---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Create a capability profile

# Create a capability profile {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Create a profile and select the McAfee ePO capabilities that you want
the profile to run.

## Before you begin

Role required: ServiceNow AI Platform® Security incident administrator
(sn_si.admin)

## About this task

For this step of the configuration, you create a profile for the McAfee ePO capabilities. When you create profiles, consider the
intention of the profile before you add McAfee ePO capabilities to
it. Refer to the following table when you create profiles.

The following table lists the capabilities that you're required to add to a profile if you want the profile perform certain queries or actions. Create a single profile that runs queries for host details, initiates malware scans,
remove isolation, and isolates host machines, or, create multiple profiles, each with its own, single capability.

## Procedure

1. Navigate to McAfee ePO IntegrationMcAfee ePO Capability Profiles.  
   The McAfee ePO Capability Profiles list is displayed.
2. Click New.
3. On the form, fill the fields.

   | Field | Description |
   | Name | Name for the McAfee ePO capability profile. This name helps you identify the profile type and describe it. An example for a profile that runs queries is, Host and Threat Details. This name is also the name for the security tag for this profile by default. |
   | Description | Additional information about the profile that further describes the activities of the profile. An example description for a profile that runs queries is, Threat enrichment for system details and a list of threat events. An example description for a profile that runs actions is, Isolate host machine. |
   | Source | Name of the McAfee ePO server. Only configured servers are available from the choice list. |
   | McAfee ePO Capability | Capabilities of the McAfee ePO profile. McAfee ePO supports the following capabilities: * Get Host Details * Isolate Host Profile * Initiate Malware Scan * Remove Isolation * List Threat Events {#mcafee-epo-create-profile__ul_zkv_5fj_fyb} Select the capabilities you want for this profile from the Available column and move them to the Selected column. You can't add Get Host Details, Initiate Malware Scan and List Threat Events in the same profile, and you can't add Remove Isolation and Isolate Host on the same profile. |
   | Order | Workflow priority. Default is 100. The value of this field indicates the order that workflows are executed when two or more profiles share triggering conditions. The workflow with the lowest number has the highest priority. To set the order of operation, enter a value. For example, 100, 200, 300, 400. |
   | Active | The check box is selected by default to indicate that the profile is active. When selected, the profile is active and triggers automatically when a security incident is created that matches the filtering conditions that you specify during the configuration step. When inactive, the profile will not run, and it is not available to invoke from a list. |
   |-|-|

   {#mcafee-epo-create-profile__choicetable_kn1_ffj_fyb}
4. To save and validate the profile, click Continue.  
   If validation is successful, the page reloads and the Configuration form is displayed.

## What to do next

The next step is to configure your profile. Before you configure the settings for the
profile, you may prefer to review the concepts for configuring profiles and
triggering conditions. See [Set up your McAfee ePO console to integrate with Security Incident Response (SIR)](https://servicenow-prod.fluidtopics.net/4Fc9alaTLobWBPEyQUWwgQ "The following section lists the setup steps that you're required to complete in your McAfee ePO console before installing the application from the ServiceNow Store for the integration.") and [Defining triggering conditions with a Configuration item (CI) field](https://servicenow-prod.fluidtopics.net/fXL1DH5oW6BGZNfXQhvQIw "After you create a profile and select the McAfee ePO capabilities that you want the profile to run, you configure the settings of the profile so that it runs only when a set of specific conditions are met.") for more information.

*[\>]: and then