Integrating McAfee ePO threat events and Service Now

[Himanshu6]

Hi

Is it possible to create a API in which whenever any threat event detected on client system and it reported to ePo events in that sudden time a ticket should automatically created in service now.

[Hawkmoon]

Hi Himanshu6,

The short answer is yes!

The below is taken directly from the ePO 5.9 Product guide (PD26914)
Page 351 onwards!

"Configure responses to automatically create issues
Use responses to automatically create issues when certain events occur.
Task
For details about product features, usage, and best practices, click ? or Help.
1 Open the Response Builder.
a Select Menu | Automation | Automatic Responses.
b Click New Response.

2 Complete the fields, then click Next.

3 Select properties to narrow the events that trigger the response, then click Next.

4 Specify these additional details, then click Next.
• The frequency of events required to generate a response.
• A method to group events.
• The maximum time period that you want this response to occur.

5 Select Create issue from the drop-down list, then select the type of issue to create.
This choice determines the options that appear on this page.

6 Type a name and description for the issue. Optionally, select one or more variables for the name
and description.
This feature provides a number of variables providing information to help fix the issue.

7 Type or select any additional options for the response, then click Next.

8 Review the details for the response, then click Save."

Hope that helps! 

[Himanshu6]

It's only notify in mail that virus has been detected but i want to integrate it to Service now as the virus get detected there should be a automatic service request would be created on behalf of that system which contain that virus

[Hawkmoon]

Apologies Himanshu6,

I misunderstood you, I took you to be refering to ePOs 'Issues' interface, my mistake sorry for that.

When you refer to 'service now' do you mean this:

https://www.servicenow.com/

[Himanshu6]

Yes it's a service request portal which is used by our client to make any service request related to issue that they are facing which is handled by our IT service team

so what i want if there is any virus detected on any machine and reported to our ePO then the service request should be created on behalf of that system in which the virus is detected.

[cdinet]

From the same product guide Hawkmoon mentioned:

Use tickets with McAfee ePO

To integrate automatic ticketing with McAfee ePO, you or McAfee Professional Services can use issue

APIs to configure a remote server.

See the McAfee ePolicy Orchestrator Web API Scripting Guide for detailed Web API use and examples.