pythonalarmmcafee

Execute a script when alarm is triggered in McAfee ESM 11.5.X


I want to execute a Python script when creating an alarm (McAfee ESM Virtual machine - ESM 11.5.4 20220106). When creating an alarm, I configured "Execute remote command". Alarm is being triggered but script isn't getting executed. I tried as shown in the image below but it didn't work.

McAfee_ESM_trigger_script_on_Alarm.png


Solution

  • I found a way to this. You can't execute a script situated in the ESM (In the image above, the IP is of ESM machine itself). You have to spin another VM with the required ports open. Refer image in the question.. So, the IP address, credentials and script path has to be of the VM.

    Basically you should have a command server for script execution and others.

    Also, in my case I noted that only bash scripts were getting executed. Python scripts failed. So, the work around to that could be that you mention bash script in ESM and inside bash script you write a command to execute the python scripts that has to be executed.

    Hope it helps!