From 388fb9a102d01f8d3763815abb9d17fa1605b8e3 Mon Sep 17 00:00:00 2001
From: Aaron Daniels <aaron@daniels.id.au>
Date: Fri, 22 Jul 2016 06:13:14 +1000
Subject: [PATCH] - Added OS support for the McAfee SIEM Nitro product range -
 Added Mcafee icon. - Added product names as features. - not everything with
 ACE in the sysDescr is a Cisco ACE!

---
 html/images/os/mcafee.png           | Bin 0 -> 2413 bytes
 includes/definitions.inc.php        |  13 +++++++++++--
 includes/discovery/os/acsw.inc.php  |   3 ---
 includes/discovery/os/nitro.inc.php |  14 ++++++++++++++
 includes/polling/os/nitro.inc.php   |  18 ++++++++++++++++++
 5 files changed, 43 insertions(+), 5 deletions(-)
 create mode 100644 html/images/os/mcafee.png
 create mode 100644 includes/discovery/os/nitro.inc.php
 create mode 100644 includes/polling/os/nitro.inc.php

diff --git a/html/images/os/mcafee.png b/html/images/os/mcafee.png
new file mode 100644
index 0000000000000000000000000000000000000000..b2d041e8e04229653192061dd7f95f66744afa4f
GIT binary patch
literal 2413
zcmV-z36l1SP)<h;3K|Lk000e1NJLTq001BW001Be0ssI2{21+{00001b5ch_0Itp)
z=>Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!vFvd!vV){sAK>D2?9w(K~zXfl~#FF
zlSvZ)<PsfRol!>x9dXprH!BDjh|KJat|RhhS6u}aF&>B@vvPxiA}9i)1Te@Y7(k31
zDj>InI~Rw9K!79yf~c5q1j2nKglr`rgLupz`+G^h>gwwLbyam&e~9d3%qTG1`3zF&
z4E$jHuS`Cl`zZlHEEW$A4)*l)ym|BH)vH%LUUOq3hs9zu7?o5iol0fU=@r%0HEebR
zhr?@cf6eC$1_p-4$0uj!&jawy5)2OyzkBzN$K$ct?E3ophK2@IsI07{(deZm<z#YE
zettntPF`kac53RAl;p<`;vXf%krES<q9gA|DSo7fsd;(%O-+sc{r#}ZSpxV^Pfs%#
zjCyuGhsWhKHo=d_;nvl%$j=M1GqZAXbIC=;<y0D-QBhG<4K0;UCl{6E<dPFfDN!**
zAHSPdef&HxdO7^p`Ro~MOH0e+$1MW_0w9>cA@^W>d>ja<H0txBg0j*wW(|wSYkAlC
zUM!Kyy_<tn278f8B+_Y#R6I2UF_{v}#1gS|TEOpS*0R!`W#VrKpE+Z_d-on3?ld|{
zPB1z;N}*7S3JW2usP+?pw^K6N#Ef)YCK;O%k4{gGO2tDm@rYDBGCegVk&G)0021j;
zYipa1&UOn6OQ}@8KRLn3$Ow%_%gxPg<no~FuxFpozWs!Ac1f4L^8@jviHVijne_$v
z-15?wG-@-Q#-&giN{U}R&nrt#&JGJt54auS?jH4@lMZ^ug99RVLzAAKfw}onGz~y7
z0|ZnGH8VR8f)A?mD>l}iy;y|1@XX9A>3}71_kk#bJ$JVl2d&o+*3|dW)CpR)_2!bz
zw-;>;(by8RR0oe}h9av-$l4Q#>hO@Lj@_WEyWQOU$Q;4+=;%mUX?a>^P7|vMR4(gv
