Set up your McAfee ePO console to integrate with Security Incident Response (SIR)

  • Release version: Zurich
  • Updated March 12, 2026
  • 4 minutes to read

    • The following section lists the setup steps that you're required to complete in your McAfee ePO console before installing the application from the ServiceNow Store for the integration.

    Before you begin

    Role required: McAfee ePO administrator

    As a user with the McAfee ePO administrator permission, verify that you have installed the Servicenow.zip extension plugin in your McAfee ePO console. This extension plugin is required for the integration. For more information and to obtain the plugin, in your ServiceNow AI Platform instance, navigate to Knowledge > Articles > All. In the Search field, enter, ServiceNow Security Operations Extension for McAfee ePO.

    About this task

    The ServiceNow extension plugin connects your ServiceNow AI Platform instance to your McAfee ePO console. This connection allows you to reference the security tags you that create in your McAfee ePO console for the isolate host and initiate malware scan actions to the capability profiles in your ServiceNow AI Platform instance.

    The security tags in your McAfee ePO console must match the security tags in the capability records in your ServiceNow AI Platform instance.

    The following steps show you how to install the extension plugin, create a security tag in your McAfee ePO console, and assign an action to the tag. For more information about the security tags in the McAfee ePO console, see the McAfee Product Documentation website.

    Note:
    The figures in the following section are from the McAfee ePO console.

    Procedure

    1. If you have not installed the ServiceNow extension plugin on your McAfee ePO console, follow these steps to install it.
      1. Log in to your McAfee ePO console with your McAfee user name and password.
        McAfee ePO console login dialog.
    2. If the page shown in the following figure is not displayed, in the top left of banner of the home page, select the menu icon to display it.
      Menu icon McAfee in McAfee ePO.
    3. In the Software section, select the Extensions link.
      Extensions software option highlighted in McAfee ePO.
    4. On the Extensions page that is displayed, select Install Extension.
      Install Extension button highlighted in McAfee ePO.
    5. In the Install Extension dialog, select Choose File, navigate to the Servicenow.zip file on your system, and select OK to download it.
      Install Extension dialog in McAfee ePO.
      After the download is completed, the Software Extensions page is displayed with the ServiceNow Extension plugin listed.
      Extensions page in McAfee ePO.

      You have successfully installed the ServiceNow plugin Extension on your McAfee ePO console.

    6. If you have not created security tags in McAfee ePO console for the initiate malware scan and isolate host actions, follow these steps.
      1. Navigate to the home page and select the Tag Catalog link.
        Tag Catalog highlighted in McAfee ePO.
      2. On the Tag Catalog page that is displayed, select New Tag.
        New Tag button highlighted in McAfee ePO.
      3. With the Description step selected in the progress bar that is displayed, enter a name and description for the tag.

        For this example, a tag with a name and description for the Initiate Malware Scan capability is displayed. This tag name is what is matched and referenced in your ServiceNow AI Platform instance.

        Description field of the Tag Catalog.
      4. To advance to the Criteria step, select Criteria in the progress bar.
        The messages that are displayed indicate that no actions are currently assigned to this tag, and that the tag can only be applied manually.
        Message displayed that ServiceNow tag is required in McAfee ePO.
      5. Select Evaluation in the progress bar to continue.
        Evaluation tab of Tag Catalog.
      6. With the Tag Catalog page of the Evaluation step displayed, leave the settings on this page in their defaults, and, in the progress bar, select Preview.
        Message displayed that ServiceNow tag is required in McAfee ePO.
      7. With the Preview page displayed, in the lower right of the page, select Save to save the record.
        The new tag is displayed in the Tag catalog as shown in the following figure.
        Tag Catalog with ServiceNow tag for initiate malware scan highlighted in McAfee ePO.
    7. Create a security tag for the host isolation action by repeating the previous steps.
      After you have created both tags, you are ready to assign actions to the new tags.
    8. To add an action to your new tag, follow these steps.
      1. Navigate to the home page and in the Policy section, select the Client Task Assignments link.
        Client Task Assignments highlighted in McAfee ePO.
      2. In the System Tree page that is displayed, at the bottom of the page, expand the Actions menu and select New Client Task Assignment.
        Choice list expanded with New Client Task Assignment highlighted in McAfee ePO.
      3. On the page that is displayed, navigate to Endpoint Security Threat Prevention > Policy Based On-Demand Scan > On-Demand Scan - Full Scan by selecting the path as shown in the following figure.
        System Tree with On-Demand Scan highlighted in McAfee ePO.
      4. In the Tags section, under the radio button and next to Has any of these tags:, select the edit link to edit the criteria for the tag.
        Edit link highlighted in System Tree for On-Demand Scan in McAfee ePO.
      5. In the dialog that is displayed, select the Initiate Malware Scan ServiceNow tag that you created in the preceding steps and select OK.

        ServiceNow initiate malware scan tag selected and highlighted in McAfee ePO.

        The ServiceNow Initiate Malware Scan tag you created is assigned to the On-Demand Scan action.
      6. Select OK.
        In the Tags section, under the radio button and next to Has any of these tags:, the Initiate Malware Scan tag is displayed.
        Send this task to only computers which have the following criteria option selected in McAfee ePO.
      7. Select Save.
        On the System Tree page, the task is displayed on the Assigned Client Tasks list (tab).

        On-Demand scan highlighted in System Tree in McAfee ePO.

      8. If you have not assigned an action to the Isolate Host action, repeat the previous steps to assign it.
      You have successfully installed the extension plugin, created security tags, and assigned tasks to your tags. You have completed the setup for the integration in your McAfee ePO console. The next step is to configure a server in your ServiceNow AI Platform instance.