McAfee Network Security Manager (NSM) Integration¶

Overview¶

This integration allows you to connect to McAfee Network Security Manager (NSM) to manage IP address blocking and quarantine, retrieve alert information, and test connectivity.

Configuration¶

The configuration for this integration (API endpoint, credentials, etc.) is managed within the SOAR platform’s Marketplace tab. The actions utilize these pre-configured settings.

Actions¶

Quarantine IP¶

Quarantine a particular IP address.

Arguments:

case_id (string, required): The ID of the case.
alert_group_identifiers (List[string], required): Identifiers for the alert groups.
target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Supports IP entities.
scope (string, optional): Defines the scope for the action. Defaults to “All entities”.

Returns:

dict: A dictionary containing the result of the action execution.

Unblock IP¶

Unblock a particular IP address.

Arguments:

case_id (string, required): The ID of the case.
alert_group_identifiers (List[string], required): Identifiers for the alert groups.
target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Supports IP entities.
scope (string, optional): Defines the scope for the action. Defaults to “All entities”.

Returns:

dict: A dictionary containing the result of the action execution.

Ping¶

Test Connectivity to McAfee NSM.

Arguments:

case_id (string, required): The ID of the case.
alert_group_identifiers (List[string], required): Identifiers for the alert groups.
target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on.
scope (string, optional): Defines the scope for the action. Defaults to “All entities”.

Returns:

dict: A dictionary containing the result of the ping action.

Is IP Blocked¶

Check if an IP address is blocked.

Arguments:

case_id (string, required): The ID of the case.
alert_group_identifiers (List[string], required): Identifiers for the alert groups.
target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Supports IP entities.
scope (string, optional): Defines the scope for the action. Defaults to “All entities”.

Returns:

dict: A dictionary containing the result of the action execution, indicating if the IP is blocked.

Block IP¶

Block IP address.

Arguments:

case_id (string, required): The ID of the case.
alert_group_identifiers (List[string], required): Identifiers for the alert groups.
target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Supports IP entities.
scope (string, optional): Defines the scope for the action. Defaults to “All entities”.

Returns:

dict: A dictionary containing the result of the action execution.

Get Alert Info Data¶

Get alert data by id.

Arguments:

case_id (string, required): The ID of the case.
alert_group_identifiers (List[string], required): Identifiers for the alert groups.
alert_id (string, required): The ID of the alert.
sensor_name (string, required): The name of the sensor associated with the alert.
target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on.
scope (string, optional): Defines the scope for the action. Defaults to “All entities”.

Returns:

dict: A dictionary containing the result of the action execution, including alert details.

Notes¶

Ensure the McAfee NSM integration is properly configured in the SOAR Marketplace tab.
Actions related to IP management (Quarantine, Block, Unblock, Is Blocked) operate on IP address entities within the specified scope.