Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The McAfee ESM Operation allows a ThreatQ user to add geolocation attributes and related indicators (if available) of IP Addresses within ThreatQ.

• Query Hash 
• Query IP 

The operation is compatible with the following indicator types:

• IP Address
• MD5
• SHA-1
• SHA-256

Installation

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Operation option from the Type dropdown (optional).
3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   ESM IP	The IP or Hostname of the McAfee ESM instance.
   ESM Username	Your username for logging into ESM.
   ESM Password	Your password for logging into ESM.
   ESM Result Limit	The maximum number of sightings to display.
   ESM Time Range	The historical time period on which to perform the query. The default value is the Current Quarter. Options include: Last Minute Last 10 Minutes Last 30 Minutes Last Hour Current Day Current Year Previous Day Last 24 Hours Last 48 Hours Last 72 Hours Previous Year Current Week Previous Week Current Month Previous Month Current Quarter Previous Quarter All

5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

Change Log

• Version 0.0.4
  • Initial release