McAfee Threat Intelligence Exchange Deprecated
Deprecated. Use McAfee Threat Intelligence Exchange V2 integration instead.
Data Enrichment & Threat Intelligence · McAfee Threat Intelligence Exchange
Details
| ID | McAfee Threat Intelligence Exchange |
|---|---|
| Provider | Trellix |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 5.0.0 |
| Docker Image | demisto/dxl2:1.0.0.38570 |
| Supported Modules | Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security |
README
Use the McAfee Threat Intelligence Exchange (TIE) integration to get file reputations and the systems that reference the files.
Detailed Instructions
This section includes information required for configuring an integration instance.
Prerequisites - Connect to McAfee Threat Intelligence Exchange (TIE) using the DXL TIE Client
To connect the McAfee TIE using the DXL TIE client, you need to create certificates and configure DXL. For more information, see the OpenDXL documentation. After you complete this configuration, you will have the following files:
- Broker CA certificates (
brokercerts.crtfile) - Client certificate (
client.crtfile) - Client private key (
client.keyfile) - Broker list properties file (‘brokerlist.properties’ file)
To use the tie-set-file-reputation command, you need to authorize the client (Cortex XSOAR) to run the command. Follow the instructions in the OpenDXL documentation. In step #4, instead of selecting Active Response Server API, select TIE Server Set Enterprise Reputation.
Dependencies (Python packages)
You don’t need to install the packages, they are included in the Docker image.
Configure McAfee Threat Intelligence Exchange on Cortex XSOAR
- Navigate to Settings > Integrations > Servers & Services.
- Search for McAfee Threat Intelligence Exchange.
- Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Broker CA certificates content (see
brokercerts.crtin Detailed Instructions) - Client certificates content (see
client.crtin Detailed Instructions) - Client private key path (e.g., /usr/config/client.key)
- A CSV list of broker URLs in the format: [ssl://]<hostname>[:port]) Get the hostname and port from the
brokerlist.propertiesfile (in instructions). The broker should be reachable from Cortex XSOAR server.
- Click Test to validate the URLs, token, and connection.
Commands
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
- Get the reputation for a file hash: file
- Set the enterprise reputation for a file: tie-set-file-reputation
- Get the systems that referenced a file: tie-file-references
1. Get the reputation for a file hash
Retrieves the reputations for the specified hash. Supports MD5 SHA1 & SHA256.
Base Command
file
Input
| Argument Name | Description | Required |
|---|---|---|
| file | Hash of the file to query. Can be “MD5”, “SHA1”, or “SHA256”. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| File.MD5 | unknown | MD5 hash of the file (if supplied). |
| File.SHA1 | unknown | SHA1 hash of the file (if supplied). |
| File.SHA256 | unknown | MD5 hash of the file (if supplied). |
| File.TrustLevel | unknown | File lowest trust level. |
| File.Vendor | unknown | Vendor of the file lowest trust level. |
| DBotScore.Score | unknown | Vendor used to calculate the score. |
| DBotScore.Vendor | unknown | The actual score. |
| DBotScore.Type | unknown | Indicator type. |
| DBotScore.Indicator | unknown | The hash of the file. |
Command Example
!file file=3d720dc2b8b0ff23f616aa850447e702eb89047e
Human Readable Output

2. Set the enterprise reputation for a file
Sets the “Enterprise” reputation (trust level) of a specified file. Permissions are required to invoke this method. See the ‘How-to’ in instance instruction.
Base Command
tie-set-file-reputation
Input
| Argument Name | Description | Required |
|---|---|---|
| file | Hash of the file for which to set the reputation. Can be “MD5”, “SHA1”, or “SHA256”. | Required |
| trust_level | The new trust level for the file. | Required |
| filename | A file name to associate with the file. | Optional |
| comment | A comment to associate with the file. | Optional |
Context Output
There is no context output for this command.
Command Example
!tie-set-file-reputation file=3b0fcc439a7d83860433d34e564ff1e9ddd4cfaa trust_level=MOST_LIKELY_TRUSTED
Human Readable Output

