Trellix Enterprise Security Manager (formerly McAfee ESM)

Connection Requirements

1 - IP

The IP address or hostname of your Trellix ESM (formerly McAfee ESM) appliance. Trellix ESM is an on-premises product; the base URL is unique to each deployment.

2 - Port

The port the ESM REST API is served on (optional, default: 443).

3 - Is Secure?

Choose this if your connection is going to be over HTTPS (optional, default: True).

4 - Username

The username of an ESM console account used to authenticate against the REST API.

5 - Password

The password of the ESM console account.

6 - Timeout

The amount of time (in seconds) to wait for API responses. (default: 30)

Default Values

• Port: 443

• Is Secure: True

• Timeout: 30

Permissions Required

The account needs standard ESM REST API access. To list log-source data sources (devices) the user should be able to view the receiver and data source lists; admin rights ensure the full, unfiltered list is returned. To collect ESM console users, the account needs user-management read access. Please perform a connection test before running discovery to confirm the credentials and permissions are valid.