McAfee MVISION Cloud (formerly known as Skyhigh Networks Cloud Security Platform)

The IBM QRadar DSM for McAfee MVISION Cloud collects logs from a McAfee MVISION Cloud Platform.

McAfee MVISION Cloud is formerly known as Skyhigh Networks Cloud Security Platform.

The following table identifies the specifications for the McAfee MVISION Cloud DSM:
Table 1. McAfee MVISION Cloud DSM specifications
Specification Value
Manufacturer McAfee
DSM name McAfee MVISION Cloud
RPM file name DSM-SkyhighNetworksCloudSecurityPlatform-QRadar_version-build_number.noarch.rpm
Supported versions 2.4 and 3.3
Protocol Syslog
Event format LEEF
Recorded event types Privilege Access, Insider Threat, Compromised Account, Access, Admin, Data, Policy, and Audit
Automatically discovered? Yes
Includes identity? No
Includes custom properties? No
More information McAfee MVision Cloud (https://www.mcafee.com/enterprise/en-ca/products/mvision-cloud.html)
To integrate McAfee MVISION Cloud with QRadar, complete the following steps:
  1. If automatic updates are not enabled, download and install the most recent version of the following RPMs from the IBM® Support Website onto your QRadar Console:
    • Skyhigh Networks Cloud Security Platform DSM RPM
    • DSMCommon RPM
  2. Configure your McAfee MVISION Cloud device to send syslog events to QRadar.
  3. If QRadar does not automatically detect the log source, add a McAfee MVISION Cloud log source on the QRadar Console. The following table describes the parameters that require specific values for McAfee MVISION Cloud event collection:
    Table 2. McAfee MVISION Cloud log source parameters
    Parameter Value
    Log Source type McAfee MVISION Cloud
    Protocol Configuration Syslog
    Log Source Identifier The IP address or host name of the McAfee MVISION Cloud that sends events to QRadar.