HOW-TO GUIDE Tenable for McAfee epolicy Orchestrator Introduction This document describes how to deploy Tenable SecurityCenter for integration with McAfee epolicy Orchestrator (epo). Please email any comments and suggestions to support@tenable.com. As the most advanced security management software in the industry, McAfee epo provides a unified view of an organization s security posture along with streamlined workflows for improved security operation efficiency. Utilized by more than 30 thousand customers worldwide, and deployed to more than 60 million nodes, McAfee epo simplifies risk and compliance for organizations of all sizes by combining security management of endpoints, networks, data, and compliance solutions within a single pane of glass. Tenable Network Security has partnered with Intel Security (formerly McAfee) to allow McAfee epo customers the ability to import Tenable vulnerability data into epo for a consolidated view of assets and their vulnerability state. A custom, McAfee-certified application created by Tenable allows McAfee epo to integrate with Tenable SecurityCenter. The custom application, which resides on the McAfee epo system, calls to the SecurityCenter API to retrieve vulnerability data. McAfee epo customers have the ability to configure how often the connection is made and the amount of vulnerability data that is imported in order to meet their specific needs. By simplifying and automating the access to Tenable vulnerability data, epo customers can now gain an even more complete view of the assets, and the risk to those assets, within their organization. Integration Requirements The following are required in order to integrate SecurityCenter with McAfee epo: McAfee epo version 5.3 or higher McAfee Rogue System Detection (RSD) extension 5.0.2 or higher (refer to the McAfee Rogue System Detection Product Guide located at https://support.mcafee.com for download and installation instructions) SecurityCenter version 5.1.0 or higher SecurityCenter Security Manager account dedicated for use with McAfee epo Tenable SecurityCenter Extension for epo (available for download at https://support.tenable.com, filename SC5_EPO_ConnectorV1.zip) and Log Correlation Engine are registered trademarks of Tenable Network Security, Inc. All other products or services are trademarks of their respective owners.
Integration Configuration SecurityCenter Configuration To create the dedicated Security Manager account, log in to SecurityCenter using a previously created administrator account, navigate to Users, and select Users (highlighted below) from the drop-down menu. Click +Add (highlighted below) to create a new user. 2
Enter an account username and password (confirm password). Next, click the Role drop-down under the Membership section and select Security Manager. Click the Organization drop-down and select the organization for the account. Click Submit. The SecurityCenter Security Manager account and password will be required during the McAfee epo configuration. McAfee epo will authenticate to SecurityCenter via this account in order to pull the vulnerability assessment data into epo. McAfee epo Configuration Prior to beginning the McAfee epo configuration, log in to the Tenable Support Portal, navigate to Downloads > SecurityCenter, and download the Tenable SecurityCenter Extension for epo (SC5_EPO_ConnectorV1.zip). Save the file in a location accessible from your McAfee epo console. 3
Once the Tenable SecurityCenter Extension for epo has been downloaded, log in to your McAfee epo console and click the Menu drop-down (highlighted below) in the top left-hand corner. Select Extensions (highlighted below) under the Software section. 4
Click Install Extension (highlighted below). Select Choose File (highlighted below) from the Install Extension pop-up window. 5
Navigate to the previously downloaded SC5_EPO_ConnectorV1.zip file and click Open (highlighted below). Click OK to install the extension. 6
Verify the extension is listed as TenableSecurityCenter (as shown below) and click OK. Select Tenable Security (highlighted below) in the left-hand pane to ensure the extension has been installed. In the righthand pane, verify that the extension is Running (highlighted below). If the extension is not listed as an installed extension or is not running, please contact Tenable Support. 7
The Tenable Security extension is listed under the Unsigned section in this example. Once signed by McAfee, the extension will be listed under the Signed section. Once the extension has been installed, navigate to Menu > Registered Servers (highlighted below) under the Configuration section. 8
Select New Server. Click the Server Type drop-down and select Tenable SecurityCenter. Enter a descriptive name for the server and click Next. 9
