Enrich DXL with ATD verdict v2

Uses McAfee ATD to push any malicious verdicts over DXL. Detonates a file in ATD and if malicious, pushes its MD5, SHA1 and SHA256 hashes to McAfee DXL.

McAfee DXL · 5 tasks · 0 inputs · 0 outputs

Commands used

closeInvestigation dxl-send-event

Flowchart

yes Start Start Any malicious files detected? - Exists Any malicious files detec... Exists Close incident - closeInvestigation Close incident closeInvestigation ATD - Detonate File - ATD - Detonate File ATD - Detonate File ATD - Detonate File DXL - Push file hashes as malicious - dxl-send-event DXL - Push file hashes as... dxl-send-event