steps.
   1. Navigate to the home page and click the Tag Catalog link.

      

   2. On the Tag Catalog page that is displayed, click New Tag.

      

   3. With the Description step selected in the progress bar that is displayed, enter a name and description for the tag.

      For this example, a tag with a name and description for the Initiate Malware Scan capability is displayed. This tag name is what is matched and referenced in your ServiceNow AI Platform instance.

      

   4. To advance to the Criteria step, click Criteria in the progress bar.
      The messages that are displayed indicate that no actions are currently assigned to this tag, and that the tag can only be applied manually.

      

   5. Click Evaluation in the progress bar to continue.

      

   6. With the Tag Catalog page of the Evaluation step displayed, leave the settings on this page in their defaults, and, in the progress bar, click Preview.

      

   7. With the Preview page displayed, in the lower right of the page, click Save to save the record.
      The new tag is displayed in the Tag catalog as shown in the following figure.

      

7. Create a security tag for the host isolation action by repeating the previous steps.
   After you have created both tags, you are ready to assign actions to the new tags.
8. To add an action to your new tag, follow these steps.
   1. Navigate to the home page and in the Policy section, click the Client Task Assignments link.

      

   2. In the System Tree page that is displayed, at the bottom of the page, expand the Actions menu and select New Client Task Assignment.

      

   3. On the page that is displayed, navigate to Endpoint Security Threat Prevention > Policy Based On-Demand Scan > On-Demand Scan - Full Scan by selecting the path as shown in the following figure.

      

   4. In the Tags section, under the radio button and next to Has any of these tags:, click the edit link to edit the criteria for the tag.

      

   5. In the dialog that is displayed, select the Initiate Malware Scan ServiceNow tag that you created in the preceding steps and click OK.

      

      The ServiceNow Initiate Malware Scan tag you created is assigned to the On-Demand Scan action.
   6. Click OK.
      In the Tags section, under the radio button and next to Has any of these tags:, the Initiate Malware Scan tag is displayed.

      

   7. Click Save.
      On the System Tree page, the task is displayed on the Assigned Client Tasks list (tab).

      

   8. If you have not assigned an action to the Isolate Host action, repeat the previous steps to assign it.
   You have successfully installed the extension plugin, created security tags, and assigned tasks to your tags. You have completed the setup for the integration in your McAfee ePO console. The next step is to configure a server in your ServiceNow AI Platform instance.

前のトピック: Set up your ServiceNow AI Platform instance for the McAfee ePO integration

次のトピック: Install the application and configure a server for the McAfee ePO integration