McAfee NSM
Versi integrasi: 6.0
Ringkasan
Mengonfigurasi integrasi McAfee NSM di Google Security Operations
Untuk mendapatkan petunjuk mendetail terkait cara mengonfigurasi integrasi di Google SecOps, lihat Mengonfigurasi integrasi.
Parameter integrasi
Gunakan parameter berikut untuk mengonfigurasi integrasi:
| Parameter | Jenis | Nilai Default | Wajib | Deskripsi |
|---|---|---|---|---|
| Root API | String | https://x.x.x.x/sdkapi/ | Benar | |
| Nama pengguna | String | T/A | Benar | |
| Sandi | Sandi | T/A | Benar | |
| ID Domain | String | T/A | Benar | |
| Nama Kebijakan Siemplify | String | T/A | Benar | |
| Daftar Nama Sensor yang Dipisahkan Koma | String | sensor_name1,sensor_name2,sensor_name3 | Benar |
Tindakan
Blokir IP
Deskripsi
Blokir alamat IP.
Parameter
T/A
Run On
Tindakan ini dijalankan pada entity Alamat IP.
Hasil Tindakan
Pengayaan Entity
T/A
Insight
T/A
Hasil Skrip
| Nama Hasil Skrip | Opsi Nilai | Contoh |
|---|---|---|
| is_success | Benar/Salah | is_success:False |
Hasil JSON
N/A
Mendapatkan Data Info Pemberitahuan
Deskripsi
Mendapatkan data pemberitahuan menurut ID.
Parameter
| Parameter | Jenis | Nilai Default | Wajib | Deskripsi |
|---|---|---|---|---|
| ID pemberitahuan | String | https://x.x.x.x/sdkapi/ | Benar | T/A |
| Nama Sensor | String | T/A | Benar | T/A |
Run On
Tindakan ini dijalankan di semua entity.
Hasil Tindakan
Pengayaan Entity
T/A
Insight
T/A
Hasil Skrip
| Nama Hasil Skrip | Opsi Nilai | Contoh |
|---|---|---|
| alert_json | T/A | T/A |
Hasil JSON
{
"name": "MALWARE: Blacklisted File Detected",
"assignTo": "---",
"description": {
"definition": "A McAfee-maintained blacklist that is dynamically updated with Callback Detectors updates.",
"signatures": [{
"conditions": "null"
}],
"componentAttacks": "null",
"target": "ServerOrClient",
"reference": {
"cveId": "[]",
"certId": "null",
"bugtraqId": "[]",
"nspId": "0x4840c300",
"microsoftId": "[]",
"additionInfo": "null",
"arachNidsId": "[]"
},
"protocals": "[smtp, ftp, http]",
"comments": {
"availableToChildDomains": "true",
"parentDomainComments": "null",
"comments": " "
},
"rfSB": "No",
"attackCategory": "Malware",
"attackSubCategory": "---",
"protectionCategory": "[Malware/Bot]",
"httpResponseAttack": "No",
"btf": "Medium"
},
"summary": {
"destination": "null",
"zoombie": "null",
"target": {
"ipAddrs": "1.1.1.1",
"risk": "N/A",
"country": "India",
"networkObject": "---",
"hostName": "null",
"vmName": "null",
"proxyIP": "1.1.1.1",
"user": "Unknown",
"os": "---",
"port": 41128
},
"attacker": {
"ipAddrs": "1.1.1.1",
"risk": "N/A",
"country": "India",
"networkObject": "---",
"hostName": "null",
"vmName": "null",
"proxyIP": "1.1.1.1",
"user": "Unknown",
"os": "---",
"port": 80
},
"cAndcServer": "null",
"source": "null",
"compromisedEndpoint": "null",
"attackedHIPEndpoint": {
"ipAddrs": "1.1.1.1",
"risk": "N/A",
"country": "India",
"networkObject": "---",
"hostName": "null",
"vmName": "null",
"proxyIP": "1.1.1.1",
"user": "Unknown",
"os": "---",
"port": 41128
},
"fastFluxAgent": "null",
"event": {
"domain": "My Company",
"protocol": "http",
"zone": "null",
"alertId": "2246015847757997493",
"attackCount": 1,
"vlan": "-11",
"direction": "Inbound",
"detection": "Signature",
"application": "HTTP",
"device": "NS9100-50",
"result": "Inconclusive",
"time": "Jan 04, 2016 09:50:39",
"relevance": "Unknown",
"matchedPolicy": "CustomFP_Engine_With_AlertOnly",
"interface": "G3/1-G3/2"
}},
"details": {
"malwareFile": {
"engine": "Manager Blacklist",
"fileHash": "3f3f7c3b9722912ddeddf006cff9d9d0",
"malwareConfidence": "Very High",
"malwareName": "null",
"fileName": "/Firewall.cpl",
"size": "6144 bytes"
},
"exceededThreshold": "null",
"callbackDetectors": "null",
"layer7": {
"httpReturnCode": 200,
"httpURI": "/Firewall.cpl",
"httpRequestMethod": "GET",
"httpServerType": "Apache/2.2.13 (Fedora) Last - Modified: Wed, 10 Oct 2012 05: 19: 15 GMT",
"httpHostHeader": "null",
"httpUserAgent": "Wget/1.11.4 (Red Hat modified)"
},
"portScan": "null",
"sqlInjection": "null",
"triggeredComponentAttacks": "null",
"hostSweep": "null",
"matchedSignature": "null",
"communicationRuleMatch": "null",
"fastFlux": "null"
},
"alertState": "UnAcknowledged",
"uniqueAlertId": "6245941293374080682"
}
IP Diblokir
Deskripsi
Periksa apakah alamat IP diblokir.
