McAfee ATD
Integration version: 11.0
Important: McAfee ATD became part of the Trellix product portfolioand was renamed to Trellix ATD.Configure McAfee ATD integration in Google Security Operations
For detailed instructions on how to configure an integration inGoogle SecOps, seeConfigureintegrations.
Actions
Check Hash
Description
Check if a hash is blacklisted.
Parameters
N/A
Use cases
N/A
Run On
This action runs on the Filehash entity.
Action Results
Entity Enrichment
N/A
Insights
N/A
Script Result
| Script Result Name | Value Options | Example |
|---|---|---|
| is_blacklisted | True/False | is_blacklisted:False |
JSON Result
[{"EntityResult":true,"Entity":"ebdd035084968f675ee1510519dd8319"}]Get Analyzer Profiles
Description
Get Trellix ATD analyzer profiles data.
Parameters
N/A
Use cases
N/A
Run On
This action runs on all entities.
Action Results
Entity Enrichment
N/A
Insights
N/A
Script Result
| Script Result Name | Value Options | Example |
|---|---|---|
| is_success | True/False | is_success:False |
JSON Result
[{"overrideOS":0,"logZip":0,"family":0,"default64OSName":"","artimas":0,"yararules":0,"xMode":0,"consoleLog":0,"sophosAV":0,"defaultVM":0,"userLog":0,"filePassword1":"","dnnEnable":0,"recusiveAnalysis":0,"imageid":0,"vmDesc":"Only Down Selectors","heuristic":0,"netdriveZip":0,"ssKeyid":1,"gtiTS":1,"ssAPIid":1,"pe32":0,"createTime":"2012-12-01 02:16:01","locBlackList":1,"openarchive":1,"yaraScan":0,"runtimeArgument":"","dumpZip":0,"userid":1,"filePassword":"","internet":0,"default32OSName":"","lastChange":"2018-08-20 01:04:37","summary":1,"maxExecTime":180,"asm":0,"ntvLog":0,"name":"Analyzer Profile 1","reAnalysis":1,"noPDF":0,"flp":0,"mfeAV":1,"aviraAV":0,"vmProfileid":1,"gam":1,"gml":0,"netLog":0,"sandbox":0,"dropZip":0,"selectedOSName":"","minExecTime":5,"ssLevelid":1,"gtiURLRep":0,"customrules":0,"locWhiteList":0}]Get Report
Description
Get a report for task IDs.
Parameters
| Parameter | Type | Default Value | Description |
|---|---|---|---|
| Task IDs | String | N/A | The IDs of the tasks to fetch reports for, comma separated. |
| Create Insight | Boolean | Checked | If enabled, action will create an insight containing all of the retrieved information about the report. |
Use cases
N/A
Run On
This action runs on all entities.
Action Results
Insights
N/A
Script Result
| Script Result Name | Value Options | Example |
|---|---|---|
| report | True/False | report:False |
JSON Result
{"95":{"Summary":{"JSONversion":"1.002","SubmitterName":"User","Subject":{"Name":"events.txt","Timestamp":"2018-08-21 08:29:48","FileType":"2","sha-256":"74834D752D73B4C81EAD10184A091C12AA30BD809D575FD9CFA07B0EBBD7A0D7","sha-1":"6BDA9FCFB56CE2B34168D499EE04970F640ADD9A","parent_archive":"Not Available","md5":"11FBEF3A9916BF50EC5002B5795B23C3","Type":"ASCII text","size":"481231"},"Process":[{"Reason":"processed by down selectors","Name":"events.txt","Severity":"0"}],"Data":{"compiled_with":"Not Available","analysis_seconds":"181","sandbox_analysis":"0"},"SUMversion":"1.1.1.1","JobId":"95","SubmitterType":"STAND_ALONE","Behavior":["Identified as --- by GTI File Reputation","Identified as --- by Anti-Malware"],"hasDynamicAnalysis":"false","TaskId":"95","Verdict":{"Severity":"0","Description":"No malicious activity was detected, but this does NOT mean that execution of the sample is safe"},"OSversion":"StaticAnalysis","Selectors":[{"Engine":"GTI File Reputation","Severity":"0","MalwareName":"---"},{"Engine":"Anti-Malware","Severity":"0","MalwareName":"---"},{"Engine":"Sandbox","Severity":"0","MalwareName":"---"}],"MISversion":"1.1.1.1","DETversion":"1.1.1.1"}}}Ping
Description
Verify that the user has a connection to Trellix ATD via the user's device.
