McAfee ePO integration with AWS Security HUB to send log

[User17662387]

Hi, I have a requirement to send event logs and any attack detected by McAfee to send same logs to AWS security HUB. Can we integrate McAfee ePO server to send logs to AWS security HUB.? Please provide your suggestion or any referral document will be helpful.

[vivs]

Hello @User17662387 

Thanks for your post.

ePO can forward received threat events directly to a syslog server, which is defined in ePO as a Registered Server.

https://kc.mcafee.com/corporate/index?page=content&id=KB87927

https://kc.mcafee.com/corporate/index?page=content&id=KB91194

Also this can be achieved with ePO Cloud 

https://www.mcafee.com/enterprise/en-us/about/newsroom/press-releases/press-release.html?news_id=0f9...

I hope the above will help you.

Was my reply helpful?

If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

[User17662387]

Hi Thanks for your response.

But above two KB are for syslog integration and below one is for MVISION.It is CASB solution. These all are not applicable in my environment.

We have ePO deployed on AWS cloud and requirement is to send logs from ePO to  AWS Security HUB direct or indirect way.

Thanks for your understanding.

[vivs]

Hello @User17662387 

Thanks for your response.

Afaik This can not be achieved but i will check with @cdinet 

I believe she can guide us in right direction and will also able to tell whether this can be done or not.

Was my reply helpful?

If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

[cdinet]

Is epo on prem, mvision or cloud?  With on prem, only options are syslog registered server or connect to db as siem.  I don't know anything about aws security hub to answer, to be honest.  If you are using mvision or cloud, there are api's that can pull events.  Check here for any info on that.

https://www.mcafee.com/enterprise/en-us/solutions/mvision/developer-portal.html

as well as 

https://docs.mcafee.com/bundle/mvision-epolicy-orchestrator-product-guide/page/GUID-685D8584-97BD-4E...