McAfee ESM in the Cloud

Configure a McAfee ESM cloud device to pull IOCs from Threat Intelligence. You must first add the device to Threat Intelligence and then configure the device to pull IOCs from Threat Intelligence.

Add a McAfee ESM cloud device

Add a cloud device to Threat Intelligence.

Prerequisites

• You have the credentials to access the device.

To add a cloud device to Threat Intelligence:

1. From the Command Platform main menu, navigate to Data Connectors > Threat Intelligence > Integrations.
2. From the Integrations page, click the Cloud tab.
3. Click Add new device.
4. In the Add New Cloud Device dialog, type a user-defined name for the device. The name can contain a maximum of 50 letters, spaces, numbers, and underscores.
5. Select the Device type.
   The default device IOCs limit is displayed.
6. (Optional) You can change the IOCs limit.
7. Click Add.
8. To verify that the new device is added, refresh the Integrations page.

The new device is added to the cloud integrations device list. Next to the device name, there is a red dot, indicating that communication has not yet been established. The dot will change to green when the device is synchronized. If the device cannot synchronize for more than 48 hours, an email warning is sent to the account administrator.

Configure a McAfee ESM cloud to pull IOCs from Threat Intelligence

Integration with McAfee ESM includes two steps:

1. Create a watchlist
2. Create an alarm

Create a watchlist

1. Log in to McAfee ESM Management console.
2. Select Watchlists:
3. Select a Watchlist and click Add:
4. Main tab - Add Watchlist details
   • Name – custom name
   • Set type to: Dynamic.
   • Enable automatic updates.
   • Set update interval to 15 minutes:
   
5. Sources tab - Add Source details
   1. Set the HTTP/HTTPS source type.
   2. Add the URL taken from the device integration IOC list (ref page 14).
   3. Authentication: None
   4. Method: GET
   5. Test connection
   
6. Parsing tab - Set Parsing details
   1. Set the regular expression value to: +
   2. Set ‘Matching Group’ to: Group1
   
7. Values tab - Set and test values
   1. Click run, you should see the IOC values.
   2. Finish
   

Create an alarm

1. Select Watchlists
2. On the Alarms tab, select an alarm and click Add.
3. Under Condition, add your Match condition. The example below uses ‘Field Match’ to match between Domains and File Hashes to IOCs from Rapid7.