category: Data Enrichment & Threat Intelligence
provider: Trellix
commonfields:
  id: McAfee Threat Intelligence Exchange
  version: -1
deprecated: true
configuration:
- display: Broker CA certificates content (see `brokercerts.crt` in Integration Tips)
  name: broker_ca_bundle
  required: true
  type: 12
- display: Client certificates content (see `client.crt` in Integration Tips)
  name: cert_file
  required: true
  type: 12
- display: Client private key content (e.g. `client.key`)
  name: private_key
  required: true
  type: 14
- display: 'A CSV list of broker URLs in the format:  [ssl://]<hostname>[:port]) Get the hostname and port from the `brokerlist.properties` file (in instructions). The broker should be reachable from Demisto server.'
  name: broker_urls
  required: true
  type: 0
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: C - Fairly reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  required: false
description: Deprecated. Use McAfee Threat Intelligence Exchange V2 integration instead.
display: McAfee Threat Intelligence Exchange (Deprecated)
name: McAfee Threat Intelligence Exchange
script:
  commands:
  - arguments:
    - default: true
      description: '  Hash of the file to query. Supports MD5 SHA1 & SHA256'
      isArray: true
      name: file
      required: true
    description: Retrieves the reputations for the specified hash. Can be "MD5", "SHA1", or "SHA256".
    name: file
    outputs:
    - contextPath: File.MD5
      description: ' The MD5 hash of the file.'
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.TrustLevel
      description: File lowest trust level.
      type: String
    - contextPath: File.Vendor
      description: The vendor that reported the file as malicious.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: File.Malicious.Description
      description: A description explaining why the file was determined to be malicious.
      type: String
    - contextPath: File.Malicious.Vendor
      description: The vendor that reported the file as malicious.
      type: String
    - contextPath: File.Malicious.Score
      description: The actual score.
      type: Number
  - arguments:
    - default: true
      description: Hash of the file for which to set the reputation. Can be "MD5", "SHA1", or "SHA256".
      name: file
      required: true
    - auto: PREDEFINED
      description: The new trust level for the file.
      name: trust_level
      predefined:
      - NOT_SET
      - KNOWN_MALICIOUS
      - MOST_LIKELY_MALICIOUS
      - MIGHT_BE_MALICIOUS
      - UNKNOWN
      - MIGHT_BE_TRUSTED
      - MOST_LIKELY_TRUSTED
      - KNOWN_TRUSTED
      - KNOWN_TRUSTED_INSTALLER
      required: true
    - description: A file name to associate with the file.
      name: filename
    - description: A comment to associate with the file.
      name: comment
    description: Sets the “Enterprise” reputation (trust level) of a specified file. Permissions are required to invoke this method. See the 'How-to' in instance instruction.
    name: tie-set-file-reputation
  - arguments:
    - default: true
      description: '  Hash of the file for which to search. Can be "MD5", "SHA1", or "SHA256".'
      name: file
      required: true
    description: Retrieves the set of systems which have referenced (typically executed) the specified file.
    name: tie-file-references
    outputs:
    - contextPath: File.MD5
      description: MD5 hash of the file (if supplied).
      type: Unknown
    - contextPath: File.SHA1
      description: SHA1 hash of the file (if supplied).
      type: Unknown
    - contextPath: File.SHA256
      description: SHA256 hash of the file (if supplied).
      type: Unknown
    - contextPath: File.References.AgentGuid
      description: The GUID of the system that referenced the file.
      type: Unknown
    - contextPath: File.References.Date
      description: The time the system first referenced the file.
      type: Unknown
  dockerimage: demisto/dxl2:1.0.0.38570
  runonce: false
  script: '-'
  subtype: python2
  type: python
tests:
- McAfee-TIE Test
fromversion: 5.0.0