Parameter
T/A
Run On
Tindakan ini dijalankan pada entity Alamat IP.
Hasil Tindakan
Pengayaan Entity
T/A
Insight
T/A
Hasil Skrip
| Nama Hasil Skrip | Opsi Nilai | Contoh |
|---|---|---|
| is_success | Benar/Salah | is_success:False |
Hasil JSON
N/A
Ping
Deskripsi
Uji Konektivitas.
Parameter
T/A
Run On
Tindakan ini dijalankan di semua entity.
Hasil Tindakan
Pengayaan Entity
T/A
Insight
T/A
Hasil Skrip
| Nama Hasil Skrip | Opsi Nilai | Contoh |
|---|---|---|
| is_success | Benar/Salah | is_success:False |
Hasil JSON
N/A
Mengarantina IP
Deskripsi
Mengarantina alamat IP tertentu.
Parameter
T/A
Run On
Tindakan ini dijalankan pada entity Alamat IP.
Hasil Tindakan
Pengayaan Entity
T/A
Insight
T/A
Hasil Skrip
| Nama Hasil Skrip | Opsi Nilai | Contoh |
|---|---|---|
| is_success | Benar/Salah | is_success:False |
Hasil JSON
N/A
Berhenti memblokir IP
Deskripsi
Berhenti memblokir alamat IP tertentu.
Parameter
T/A
Run On
Tindakan ini dijalankan pada entity Alamat IP.
Hasil Tindakan
Pengayaan Entity
T/A
Insight
T/A
Hasil Skrip
| Nama Hasil Skrip | Opsi Nilai | Contoh |
|---|---|---|
| is_success | Benar/Salah | is_success:False |
Hasil JSON
[{
"EntityResult":
[{
"EPOEvents.ThreatCategory": "av.detect",
"EPOEvents.TargetUserName": "VM-EPOAGENTTEST\\\\\\\\Admin",
"EPOEvents.TargetPort": "None",
"EPOEvents.TargetFileName": "C:\\\\\\\\Users\\\\\\\\Admin\\\\\\\\Desktop\\\\\\\\eicar.txt",
"EPOEvents.TargetIPV4": -1979711347,
"EPOEvents.ThreatName": "EICAR test file",
"EPOEvents.SourceUserName": "None",
"EPOEvents.TargetProcessName": "None",
"EPOEvents.SourceProcessName": "None",
"EPOEvents.ThreatType": "test",
"EPOEvents.SourceIPV4": -1979711347,
"EPOEvents.TargetProtocol": "None",
"VSECustomEvent.MD5": "44d88612fea8a8f36de82e1278abb02f",
"EPOEvents.SourceURL": "None",
"EPOEvents.ThreatActionTaken": "deleted",
"EPOEvents.TargetHostName": "VM-EPOAGENTTEST",
"EPOEvents.ThreatHandled": "True",
"EPOEvents.SourceHostName": "_"
}, {
"EPOEvents.ThreatCategory": "av.detect",
"EPOEvents.TargetUserName": "VM-EPOAGENTTEST\\\\\\\\Admin",
"EPOEvents.TargetPort": "None",
"EPOEvents.TargetFileName": "C:\\\\\\\\Users\\\\\\\\Admin\\\\\\\\Desktop\\\\\\\\eicar.txt",
"EPOEvents.TargetIPV4": -1979711347,
"EPOEvents.ThreatName": "EICAR test file",
"EPOEvents.SourceUserName": "None",
"EPOEvents.TargetProcessName": "None",
"EPOEvents.SourceProcessName": "None",
"EPOEvents.ThreatType": "test",
"EPOEvents.SourceIPV4": -1979711347,
"EPOEvents.TargetProtocol": "None",
"VSECustomEvent.MD5": "44d88612fea8a8f36de82e1278abb02f",
"EPOEvents.SourceURL": "None",
"EPOEvents.ThreatActionTaken": "deleted",
"EPOEvents.TargetHostName": "VM-EPOAGENTTEST",
"EPOEvents.ThreatHandled": "True",
"EPOEvents.SourceHostName": "_"
}],
"Entity": "44d88612fea8a8f36de82e1278abb02f"
}]
Perlu bantuan lain? Dapatkan jawaban dari anggota Komunitas dan profesional Google SecOps.