zxo!a*A3}3*Z2LV@D>0QB^N=1KUFS_`^$4zW@~b)FmUi;O)5F#&dybaq9!y=Pm!!Tq
zU3v4l1>X(``{)%6U0vN{$Bs!P5;?)ljAU|hf<mFCJWgj-)q(2LHe;5PZ-Ylrqi+}|
zFrqr~F(?7G8PCh@y_lyx)9k%a4J#}A!KPo5HMYg6ZzL&yZ?)t*VP9`ve!hW$0S<>l
zFCBOQOkz0f$*Jj#A{wYde?L-e<y!9=P<I8-ymISBE*X?yJ1{tud=OV;ZeL$m4jS<P
zEtea*MmJ^gk1^^SVwJvg{K4RTk03TS76=?29l-`5PcopUriPT1l%1Iga<q$kfeEhG
z;X2dRztq;VtzL1o6eS?`xHWMfPA*Di(~9=`;vW)JH-#_K#v`k5m>h0-)8XxXO<&)@
z-#<V;Y3?RBzkHdLk`zZIf=o$IBWN2|+Im*mc|AIGc6wwCwE+~z5OZAoK>!XpflPKo
z3lpuZO;FeNM83Z7<jG(%akx_$j1h^Hq!|CxgSNJ|v}YOjqGCrS(<9wo=NGS`Te(+Q
zy2P5FK@G-+N1z?(7I^JC48rix5bD!4W7FHnYQn<r;Rt0VkP6Ewd-v`$Fu*{uk`K=j
zK=sJX&54O3a#~+Q*Lt~jftd|u|M@s;d(<E%G8z>uR&0g#L3lXY4YRiMMOFkUt+!aP
zwED%1^sF2#*4WtiAETpi`Q(@-n4FxXQfZNq(NNT&i??@vv;muLYLVd~4<+ElW<6Ah
zzUadxmz>)5E82ZT2z5rjx{R#4{M&&lHY+sr4hFNs#>NI61<VovI8B`B=$M#$v7_UY
zoh{8L5VdT~!GcJ6Rsg1m#)L=&LKm;q%jA%m#;SpCA#^EuS$2rJC8ClW5yN`bVsQe8
z*|8%bAwe-ojt>NUKL5#+w9rrjo81W6xBd}B_-1=;NeK*zdIYw}N>)K3YH9ZEMjK=~
zOEJ{N?=(k{Ltm}pzv*C9*X}Udsjsi!)zyVs0%i%&qFq)-ArS69BqjCs_E$a2`3*s2
zGxCB}TVCw5aKl6I>!@+If3PjGJUedIxnB_^@v1MUqb1Ng&<KOI`@;^^qxj$ffXn5?
z#U+FU-+fVA&+q9vr(?VaQQx&>nc3nM(W?zFEY-#?)G$=jIIOnPMP>cJk-u$4l(r+t
zUiFpzulX<AUj6j*Puq2LOB9~X;UfZpfDdn0XlOVwf=FlAy<pIeAd4e3w&B0g3H<u+
zzRR}ys&8^pU2DH!wY$n%mxXJ57igIv2qh!EL-78xug^{+ti_R|y~19!P^0)jFflP9
z6!w;sl*Px9f<waLwaTNFq+Y*ihNxUoUiXK(mc5Fmi?XIGv}#(eYMQ<(YtJEz?pWG(
zbqlI%nNZ-cM%brMp9+OScwlB1ou7lTu`x&vhr@mPB;(edy99h#P9d4u!tpwC^faRG
zrM%8nd98=)I%oBDJ`1!0)Hb*xE6(T}_w))o-t!OrYyU6CKik;a!mAF4WoT$<&WR5m
z06}+mcWY~FVPRo>d_u^bu&}U*>Kc}yqy5r9e?N(+T~pP%q4J%N`uh7yo4k<ac5Ai_
zcD@ye`rMq|jEszS?b=mZTH4am(%IPw56tYM^9i7+f_EJq9ZgM5iHQ#hVd23ccZkIJ
z#^!d|X5jIYrx1joq)AfU2sg`l$IgCXcc+jaa4QgNU<h{?kH<5a%=Y$n*d;_8LV_;)
zQIg^HhbTc^s;sPvz84D|LHLk+_v5)8?F0S28IjQ^5oH{r6y|<uU`WIl_T3D)xdVg2
z8e^TDoXBKyb91vmAb{<|>R%>+zySwr0Zi$1MtFGm?b|`#SG|Mq!A-oEe4((JSyPc$
z&@1W_2)Y~{oD2;xJ9lC)IM`=rWpTM&SRKBv<{u%zM+86%!%&w*qJGE~hr=NfiC$jb
zZf+Ny99_udVt#j5PhVd}Wu>X9Da73fYvkwWS5;N@_U&7dNCc7jWOcwt1oHtjaM~bZ
z@S1vfT(+{ZhA$CcUte!;Z#_LdLqkIo6O;V>d`KJYdVbJ9!Iuf<TZ72wcfk!mcI>#B
z*<si>yomn({tys(q!msp%>GXT6tjH=;6wP<ty|XC))2Z`)t~s>cn*IVqAy}<Y6|_@
f`8?KNhD`Q9feOCtuHN@d00000NkvXXu0mjf2(*n?