Enter the Tenable SecurityCenter Settings (highlighted below). See Table 1 Registered Server Configuration for a description of each field. Table 1 Registered Server Configuration Tenable SecurityCenter Settings IP Address Port Number User Name Password Import Results Debug Mode Description IP address of the Tenable SecurityCenter instance Port number used to connect to Tenable SecurityCenter (443 default) Username of the Security Manager account created in Tenable SecurityCenter Password of the Security Manager account created in Tenable SecurityCenter Selects the amount of data (in days) to import from Tenable SecurityCenter Enables debug mode. Leave unchecked unless specified by Tenable Support 10
Click Test Connection to verify that McAfee epo can successfully connect to Tenable SecurityCenter using the information provided above. If the connection is successful, it will display Tenable SecurityCenter connection successful (highlighted below). If you receive the success message, click Save. If the connection fails, please verify the information entered above is correct. If the problem persists, contact Tenable Support. Only one Tenable SecurityCenter type is allowed at any given time. To make changes, either edit the configured server or delete it and recreate it. 11
Once the registered server has been configured, navigate to Menu > Server Tasks (highlighted below) under the Automation section. In the Quick Find search box, type Tenable and click Apply. 12
Click Edit (highlighted below) on the action for Tenable SecurityCenter Collect Task. Set the Scheduled status to Enabled (default is disabled) and click Next. 13
Click the Select the Server Name drop-down and select the previously configured registered server. Click Next. Schedule the frequency the Server Task should run and click Next. See Table 2 Server Task Builder for a description of each option. 14
Table 2 Server Task Builder Server Task Builder Settings Schedule type Start date End date Schedule Description Click the drop-down to select the frequency that log data will be collected from Tenable SecurityCenter. Options include: Hourly, Daily, Weekly, Monthly, Yearly, and Advanced. If Advanced is selected, you will be presented with the option to enter Cron Syntax instead of the scheduled start time. The date that log collection will begin The date the log collection will end. To allow log collection to recur indefinitely, check the No end date radio button instead of setting an end date. Click the drop-down to set the log collection to begin at a specific time by selecting at, or select between to have the log collection only run between a certain time period. Once the schedule is configured, you will be presented with a Summary of the server task. Verify all the settings are correct and click Save. 15
To run a server task, click the Menu drop-down in the top left-hand corner and select Server Tasks (highlighted below) under the Automation section. To run the extension, select the Tenable SecurityCenter Collection Task from the list of Server Tasks and click Run. 16
To view the task status, click on the Tenable SecurityCenter Collection Task. It will display the status of the task on the Server Task Log Information screen as shown below. Click Close to return to the Server Task Log screen. The configuration is now complete and the task will run on the previously configured automated schedule. 17
Once a server task has completed and logs have been collected from Tenable SecurityCenter, the results can be viewed within McAfee epo dashboards. To view the dashboards, click on the Menu drop-down in the top left-hand corner and select Dashboards (highlighted below) in the Reporting section. Click the drop-down to the left of Dashboard Actions (highlighted below) and select Tenable SecurityCenter Dashboard to display the vulnerability data collected from SecurityCenter. Clicking the drop-down arrow (highlighted below) in the top left-hand corner of each widget gives you the option to Refresh the information within that widget or to display it Full Screen. 18
To view data in the System Tree, click on the Menu drop-down in the top left-hand corner and select System Tree (highlighted below) in the Systems section. Select a Managed Host from the System Tree. 19
If there is data on the Managed Host, it will be displayed on the Tenable System Detail tab (highlighted below) of the selected host. About Tenable Network Security Tenable Network Security transforms security technology for the business needs of tomorrow through comprehensive solutions that provide continuous visibility and critical context, enabling decisive actions to protect your organization. Tenable eliminates blind spots, prioritizes threats, and reduces exposure and loss. With more than one million users and more than 20,000 enterprise customers worldwide, organizations trust Tenable for proven security innovation. Tenable's customers range from Fortune Global 500 companies, to the U.S. Department of Defense, to mid-sized and small businesses in all sectors, including finance, government, healthcare, higher education, retail, and energy. Transform security with Tenable, the creators of Nessus and leaders in continuous monitoring, by visiting tenable.com. 20