topic McAfee Integration not sending Summary of alerts to XSOAR for ingestion. in Cortex XSOAR Discussions

McAfee Integration not sending Summary of alerts to XSOAR for ingestion.

michaelsysec242 — Sun, 23 Oct 2022 07:25:17 GMT

I have an integration between McAfee ESM (SIEM) that produces Alerts. 95% of alerts are received by the XSOAR including the "Summary" which is essentially the Alert Packet. Every few days some alerts are received that do not contain the summary. So essentially the time-stamp and the Alert Name appears yet there are no Summary details. The context data has been analysed and does not show any details.

The Integration has is updated to the latest version.
The McAfee ESM is of a recent version.
This is a relatively new phenomenon yet no explanation has been found.
A new integration has been defined with a new Instance in order to attempt to fix this problem, unfortunately without results.
A playbook for Unclassified events has been set to attempt to retrieve the summary for every anomalous alert through the Instance. Which also doesn't work 100% of the time.
The XSOAR is community edition.

I have two questions;

Does anyone have a solution or workaround for this problem ?
Is there a way to ensure 100% Alert transfer for this usually static use case ?

Thanks in advance.

#McafeeESM

Re: McAfee Integration not sending Summary of alerts to XSOAR for ingestion.

jfernandes1 — Mon, 24 Oct 2022 02:36:57 GMT

Hi @michaelsysec242, you'll need to check the data coming into the mapper to verify where the issue is. Screenshot below shows the raw vs mapped fields.

1. Select the source of the alerts, this would McAfee ESM for you.

2. Look at the raw data that is being sent from the API call. Ensure you can see the missing data here. If missing here its an API issue with McAfee's API.

3. If the missing data is found above, map it to a field.

Re: McAfee Integration not sending Summary of alerts to XSOAR for ingestion.

michaelsysec242 — Tue, 25 Oct 2022 08:07:25 GMT

Thanks for your message. The incidents that do not contain the required "Summary" is not a mapping issue. Even after ingestion the Context Data doesn't contain any event details, just time stamps. As I mentioned before these are the same alerts that most of the time provide a static set of fields that do not change. @jfernandes1 is it recommended to speak with McAfee or PAN CSP regarding this issue ?