McAfee Threat Intelligence Exchange Deprecated

Deprecated. Use McAfee Threat Intelligence Exchange V2 integration instead.

Data Enrichment & Threat Intelligence · McAfee Threat Intelligence Exchange

Details

ID	`McAfee Threat Intelligence Exchange`
Provider	Trellix
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/dxl2:1.0.0.38570`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Use the McAfee Threat Intelligence Exchange (TIE) integration to get file reputations and the systems that reference the files.

Detailed Instructions

This section includes information required for configuring an integration instance.

Prerequisites - Connect to McAfee Threat Intelligence Exchange (TIE) using the DXL TIE Client

To connect the McAfee TIE using the DXL TIE client, you need to create certificates and configure DXL. For more information, see the OpenDXL documentation. After you complete this configuration, you will have the following files:

Broker CA certificates (brokercerts.crt file)
Client certificate (client.crt file)
Client private key (client.key file)
Broker list properties file (‘brokerlist.properties’ file)

To use the tie-set-file-reputation command, you need to authorize the client (Cortex XSOAR) to run the command. Follow the instructions in the OpenDXL documentation. In step #4, instead of selecting Active Response Server API, select TIE Server Set Enterprise Reputation.

Dependencies (Python packages)

You don’t need to install the packages, they are included in the Docker image.

Configure McAfee Threat Intelligence Exchange on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for McAfee Threat Intelligence Exchange.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Broker CA certificates content (see brokercerts.crt in Detailed Instructions)
- Client certificates content (see client.crt in Detailed Instructions)
- Client private key path (e.g., /usr/config/client.key)
- A CSV list of broker URLs in the format: [ssl://]<hostname>[:port]) Get the hostname and port from the brokerlist.properties file (in instructions). The broker should be reachable from Cortex XSOAR server.
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Get the reputation for a file hash: file
Set the enterprise reputation for a file: tie-set-file-reputation
Get the systems that referenced a file: tie-file-references

1. Get the reputation for a file hash

Retrieves the reputations for the specified hash. Supports MD5 SHA1 & SHA256.

Base Command

file

Input

Argument Name	Description	Required
file	Hash of the file to query. Can be “MD5”, “SHA1”, or “SHA256”.	Required

Context Output

Path	Type	Description
File.MD5	unknown	MD5 hash of the file (if supplied).
File.SHA1	unknown	SHA1 hash of the file (if supplied).
File.SHA256	unknown	MD5 hash of the file (if supplied).
File.TrustLevel	unknown	File lowest trust level.
File.Vendor	unknown	Vendor of the file lowest trust level.
DBotScore.Score	unknown	Vendor used to calculate the score.
DBotScore.Vendor	unknown	The actual score.
DBotScore.Type	unknown	Indicator type.
DBotScore.Indicator	unknown	The hash of the file.

Command Example

!file file=3d720dc2b8b0ff23f616aa850447e702eb89047e

Human Readable Output

2. Set the enterprise reputation for a file

Sets the “Enterprise” reputation (trust level) of a specified file. Permissions are required to invoke this method. See the ‘How-to’ in instance instruction.

Base Command

tie-set-file-reputation

Input

Argument Name	Description	Required
file	Hash of the file for which to set the reputation. Can be “MD5”, “SHA1”, or “SHA256”.	Required
trust_level	The new trust level for the file.	Required
filename	A file name to associate with the file.	Optional
comment	A comment to associate with the file.	Optional

Context Output

There is no context output for this command.

Command Example

!tie-set-file-reputation file=3b0fcc439a7d83860433d34e564ff1e9ddd4cfaa trust_level=MOST_LIKELY_TRUSTED

Human Readable Output

3. Get the systems that referenced a file

Retrieves the set of systems which have referenced (typically executed) the specified file.

Base Command

tie-file-references

Input

Argument Name	Description	Required
file	Hash of the file for which to search. Can be “MD5”, “SHA1”, or “SHA256”.	Required

Context Output

Path	Type	Description
File.MD5	unknown	MD5 hash of the file (if supplied).
File.SHA1	unknown	SHA1 hash of the file (if supplied).
File.SHA256	unknown	SHA256 hash of the file (if supplied).
File.References.AgentGuid	unknown	The GUID of the system that referenced the file.
File.References.Date	unknown	The time the system first referenced the file.