Parameters
N/A
Use cases
N/A
Run On
This action runs on all entities.
Action Results
Entity Enrichment
N/A
Insights
N/A
Script Result
| Script Result Name | Value Options | Example |
|---|---|---|
| is_success | True/False | is_success:False |
JSON Result
N/ASubmit File
Description
Submit a file for analysis.
Parameters
| Parameter | Type | Default Value | Description |
|---|---|---|---|
| File Paths | String | N/A | The paths of the file to submit, comma separated. |
| Analyzer Profile ID | String | N/A | The ID of the analyzer profile to analyze with. |
Use cases
N/A
Run On
This action runs on all entities.
Action Results
Entity Enrichment
N/A
Insights
N/A
Script Result
| Script Result Name | Value Options | Example |
|---|---|---|
| task_id | True/False | task_id:False |
JSON Result
{"C:\\temp\\test.txt\": 95}Submit URL
Description
Submit a URL for analysis.
Parameters
| Parameter | Type | Default Value | Description |
|---|---|---|---|
| Analyzer Profile ID | String | N/A | The ID of the analyzer profile to analyze the URLs with. It can be found in ATD under the Policy Analyzer Profile section. |
| Create Insight | Boolean | Checked | If enabled, action will create an insight containing all of the retrieved information about the entity. |
Run On
This action runs on the URL entity.
Action Results
Entity Enrichment
| Enrichment Field Name | Logic-When to apply |
|---|---|
| Summary | Returns if it exists in JSON result |
Script Result
| Script Result Name | Value Options | Example |
|---|---|---|
| report | True/False | report:False |
JSON Result
[{"EntityResult":{"Summary":{"JSONversion":"1.002","SubmitterName":"User","Subject":{"sha-1":"6BDA9FCFB56CE2B34168D499EE04970F640ADD9A","Timestamp":"2018-08-21 08:29:48","FileType":"2","sha-256":"74834D752D73B4C81EAD10184A091C12AA30BD809D575FD9CFA07B0EBBD7A0D7","parent_archive":"Not Available","Name":"events.txt","md5":"11FBEF3A9916BF50EC5002B5795B23C3","Type":"ASCII text","size":"481231"},"Process":[{"Reason":"processed by down selectors","Name":"events.txt","Severity":"0"}],"Data":{"compiled_with":"Not Available","analysis_seconds":"181","sandbox_analysis":"0"},"SUMversion":"1.1.1.1","JobId":"95","SubmitterType":"STAND_ALONE","Behavior":["Identified as --- by GTI File Reputation","Identified as --- by Anti-Malware"],"hasDynamicAnalysis":"false","TaskId":"95","Verdict":{"Description":"No malicious activity was detected, but this does NOT mean that execution of the sample is safe","Severity":"0"},"OSversion":"StaticAnalysis","Selectors":[{"Engine":"GTI File Reputation","Severity":"0","MalwareName":"---"},{"Engine":"Anti-Malware","Severity":"0","MalwareName":"---"},{"Engine":"Sandbox","Severity":"0","MalwareName":"---"}],"MISversion":"1.1.1.1","DETversion":"1.1.1.1"}},"Entity":"http://google.com"}]Need more help?Get answers from Community members and Google SecOps professionals.
Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2026-02-19 UTC.