- 25 Jan 2024
- 2 Minutes to read
McAfee ePolicy Orchestrator (ePO)
- Updated on 25 Jan 2024
- 2 Minutes to read
McAfee ePolicy Orchestrator (ePO) is a security management platform that provides real-time monitoring of security solutions. This adapter connects to the ePO server to import information about devices managed by that solution.
Types of Assets Fetched
This adapter fetches the following types of assets:
Host (required) - The hostname of the McAfee ePolicy Orchestrator (ePO) server that Axonius can communicate with via the Required Ports.
Port (required) - Use TCP port 8443.
User and Password (required) - The credentials for a user account that has permissions to fetch assets.
Installed Software Query ID (optional) - The ID from the URL bar in the ePO. Set this for product name parsing. It should contain the following fields:
Drive Encryption Query ID (optional) - The ID of an existing EPO Query that contains at least 'EPOLeafNode.NodeName' and 'EPESystems.State' information to populate Hard Drive Encryption data for devices. The user specified for the connection must have permissions to access the saved query in order for the additional data to be fetched.
Non-Compliant Devices Query ID (optional) - Select this option to run the query specified by the Query ID. The query itself must be configured to at least return the EPOLeafNode.NodeName column. Any device in which the NodeName matches a result from this query will have the Non-Compliance Detected field set to true. All devices not returned in this query will have the Non-Compliance Detected field set to False.
Events Management Query ID (optional) - Specify the Events Management Query ID to fetch threat events.
Benchmark Query ID (optional) - Specify the Benchmark Query ID to query audit logs.
OAM Query ID (optional) - Specify the OAM Query ID to fetch additional information.
Solidcore Query ID (optional) - Enter a Query ID for Solidcore client data.
Applied Policy Query ID - Select this option to fetch assigned Policy information, such as applied firewall rules.
Use Rolled Up Query - Select whether to use a rolled-up query from multiple databases.
To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.
Advanced settings can either apply for all connections for this adapter, or you can set different advanced settings and/or different scheduling for a specific connection, refer to Advanced Configuration for Adapters.
- Exclude IPv6 addresses - Select this option to fetch IPv6 addresses (as well as IPv4 addresses).
- ePO tags Include list (optional) - Specify a comma-separated list of McAfee ePO tags.
- If supplied, all connections for this adapter will only fetch devices tagged in McAfee ePO with the tags provided in this list.
- If not supplied, the connection for this adapter will fetch all devices from McAfee ePO.
- Include devices with no Agent GUID - Select to include devices with no Agent GUID, using their EPOLeafNode.NodeName as the ID. When option is cleared, these devices are ignored.
For details on general advanced settings under the Adapter Configuration tab, see Adapter Advanced Settings.
Axonius uses the ePolicy Orchestrator Web API.
Axonius must be able to communicate with the value supplied in Host Name or IP Address via the following ports:
- TCP port 8443
Create a service account in McAfee ePO that is view for the systems tree tab and sub systems tree. View System tree acccess of "my organization"
Under Host Viewer: Queries and Reports select Use public groups, and the shared groups,