McAfee MVISION EDR

Integration version: 8.0

For detailed instructions on how to configure an integration inGoogle SecOps, seeConfigureintegrations.

Integration parameters

Use the following parameters to configure the integration:

How to generate Client ID and Client Secret

For more information on how to generate Client ID and Client Secret, see theMcAfee MVISION EDRIntegrationsdocument.

Use Cases

1. Ingest Trellix EDR threats and detections to use them to createGoogle SecOps alerts. Next, in Google SecOps, alerts canbe used to perform orchestrations with playbooks or manual analysis.
2. Perform enrichment actions - get data from Trellix EDR to enrich datain Google SecOps Alerts.
3. Perform active actions - quarantine a host using Trellix EDR agentfrom Google SecOps.

Actions

Ping

Description

Test connectivity to Trellix EDR with parameters provided at theintegration configuration page in the Google Security Operations Marketplace tab.

Parameters

N/A

Use Cases

The action is used to test connectivity at the integration configuration page inthe Google Security Operations Marketplace tab, and it can be executed as a manual action,not used in playbooks.

Run On

This action doesn't run on entities, nor has mandatory input parameters.

Action Results

Script Result

JSON Result

N/A

Entity Enrichment

N/A

Insights

N/A

Enrich Endpoint

Description

Fetch endpoint's system information by its hostname or IP address.

Parameters

N/A

Run On

This action runs on the following entities:

• IP Address
• Hostname

Action Results

Script Result

JSON Result

{"total":9,"skipped":0,"items":1,"hosts":[{"maGuid":"3975892D-E16D-45C0-8795-164CFDF27946","hostname":"AWS-LT-EDR1","os":{"major":10,"minor":0,"build":18362,"sp":"","desc":"Windows 10"},"lastBootTime":"2020-02-24T21:41:38Z","netInterfaces":[{"name":"Ethernet 2","macAddress":"02:33:86:c2:6b:d4","ip":"10.0.3.212","type":6}],"traceExtendedVisibility":0}]}

Entity Enrichment

Insights

N/A

Quarantine Endpoint

Description

Create quarantine endpoint task on the Trellix EDR server based on theGoogle SecOps IP Address or Hostname entities.

Known Issue from Trellix

Reference:Trellix EDR Known Issues

When you quarantine an endpoint connected to a VPN, the endpoint becomesunreachable. You can't send the reaction to End the Quarantine.

Workaround:

1. Gain physical access to the endpoint.
2. Uninstall the EDR Client from Add and Remove Programs.
3. Install the EDR client again.

Parameters

N/A

Run On

This action runs on the following entities:

• IP Address
• Hostname

Action Results

Script Result

JSON Result

N/A

Entity Enrichment

N/A

Insights

N/A

Unquarantine Endpoint

Description

Create unquarantine endpoint task on the McAfee MVISION EDR server based on theGoogle SecOps IP Address or Hostname entities.

Known Issue from Trellix

Reference:Trellix EDR Known Issues

When you quarantine an endpoint connected to a VPN, the endpoint becomesunreachable. You can't send the reaction to End the Quarantine.

Workaround:

1. Gain physical access to the endpoint.
2. Uninstall the EDR Client from Add and Remove Programs.
3. Install the EDR client again.

Parameters

N/A

Run On

This action runs on the following entities:

• IP Address
• Hostname

Action Results

Script Result

JSON Result

N/A

Entity Enrichment

N/A

Insights

N/A

Remove File

Description

Remove a file from the endpoint.

Action execution known issue

McAfee may not remove files and still show in the WebUI that action was executedsuccessfully. The following issue can be related to permissions on agent.Verify that the agent has the required permissions and try again.

Parameters

Run On

This action runs on the following entities:

• IP Address
• Hostname

Action Results

Script Result

JSON Result

N/A

Entity Enrichment

N/A

Insights

N/A

Stop And Remove Content

Description

Stop interpreter process by PID, for example Python or Bash, and remove theassociated script by full path on the McAfee MVISION EDR.

Action execution known issue

McAfee may not remove or kill associated files and still show in the WebUI thataction was executed successfully. The following issue can be related topermissions on agent. Verify that the agent has the required permissions and try again.

Parameters

Run On

This action runs on the following entities:

• IP Address
• Hostname

Action Results

Script Result

JSON Result

N/A

Entity Enrichment

N/A

Insights

N/A

Kill Process

Description

Stop a running process and remove its file. If the process is not running, thenits file is just removed from the managed endpoint.

Parameters

Run On

This action runs on the following entities:

• IP Address
• Hostname

Action Results

Script Result

JSON Result

N/A

Entity Enrichment

N/A

Insights

N/A

Dismiss Threat

Description

Dismiss threat in Trellix EDR.

Parameters

Run On

This action doesn't run on entities.

Action Results

Script Result

JSON Result

N/A

Entity Enrichment

N/A

Insights

N/A

Connectors

McAfee MVISION EDR - Threats Connector

Description

Trellix EDR threats can be updated with new detections with time. Rightnow, in order to process new detections, you would need to dismiss the threat.This way Trellix EDR will create a new threat and it will be ingestedinto Google SecOps with those new detections. In other cases, newdetections that were added after ingestion of threat will not be availablewithin Google SecOps.

Configure McAfee MVISION EDR - Threats Connector in Google SecOps

For detailed instructions on how to configure a connector inGoogle SecOps, seeConfiguring theconnector.

Connector parameters

Use the following parameters to configure the connector:

Connector Rules

Proxy Support

The connector supports proxy.

Need more help?Get answers from Community members and Google SecOps professionals.