Integrate Endpoint Security with CW Automate

[thenags]

Trying to get CW Automate to see Endpoint Security.  CW Support tells me I need to get the info needed, as seen in the image attached, from McAfee.  Does anyone have the necessary info so that I can get Automate to see/report Endpoint Security?

Thanks in advance.

[Sivakumar1]

Hello @thenags . Thank you for reaching out McAfee Enterprise Support Community. I did check with the Screenshot. It would be a great help if you could be specific and let us know the information you required from us with regards to ENS.

[thenags]

Thanks for the quick reply.  In that screenshot is an example of the entry for whatever they consider 'McAfee Virusscan'.  What I need is the information that I'd put in the following fields;

Program Location

Definition Location

Update Command

AP Process

There is a McAfee Enterprise entry in there but it doesn't seem to work to detect the Endpoint Security solution that some of our clients are using.

[thenags]

Attached are their definitions for each field if this helps

[thenags]

Any thoughts on this?

Only other option is to get these clients flipped over to our Sophos account to alleviate this issue.

[Pravas]

Hi @thenags ,

Here are the path & registry location for ENS.

Program Location - HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\Endpoint\Common\Servers\mcshield.exe

Definition Location - HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\Endpoint\AV\AVCM\CMajor
C:\Program Files\Common Files\McAfee\Engine\content\amcore\update

Update Command- "C:\Program Files\McAfee\Endpoint Security\Threat Prevention\"amcfg.exe /update

AP Process - C:\Program Files\Common Files\McAfee\AVSolution\mcshield.exe

Thanks

[thenags]

I believe the information you gave me might be for a server install rather than a workstation install?  ConnectWise Support is telling me the files aren't in the locations specified.

[thenags]

Any luck getting the information for a workstation install?

[Pravas]

Hi @thenags ,

The information is common for both WorkStation & Server.

Thanks

[thenags]

Some of the files don't exist in the locations mentioned on any of the workstations we looked at that are running Endpoint Security.