3. Get the systems that referenced a file
Retrieves the set of systems which have referenced (typically executed) the specified file.
Base Command
tie-file-references
Input
| Argument Name | Description | Required |
|---|---|---|
| file | Hash of the file for which to search. Can be “MD5”, “SHA1”, or “SHA256”. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| File.MD5 | unknown | MD5 hash of the file (if supplied). |
| File.SHA1 | unknown | SHA1 hash of the file (if supplied). |
| File.SHA256 | unknown | SHA256 hash of the file (if supplied). |
| File.References.AgentGuid | unknown | The GUID of the system that referenced the file. |
| File.References.Date | unknown | The time the system first referenced the file. |
Command Example
!tie-file-references file=3d720dc2b8b0ff23f616aa850447e702eb89047e
Human Readable Output

Configuration parameters
broker_ca_bundle— Broker CA certificates content (see `brokercerts.crt` in Integration Tips) (required)cert_file— Client certificates content (see `client.crt` in Integration Tips) (required)private_key— Client private key content (e.g. `client.key`) (required)broker_urls— A CSV list of broker URLs in the format: [ssl://]<hostname>[:port]) Get the hostname and port from the `brokerlist.properties` file (in instructions). The broker should be reachable from Demisto server. (required)integrationReliability— Source ReliabilityfeedExpirationPolicy—feedExpirationInterval—
Commands (3)
-
fileRetrieves the reputations for the specified hash. Can be "MD5", "SHA1", or "SHA256".
-
tie-file-referencesRetrieves the set of systems which have referenced (typically executed) the specified file.
-
tie-set-file-reputationSets the “Enterprise” reputation (trust level) of a specified file. Permissions are required to invoke this method. See the 'How-to' in instance instruction.
import demistomock as demisto import importlib import pytest from dxltieclient import TieClient valid_private_key = """-----BEGIN PRIVATE KEY----- This is a vaild Private Key -----END PRIVATE KEY-----""" valid_certificate = """-----BEGIN CERTIFICATE----- This is a valid Certificate -----END CERTIFICATE-----""" invalid_private_key = r"\private\key\path.key" invalid_certificate = """""-----BEGIN CERTIFICATE REQUEST----- This is a valid Certificate -----END CERTIFICATE REQUEST-----""" spaces_in_certificate = """ -----BEGIN CERTIFICATE----- This is a valid Certificate -----END CERTIFICATE----- """ def test_validate_certificate_format(mocker): mcafee_tie = importlib.import_module("McAfee-TIE") # Invalid private Key valid_params = {'private_key': invalid_private_key, 'cert_file': valid_certificate, 'broker_ca_bundle': valid_certificate} mocker.patch.object(demisto, "params", return_value=valid_params) with pytest.raises(SystemExit): mcafee_tie.validate_certificates_format() # Invalid cert file valid_params = {'private_key': valid_private_key, 'cert_file': invalid_certificate, 'broker_ca_bundle': valid_certificate} mocker.patch.object(demisto, "params", return_value=valid_params) with pytest.raises(SystemExit): mcafee_tie.validate_certificates_format() # Invalid broker_ca_bundle valid_params = {'private_key': valid_private_key, 'cert_file': valid_certificate, 'broker_ca_bundle': invalid_certificate} mocker.patch.object(demisto, "params", return_value=valid_params) with pytest.raises(SystemExit): mcafee_tie.validate_certificates_format() # Everything is valid + spaces valid_params = {'private_key': valid_private_key, 'cert_file': valid_certificate, 'broker_ca_bundle': spaces_in_certificate} mocker.patch.object(demisto, "params", return_value=valid_params) mcafee_tie.validate_certificates_format() def test_safe_get_file_reputation_returned_exception(mocker): """ Given: - tie client and hash parameter When: - The tie client returns some exception Then: - Print to log and return empty dict """ mcafee_tie = importlib.import_module("McAfee-TIE") tie_client = TieClient(None) hash_param = {'test': 'test'} mocker.patch.object(tie_client, "get_file_reputation", side_effect=Exception()) assert not mcafee_tie.safe_get_file_reputation(tie_client, hash_param) def test_safe_get_file_reputation_returned_rep(mocker): """ Given: - tie client and hash parameter When: - The tie client returns reputation Then: - return the reputation """ mcafee_tie = importlib.import_module("McAfee-TIE") tie_client = TieClient(None) hash_param = {'test': 'test'} mocker.patch.object(tie_client, "get_file_reputation", return_value='test_value') assert mcafee_tie.safe_get_file_reputation(tie_client, hash_param)