QRadar Trellix ePolicy Orchestrator - Saas Connector update is required

Technical Articles ID: KB96229
Last Modified: 2022-12-22 05:33:20 Etc/GMT

Environment

Trellix ePolicy Orchestrator (ePO) - SaaS
Trellix Marketplace (TM)

IBM QRadar

Summary

As part of the Trellix rebranding efforts, the IBM QRadar App (Trellix SaaS App for IBM QRadar, formerly known as McAfee MVISION Connector for QRadar) must be updated to make sure that the app continues to function. Review and perform the steps in the "Solution" field to replace the QRadar App with the new version.

If you don't currently use the TM App (Trellix SaaS App for IBM QRadar or McAfee MVISION Connector for QRadar), this article doesn't apply to your environment.

Solution

Perform the steps below for the installation of Trellix ePO Saas Connector:

Uninstall the existing McAfee MVISION Connector for QRadar.
1. Log on to the IBM QRadar Console. Navigate to the Admin Tab.
2. Select Extension Management.
3. Click McAfee MVISION Connector. Select the uninstall button under the app name.
4. Click the uninstall button on the pop-up window.
Remove the previous Log Source and Entries. Complete the following steps from the Admin tab of the QRadar Console.
1. Select Log Sources, Manage Log Sources. Select MVISION ePO Threat Events and MVISION Insights Events. Click Menu, Delete.
2. Select Log Source Extensions. Select MVISIONEPOThreatEventsCustom_ext and MVISIONInsightsEventsCustom. Click Delete.
3. Select Custom Event Properties. Select MVISION ePO Events and MVISION Insights Events. Click Select All, Delete.
4. Select DSM Editor. Select MVISION ePO Threat Events and MVISION Insights Events. Click Delete.
Install the updated Trellix ePO Saas Connector.
1. Log on to the IBM Qradar Console. Navigate to the Admin Tab.
2. Select Extension Management.
3. Click IBM Security App Exchange.
4. Provide a valid credential and search for Trellix ePO Saas Connector in the search bar.
5. Click the Trellix ePO Saas Connector - QRadar v7.5.0+ and select Download.
6. Once downloaded, navigate back to the IBM Qradar Extensions Management.
7. Select the Add button and then select Trellix ePO Saas Connector extension. Click install and complete the installation.

NOTE: The updated app Trellix ePO Saas Connector - QRadar v7.5.0+ needs to be configured to use the Trellix ePO SaaS API Gateway URL. For example: https://api.manage.trellix.com/

For more details about how to set up and use the Trellix ePO Saas Connector, see the Trellix ePO Saas Connector App for QRadar article.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

QRadar Trellix ePolicy Orchestrator - Saas Connector update is required

Environment

Summary

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

QRadar Trellix ePolicy Orchestrator - Saas Connector update is required

Environment

Summary

Solution

Affected Products

Languages:

Choose your region

Title

Title