Create a capability profile for the McAfee ePO integration
Create a profile and select the McAfee ePO capabilities that you want the profile to run.
Before you begin
Role required: ServiceNow AI Platform® Security incident administrator (sn_si.admin)
About this task
For this step of the configuration, you create a profile for the McAfee ePO capabilities. When you create profiles, consider the intention of the profile before you add McAfee ePO capabilities to it. Refer to the following table when you create profiles.
The following table lists the capabilities that you are required to add to a profile if you want the profile perform certain queries or actions. Create a single profile that runs queries for host details, initiates malware scans, remove isolation, and isolates host machines, or, create multiple profiles, each with its own, single capability.
Procedure
-
On the form, fill the fields.
Field Description Name Name for the McAfee ePO capability profile. This name helps you identify the profile type and describe it. An example for a profile that runs queries is, Host and Threat Details. This name is also the name for the security tag for this profile by default. Description Additional information about the profile that further describes the activities of the profile. An example description for a profile that runs queries is, Threat enrichment for system details and a list of threat events. An example description for a profile that runs actions is, Isolate host machine. Source Name of the McAfee ePO server. Only configured servers are available from the choice list. McAfee ePO Capability Capabilities of the McAfee ePO profile. McAfee ePO supports the following capabilities: - Get Host Details
- Isolate Host Profile
- Initiate Malware Scan
- Remove Isolation
- List Threat Events
Select the capabilities you want for this profile from the Available column and move them to the Selected column.
You can't add Get Host Details, Initiate Malware Scan and List Threat Events in the same profile, and you can't add Remove Isolation and Isolate Host on the same profile.
Order Workflow priority. Default is 100. The value of this field indicates the order that workflows are executed when two or more profiles share triggering conditions. The workflow with the lowest number has the highest priority.
To set the order of operation, enter a value. For example, 100, 200, 300, 400.Active The check box is selected by default to indicate that the profile is active. When selected, the profile is active and triggers automatically when a security incident is created that matches the filtering conditions that you specify during the configuration step.
When inactive, the profile will not run, and it is not available to invoke from a list.
What to do next
The next step is to configure your profile. Before you configure the settings for the profile, you may prefer to review the concepts for configuring profiles and triggering conditions. See Set up your McAfee ePO console to integrate with Security Incident Response (SIR) and Defining triggering conditions with a Configuration item (CI) field for a McAfee ePO profile for more information.