McAfee ESM in the Cloud
Configure a McAfee ESM cloud device to pull IOCs from Threat Command. You must first add the device to Threat Command and then configure the device to pull IOCs from Threat Command.
Add a McAfee ESM cloud device
Add a cloud device to Threat Command.
- You have the credentials to access the device.
- You have administrative credentials to access Threat Command with a subscription to the Automation and TIP modules.
To add a cloud device to Threat Command:
- Log in to Threat Command at https://dashboard.ti.insight.rapid7.com
- From the main menu, select Automation -> Integrations.
- From the Integrations page, click Cloud.
- Click Add new device.
- In the Add New Cloud Device dialog, type a user-defined name for the device.
The name can contain a maximum of 50 letters, spaces, numbers, and underscores.
- Select the Device type.
The default device IOCs limit is displayed.
- (Optional) You can change the IOCs limit.
- Click Add.
- To verify that the new device is added, refresh the Automation > Integrations page.
The new device is added to the cloud integrations device list. Next to the device name, there is a red dot, indicating that communication has not yet been established. The dot will change to green when the device is synchronized. If the device cannot synchronize for more than 48 hours, an email warning is sent to the account administrator.
Configure a McAfee ESM cloud to pull IOCs from Threat Command
Integration with McAfee ESM includes two steps:
- Create a watchlist
- Create an alarm
Create a watchlist
- Log in to McAfee ESM Management console.
- Select Watchlists:
- Select a Watchlist and click Add:
- Main tab - Add Watchlist details
- Sources tab - Add Source details
- Parsing tab - Set Parsing details
- Values tab - Set and test values