Get started with the McAfee ESM - Incident Enrichment integration

McAfee ESM protects endpoints against viruses, spyware, Trojan horses, and other malware threats and integrates easily with Security Operations. Before you can use the McAfee ESM - Incident Enrichment integration, you must activate the plugin and add the appropriate API Base URL and login credentials.

Before you begin

Role required: sn_si_admin

About this task

This procedure can be used to activate the plugin and configure the integration. You can also activate the plugin using the traditional method. If you activate the plugin using the traditional method, the McAfee ESM - Incident Enrichment integration recognizes the installation and the integration card displays the New button. Proceed to step 5.


  1. Navigate to Security Operations > Integrations > Integration Configuration.
    The available security integrations appear as a series of cards.
    McAfee ESM integration card
  2. In the McAfee ESM - Incident Enrichment card, click Install Plugin.
  3. In the Install McAfee ESM - Incident Enrichment dialog box, review the plugin details and click Activate.
  4. When the activation is complete, click Close & Reload Form.
    The Security Integration screen reloads and the New button for the integration is available.
  5. Click New.
    McAfee ESM configuration
  6. Fill in the fields, as needed.
    Field Description
    Name The name of this configuration.
    McAfee ESM API Base URL The base URL you acquired from the McAfee ESM site.
    Link URL [Optional] The Link URL that links to an McAfee ESM instance, when available.
    Username Your McAfee ESM username.
    Password Your McAfee ESM password.
    Max Rows The maximum number of rows you want to search.
    Earliest Result (days) The earliest results you want to see in number of days.
    Include raw data samples in search results Select this to include samples of raw data in your sightings search results. The amount of data returned depends on your setting in the number of rows of raw data property in Security Incident Response properties.
    MID Server Select Any to use any active MID Server, or select a specific MID Server name.
    Note: Configuring this integration activates workflows. To manage the workflows, navigate to the Workflow Editor.
  7. Click Submit.
    The integration configuration card displays.
  8. When viewing the new configuration card, you can click Configure or Delete to change or delete the configuration, respectively.
  9. To return to the original list of integration configuration cards, select No from the Show Configurations drop-down list.