Skip to main content

​
Overview

The McAfee MVISION integration enables ThreatAware to collect data from McAfee MVISION, providing visibility into your security posture and cyber asset management.
Connection Method: API Setup Time: 15-30 minutes Access Required: Administrator account with API permissions

​
Use cases

Device & Asset Tracking

Monitor devices and assets managed by McAfee MVISION

Security Compliance

Track security posture and compliance status

User & Access Management

Identify users, roles, and access patterns

Threat Detection

Detect threats and vulnerabilities in real-time

​
Setup instructions

1

**Log in to McAfee MVISION Cloud Console**:

2

**Generate an API Key**:

  • In the MVISION Cloud console, go to Settings > API Access.
  • Click Generate New API Key and set the permissions required for ThreatAware, typically Read-only for monitoring purposes.
  • Copy the Client ID and Client Secret generated.
3

**Input API Credentials in ThreatAware**:

  • Open ThreatAware, go to Integrations, and select McAfee MVISION Cloud.
  • Enter the Client ID, Client Secret, and MVISION Cloud URL in the respective fields.
  • Refer to McAfee MVISION Cloud API Documentation for more information on API configuration and permissions.
  • API credentials must be stored securely, as they provide access to McAfee MVISION Cloud data.

​
Input Details

  • Client ID: ID generated for API access in McAfee MVISION Cloud.
  • Client Secret: Secret associated with the Client ID.
  • MVISION Cloud URL: URL of the McAfee MVISION Cloud instance.

​
Verification and Troubleshooting

  • Verification: In ThreatAware, confirm that the Integration Status shows as Active after setup.
  • Troubleshooting:
  • Invalid Credentials: Ensure that the Client ID and Client Secret are entered correctly.
  • Permission Errors: Verify that the API key has the necessary permissions for ThreatAware’s access in McAfee MVISION Cloud.

​
Data collected

The McAfee MVISION integration provides:
  • Device and asset information
  • Security compliance and posture data
  • User and access information
  • System performance metrics
  • Configuration and policy information

​
Required credentials

To set up the McAfee MVISION integration, you will need:
  • API Key or Token: Obtain from McAfee MVISION admin console
  • API Secret or Client Secret: Keep this secure
  • API Endpoint URL: The McAfee MVISION API base URL
  • Service Account: Admin account or dedicated integration user
  • Service Account Password: Associated credentials
Create a dedicated service account specifically for ThreatAware integration and store all credentials securely in your organisation’s password manager.

​
Verification and testing

After setup, verify the integration is working correctly:
  1. Check Integration Status
    • Navigate to Settings → Integrations in ThreatAware
    • Confirm the integration shows Active status
    • Check the last sync timestamp
  2. Verify Data Collection
    • Wait up to 60 minutes for the initial data collection
    • Verify data appears in device details or dashboards
  3. Test Queries
    • Create a test query to filter data from this integration
    • Verify results match your expectations

​
Troubleshooting

Symptoms: Integration fails to connect or shows errorSolutions:
  • Verify all credentials are correct and copied without extra spaces
  • Ensure the API endpoint URL is accessible from ThreatAware
  • Check firewall rules allow outbound HTTPS (port 443) to the API endpoint
  • Confirm API credentials have not expired
  • Verify the service account has necessary permissions
Symptoms: Invalid credentials errorSolutions:
  • Double-check the API key and secret are correct
  • Verify the API credentials have not been revoked
  • Ensure you are using the correct API version
  • Check if IP whitelisting is required
  • Review admin logs for authentication failures
Symptoms: Integration active but no data visibleSolutions:
  • Wait 60 minutes for initial synchronization
  • Verify API credentials have read permissions
  • Check the service account can access required data
  • Ensure data exists in the source system
  • Review ThreatAware integration logs
Symptoms: Only some data is being collectedSolutions:
  • Verify the service account permissions for all resources
  • Check for API rate limit issues
  • Review source system for data availability
  • Contact ThreatAware support if the issue persists

​
Best practices

Security Considerations
  • Create a dedicated service account specifically for the ThreatAware integration
  • Use read-only API permissions (never grant write access)
  • Store credentials securely in your organisation’s password manager
  • Rotate API credentials annually or per your security policy
  • Monitor authentication failures and API usage regularly
  • Review and audit integration activity periodically
  • Enable multi-factor authentication on the service account if available
  • Restrict the service account to only necessary resources and permissions