McAfee NSM (Network Security Manager)
This pack includes Cortex XSIAM content.
McAfee Network Security Manager
This pack includes Cortex XSIAM content.
This pack includes Cortex XSIAM content.
McAfee NSM syslog event types:
config Syslog IPS Events:
In McAfee NSM, go to Manager > Setup> Notification > IPS Events > syslog.
In Enable Syslog Notification, click YES .
Click + and add the target server.
If you do not have a configured target server, click Add near Target Server and fill in the target server details.
In Facility, select Log Alert (note 1).
In Severity mapping, leave the configuration as it. It should be:
Click the Notify for all Alerts checkbox.
Click Save.
Configure Syslog Faults Events:
Configure Syslog User Activity (audit logs) Events:
By default, on Fault and IPS events (syslog) do not have an event time. To add an event time, perform the following:
IPS Events
at $IV_ATTACK_TIME$
.Syslog Faults
at $IV_FAULT_TIME$
.Note:
In order to parse the timestamp correctly, make sure to configure the logs to be sent in a UTC timezone (timestamp ends with UTC).
In order to use the collector, use the Broker VM option.
To create or configure the Broker VM, use the information described here.
You can configure the specific vendor and product for this instance.
Name | Description |
---|---|
McAfee NSM (Deprecated) | Deprecated. Use McAfee NSM v2 integration instead. |
McAfee NSM v2 | McAfee Network Security Manager gives you real-time visibility and control over all McAfee intrusion prevention systems deployed across your network. |
Name | Description |
---|---|
McAfee NSM (Deprecated) | Deprecated. Use McAfee NSM v2 integration instead. |
McAfee NSM v2 | McAfee Network Security Manager gives you real-time visibility and control over all McAfee intrusion prevention systems deployed across your network. |
Name | Description |
---|---|
McAfee NSM Modeling Rule |
Name | Description |
---|---|
McAfeeNSM Parsing Rule |
Pack Name | Pack By |
---|---|
Base | By: Cortex XSOAR |
Pack Name | Pack By |
---|
Pack Name | Pack By |
---|---|
Base | By: Cortex XSOAR |
Added the Product Version parameter to select the API version that the integration integrates with.
You can now run the following commands with API version 10:
nsm-create-rule-object,
nsm-update-rule-object,
nsm-list-domain-rule-object,
nsm-get-rule-object.
Added the following commands to support the configuration deploy process:
nsm-get-device-configuration,
nsm-deploy-device-configuration.
Added the following commands to support update policy assignments:
nsm-assign-interface-policy,
nsm-assign-device-policy.
Added the following commands:
nsm-list-interface-policy,
nsm-list-domain-device,
nsm-list-device-interface,
nsm-list-device-policy.
Updated the Docker image to: demisto/python3:3.10.10.51930.
Certification | Certified | Read more |
Supported By | Cortex | |
Created | November 9, 2020 | |
Last Release | June 25, 2024 |