> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# McAfee MVISION

> Connect ThreatAware to McAfee MVISION to track security posture and device inventory

## Overview

The McAfee MVISION integration enables ThreatAware to collect data from McAfee MVISION, providing visibility into your security posture and cyber asset management.

<Info>
  **Connection Method**: API
  **Setup Time**: 15-30 minutes
  **Access Required**: Administrator account with API permissions
</Info>

## Use cases

<CardGroup cols={2}>
  <Card title="Device & Asset Tracking" icon="computer">
    Monitor devices and assets managed by McAfee MVISION
  </Card>

  <Card title="Security Compliance" icon="shield-check">
    Track security posture and compliance status
  </Card>

  <Card title="User & Access Management" icon="users">
    Identify users, roles, and access patterns
  </Card>

  <Card title="Threat Detection" icon="triangle-exclamation">
    Detect threats and vulnerabilities in real-time
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="**Log in to McAfee MVISION Cloud Console**:">
    * Access the [McAfee MVISION Cloud Console](https://www.mcafee.com/enterprise/en-us/solutions/mvision.html) with an administrator account.
  </Step>

  <Step title="**Generate an API Key**:">
    * In the MVISION Cloud console, go to **Settings** > **API Access**.
    * Click **Generate New API Key** and set the permissions required for ThreatAware, typically **Read-only** for monitoring purposes.
    * Copy the **Client ID** and **Client Secret** generated.
  </Step>

  <Step title="**Input API Credentials in ThreatAware**:">
    * Open ThreatAware, go to **Integrations**, and select **McAfee MVISION Cloud**.
    * Enter the **Client ID**, **Client Secret**, and **MVISION Cloud URL** in the respective fields.

    ### Important Notes and Links

    * Refer to [McAfee MVISION Cloud API Documentation](https://www.mcafee.com/enterprise/en-us/solutions/mvision.html) for more information on API configuration and permissions.
    * API credentials must be stored securely, as they provide access to McAfee MVISION Cloud data.

    ### Input Details

    * **Client ID**: ID generated for API access in McAfee MVISION Cloud.

    ```text theme={null}
    Field: Client ID
    Name: McAfee MVISION Client ID
    Type: String
    ```

    * **Client Secret**: Secret associated with the Client ID.

    ```text theme={null}
    Field: Client Secret
    Name: McAfee MVISION Client Secret
    Type: Password
    ```

    * **MVISION Cloud URL**: URL of the McAfee MVISION Cloud instance.

    ```text theme={null}
    Field: MVISION Cloud URL
    Name: McAfee MVISION Cloud URL
    Type: String
    Placeholder: "https://www.mcafee.com/enterprise/en-us/solutions/mvision.html"
    ```

    ### Verification and Troubleshooting

    * **Verification**: In ThreatAware, confirm that the **Integration Status** shows as **Active** after setup.
    * **Troubleshooting**:
    * **Invalid Credentials**: Ensure that the **Client ID** and **Client Secret** are entered correctly.
    * **Permission Errors**: Verify that the API key has the necessary permissions for ThreatAware’s access in McAfee MVISION Cloud.
  </Step>
</Steps>

## Data collected

The McAfee MVISION integration provides:

* Device and asset information
* Security compliance and posture data
* User and access information
* System performance metrics
* Configuration and policy information

## Required credentials

To set up the McAfee MVISION integration, you will need:

* **API Key or Token**: Obtain from McAfee MVISION admin console
* **API Secret or Client Secret**: Keep this secure
* **API Endpoint URL**: The McAfee MVISION API base URL
* **Service Account**: Admin account or dedicated integration user
* **Service Account Password**: Associated credentials

<Tip>
  Create a dedicated service account specifically for ThreatAware integration and store all credentials securely in your organisation's password manager.
</Tip>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings → Integrations** in ThreatAware
   * Confirm the integration shows **Active** status
   * Check the last sync timestamp

2. **Verify Data Collection**
   * Wait up to 60 minutes for the initial data collection
   * Verify data appears in device details or dashboards

3. **Test Queries**
   * Create a test query to filter data from this integration
   * Verify results match your expectations

## Troubleshooting

<AccordionGroup>
  <Accordion title="Connection Failed" icon="triangle-exclamation">
    **Symptoms**: Integration fails to connect or shows error

    **Solutions**:

    * Verify all credentials are correct and copied without extra spaces
    * Ensure the API endpoint URL is accessible from ThreatAware
    * Check firewall rules allow outbound HTTPS (port 443) to the API endpoint
    * Confirm API credentials have not expired
    * Verify the service account has necessary permissions
  </Accordion>

  <Accordion title="Authentication Failed" icon="lock">
    **Symptoms**: Invalid credentials error

    **Solutions**:

    * Double-check the API key and secret are correct
    * Verify the API credentials have not been revoked
    * Ensure you are using the correct API version
    * Check if IP whitelisting is required
    * Review admin logs for authentication failures
  </Accordion>

  <Accordion title="No Data Appearing" icon="database">
    **Symptoms**: Integration active but no data visible

    **Solutions**:

    * Wait 60 minutes for initial synchronization
    * Verify API credentials have read permissions
    * Check the service account can access required data
    * Ensure data exists in the source system
    * Review ThreatAware integration logs
  </Accordion>

  <Accordion title="Incomplete or Partial Data" icon="hourglass">
    **Symptoms**: Only some data is being collected

    **Solutions**:

    * Verify the service account permissions for all resources
    * Check for API rate limit issues
    * Review source system for data availability
    * Contact ThreatAware support if the issue persists
  </Accordion>
</AccordionGroup>

## Best practices

<Tip>
  **Security Considerations**

  * Create a dedicated service account specifically for the ThreatAware integration
  * Use read-only API permissions (never grant write access)
  * Store credentials securely in your organisation's password manager
  * Rotate API credentials annually or per your security policy
  * Monitor authentication failures and API usage regularly
  * Review and audit integration activity periodically
  * Enable multi-factor authentication on the service account if available
  * Restrict the service account to only necessary resources and permissions
</Tip>