literal 0
HcmV?d00001

diff --git a/includes/definitions.inc.php b/includes/definitions.inc.php
index 86eea6a54a..31fcb11c92 100644
--- a/includes/definitions.inc.php
+++ b/includes/definitions.inc.php
@@ -1926,8 +1926,17 @@ $config['os'][$os]['over'][1]['text']  = 'Wifi Clients';
 $config['os'][$os]['over'][2]['graph'] = 'device_xirrus_rssi';
 $config['os'][$os]['over'][2]['text']  = 'Signal RSSI';
 
-
-
+// McAfee SIEM
+$os = 'nitro';
+$config['os'][$os]['text'] = 'McAfee SIEM Nitro';
+$config['os'][$os]['type'] = 'appliance';
+$config['os'][$os]['icon'] = 'mcafee';
+$config['os'][$os]['over'][0]['graph'] = 'device_bits';
+$config['os'][$os]['over'][0]['text'] = 'Device Traffic';
+$config['os'][$os]['over'][1]['graph'] = 'device_processor';
+$config['os'][$os]['over'][1]['text'] = 'CPU Usage';
+$config['os'][$os]['over'][2]['graph'] = 'device_mempool';
+$config['os'][$os]['over'][2]['text'] = 'Memory Usage';
 
 // Graph Types
 require_once $config['install_dir'].'/includes/load_db_graph_types.inc.php';
diff --git a/includes/discovery/os/acsw.inc.php b/includes/discovery/os/acsw.inc.php
index f662254b9d..ac8118f0cf 100644
--- a/includes/discovery/os/acsw.inc.php
+++ b/includes/discovery/os/acsw.inc.php
@@ -7,9 +7,6 @@ if (!$os) {
     if (strstr($sysDescr, 'Application Control Engine')) {
         $os = 'acsw';
     }
-    if (strstr($sysDescr, 'ACE')) {
-        $os = 'acsw';
-    }
 }
 
 if (!$os) {
diff --git a/includes/discovery/os/nitro.inc.php b/includes/discovery/os/nitro.inc.php
new file mode 100644
index 0000000000..5e00d5668a
--- /dev/null
+++ b/includes/discovery/os/nitro.inc.php
@@ -0,0 +1,14 @@
+<?php
+
+// MaAfee SIEM Nitro
+if (!$os) {
+    if (strstr($sysObjectId, '.1.3.6.1.4.1.23128.1000.1.1')) {
+        $os = 'nitro';
+    } elseif (strstr($sysObjectId, '.1.3.6.1.4.1.23128.1000.3.1')) {
+        $os = 'nitro';
+    } elseif (strstr($sysObjectId, '.1.3.6.1.4.1.23128.1000.7.1')) {
+        $os = 'nitro';
+    } elseif (strstr($sysObjectId, '.1.3.6.1.4.1.23128.1000.11.1')) {
+        $os = 'nitro';
+    }
+}
diff --git a/includes/polling/os/nitro.inc.php b/includes/polling/os/nitro.inc.php
new file mode 100644
index 0000000000..ddbb25fb4b
--- /dev/null
+++ b/includes/polling/os/nitro.inc.php
@@ -0,0 +1,18 @@
+<?php
+
+if ($device['sysObjectID'] == 'enterprises.23128.1000.1.1') {
+    $features = 'Enterprise Security Manager';
+} elseif ($device['sysObjectID'] == 'enterprises.23128.1000.3.1') {
+    $features = 'Event Receiver';
+} elseif ($device['sysObjectID'] == 'enterprises.23128.1000.7.1') {
+    $features = 'Enterprise Log Manager';
+} elseif ($device['sysObjectID'] == 'enterprises.23128.1000.11.1') {
+    $features = 'Advanced Correlation Engine';
+} else {
+    $features = 'Unknown';
+}
+
+// McAfee ACE 9.5.0
+if (preg_match('/^McAfee [A-Z]{3} ([^,]+)$/', $device['sysDescr'], $regexp_result)) {
+    $version  = $regexp_result[1];
+}