- 01 Feb 2023
- 2 Minutes to read
McAfee ePolicy Orchestrator (ePO)
- Updated on 01 Feb 2023
- 2 Minutes to read
McAfee ePolicy Orchestrator (ePO) is a security management platform that provides real-time monitoring of security solutions. This adapter connects to the ePO server to import information about devices managed by that solution.
Types of Assets Fetched
This adapter fetches the following types of assets:
Host (required) - The hostname of the McAfee ePolicy Orchestrator (ePO) server that Axonius can communicate with via the Required Ports.
Port (required) - Use TCP port 8443.
User and Password (required) - The credentials for a user account that has permissions to fetch assets.
Installed Software Query ID (optional) - The ID from the URL bar in the ePO. Set this for product name parsing. It should contain the following fields:
Drive Encryption Query ID (optional) - The ID of an existing EPO Query that contains at least 'EPOLeafNode.NodeName' and 'EPESystems.State' information to populate Hard Drive Encryption data for devices. The user specified for the connection must have permissions to access the saved query in order for the additional data to be fetched.
Non-Compliant Devices Query ID (optional) - Select this option to run the query specified by the Query ID. The query itself must be configured to at least return the EPOLeafNode.NodeName column. Any device in which the NodeName matches a result from this query will have the Non-Compliance Detected field set to true. All devices not returned in this query will have the Non-Compliance Detected field set to False.
Events Management Query ID (optional) - Specify the Events Management Query ID to fetch threat events.
Benchmark Query ID (optional) - Specify the Benchmark Query ID to query audit logs.
OAM Query ID (optional) - Specify the OAM Query ID to fetch additional information.
Solidcore Query ID (optional) - Enter a Query ID for Solidcore client data.
Use Rolled Up Query - Select whether to use a rolled-up query from multiple databases.
To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.
From Version 4.6, Advanced settings can either apply for all connections for this adapter, or you can set different advanced settings and/or different scheduling for a specific connection, refer to Advanced Configuration for Adapters.
- Exclude IPv6 addresses - Specify whether to fetch IPv6 addresses.
- If enabled, all connections for this adapter will fetch only IPv4 addresses.
- If disabled, all connections for this adapter will fetch both IPv4 and IPv6 addresses.
- ePO tags Include list (optional) - Specify a comma-separated list of McAfee ePO tags.
- If supplied, all connections for this adapter will only fetch devices tagged in McAfee ePO with the tags provided in this list.
- If not supplied, the connection for this adapter will fetch all devices from McAfee ePO.
- Include devices with no Agent GUID - Select to include devices with no Agent GUID, using their EPOLeafNode.NodeName as the ID. When option is cleared, these devices are ignored.
For details on general advanced settings under the Adapter Configuration tab, see Adapter Advanced Settings.
Axonius uses the McAfee ePolicy Orchestrator Web API.
Axonius must be able to communicate with the value supplied in Host Name or IP Address via the following ports:
- TCP port 8443
Create a service account in McAfee ePO that is view for the systems tree tab and sub systems tree. View System tree acccess of "my organization"
Under Host Viewer: Queries and Reports select Use public groups, and the shared groups,