Command Example

!tie-file-references file=3d720dc2b8b0ff23f616aa850447e702eb89047e

Human Readable Output

Configuration parameters

broker_ca_bundle — Broker CA certificates content (see `brokercerts.crt` in Integration Tips) (required)
cert_file — Client certificates content (see `client.crt` in Integration Tips) (required)
private_key — Client private key content (e.g. `client.key`) (required)
broker_urls — A CSV list of broker URLs in the format: [ssl://]<hostname>[:port]) Get the hostname and port from the `brokerlist.properties` file (in instructions). The broker should be reachable from Demisto server. (required)
integrationReliability — Source Reliability
feedExpirationPolicy —
feedExpirationInterval —

Commands (3)

file
Retrieves the reputations for the specified hash. Can be "MD5", "SHA1", or "SHA256".
tie-file-references
Retrieves the set of systems which have referenced (typically executed) the specified file.
tie-set-file-reputation
Sets the “Enterprise” reputation (trust level) of a specified file. Permissions are required to invoke this method. See the 'How-to' in instance instruction.

Source

McAfee-TIE.py McAfee-TIE_test.py McAfee-TIE.yml McAfee-TIE_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Trellix
commonfields:
  id: McAfee Threat Intelligence Exchange
  version: -1
deprecated: true
configuration:
- display: Broker CA certificates content (see `brokercerts.crt` in Integration Tips)
  name: broker_ca_bundle
  required: true
  type: 12
- display: Client certificates content (see `client.crt` in Integration Tips)
  name: cert_file
  required: true
  type: 12
- display: Client private key content (e.g. `client.key`)
  name: private_key
  required: true
  type: 14
- display: 'A CSV list of broker URLs in the format:  [ssl://]<hostname>[:port]) Get the hostname and port from the `brokerlist.properties` file (in instructions). The broker should be reachable from Demisto server.'
  name: broker_urls
  required: true
  type: 0
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: C - Fairly reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  required: false
description: Deprecated. Use McAfee Threat Intelligence Exchange V2 integration instead.
display: McAfee Threat Intelligence Exchange (Deprecated)
name: McAfee Threat Intelligence Exchange
script:
  commands:
  - arguments:
    - default: true
      description: '  Hash of the file to query. Supports MD5 SHA1 & SHA256'
      isArray: true
      name: file
      required: true
    description: Retrieves the reputations for the specified hash. Can be "MD5", "SHA1", or "SHA256".
    name: file
    outputs:
    - contextPath: File.MD5
      description: ' The MD5 hash of the file.'
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.TrustLevel
      description: File lowest trust level.
      type: String
    - contextPath: File.Vendor
      description: The vendor that reported the file as malicious.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: File.Malicious.Description
      description: A description explaining why the file was determined to be malicious.
      type: String
    - contextPath: File.Malicious.Vendor
      description: The vendor that reported the file as malicious.
      type: String
    - contextPath: File.Malicious.Score
      description: The actual score.
      type: Number
  - arguments:
    - default: true
      description: Hash of the file for which to set the reputation. Can be "MD5", "SHA1", or "SHA256".
      name: file
      required: true
    - auto: PREDEFINED
      description: The new trust level for the file.
      name: trust_level
      predefined:
      - NOT_SET
      - KNOWN_MALICIOUS
      - MOST_LIKELY_MALICIOUS
      - MIGHT_BE_MALICIOUS
      - UNKNOWN
      - MIGHT_BE_TRUSTED
      - MOST_LIKELY_TRUSTED
      - KNOWN_TRUSTED
      - KNOWN_TRUSTED_INSTALLER
      required: true
    - description: A file name to associate with the file.
      name: filename
    - description: A comment to associate with the file.
      name: comment
    description: Sets the “Enterprise” reputation (trust level) of a specified file. Permissions are required to invoke this method. See the 'How-to' in instance instruction.
    name: tie-set-file-reputation
  - arguments:
    - default: true
      description: '  Hash of the file for which to search. Can be "MD5", "SHA1", or "SHA256".'
      name: file
      required: true
    description: Retrieves the set of systems which have referenced (typically executed) the specified file.
    name: tie-file-references
    outputs:
    - contextPath: File.MD5
      description: MD5 hash of the file (if supplied).
      type: Unknown
    - contextPath: File.SHA1
      description: SHA1 hash of the file (if supplied).
      type: Unknown
    - contextPath: File.SHA256
      description: SHA256 hash of the file (if supplied).
      type: Unknown
    - contextPath: File.References.AgentGuid
      description: The GUID of the system that referenced the file.
      type: Unknown
    - contextPath: File.References.Date
      description: The time the system first referenced the file.
      type: Unknown
  dockerimage: demisto/dxl2:1.0.0.38570
  runonce: false
  script: '-'
  subtype: python2
  type: python
tests:
- McAfee-TIE Test
fromversion: 5.0.0