ePO™ and Data Exchange Layer (DXL) & InsightVM

Collect, prioritize, and remediate your security challenges

A well-oiled and efficient security program combines different tools and information to help you make better overall decisions. As McAfee’s preferred vulnerability management partner, Rapid7 makes it easy to integrate vulnerability management data and risk context from InsightVM or Nexpose into the McAfee ePO™ enterprise security management console and McAfee Data Exchange Layer (DXL), enabling you to share vulnerability context with other McAfee partners.

By combining McAfee ePO™ and McAfee DXL with Rapid7 vulnerability management solutions’ advanced risk scoring and vulnerability data, you can more easily collect, prioritize, and remediate your security priorities.

COLLECT

InsightVM* automatically imports assets from McAfee ePO™, ensuring that you never miss an asset for vulnerability scans and eliminate the need to repeat asset discovery in multiple solutions. As new assets and offices are added into McAfee ePO™, they will be instantly imported into InsightVM sites so that they aren’t missed in future scans.

PRIORITIZE

InsightVM is the only vulnerability management solution that prioritizes vulnerabilities above and beyond the basic CVSS score, by also considering which vulnerabilities are most easily used in an attack. Now you can get the same attacker-focused approach in your McAfee ePO™ dashboards and analytics by importing asset risk scores from InsightVM into McAfee ePO™. As you use McAfee ePO™ to understand your overall risk posture, you can factor in vulnerability exposure to gain insight into where compensating controls are most needed.

REMEDIATE

Sealing up a breach requires a multi-pronged approach to ensure that no information is lost and that the attack can’t happen again. McAfee DXL makes it easy for solutions to share data and collaborate, and InsightVM is the only solution to provide vulnerability data to the McAfee DXL cloud. InsightVM can also utilize data regarding compromised assets from McAfee Threat Intelligence Exchange (TIE) to prioritize vulnerability remediation efforts. With new partners integrating to McAfee DXL every month, the opportunity to add vulnerability and attacker context to security decisions is limitless.

Deploy Insight Agents directly from ePO™

Rapid7 Insight Agents power live collection of vulnerability data for InsightVM and incident detection/response data for InsightIDR. You can automatically deploy Insight Agents from the ePO console™, saving time and ensuring you have live visibility into all your endpoints.

How It Works

McAfee ePO™

1. Install the InsightVM Extension in the McAfee ePO™ server.
2. Go to “Connections” under “Administration” in InsightVM to configure the connection between InsightVM and McAfee ePO™.
3. On startup, InsightVM will automatically query the McAfee ePO™ server for new computer details since the last sync and associated InsightVM risk scores will be automatically imported into McAfee ePO™.

McAfee DXL

1. Log in to the McAfee ePO™ server as admin.
2. Create a permission set, DxlClientCerts, that uses the “Create DXL McAfee MePO Certificates” for DXL McAfee MePO Certificate Creation.
3. Create a McAfee DXL user (typically we use “dxlmepo”) that InsightVM can use later to connect to the fabric. Assign this user the DxlClientCerts permission set.

*All mentions of Rapid7 InsightVM associated with its integration with McAfee ePO™ and McAfee Data Exchange Layer (DXL) also apply to Rapid7 Nexpose.