category: Data Enrichment & Threat Intelligence provider: Trellix sectionorder: - Connect - Collect commonfields: id: McAfee Threat Intelligence Exchange V2 version: -1 configuration: - display: Broker CA certificates name: broker_ca_bundle required: true type: 12 additionalinfo: From `brokercerts.crt` file. section: Connect - display: Client certificates name: cert_file required: true type: 12 additionalinfo: From `client.crt` file. section: Connect - display: Client private key name: private_key required: true type: 14 additionalinfo: From `client.key` file. Make sure that the type of the field is not `encrypted` when filling it out. section: Connect - display: Broker URLs name: broker_urls required: true type: 0 additionalinfo: "The format should be: [ssl://][:port]. Get the hostname and port from the `brokerlist.properties` file. The broker should be reachable from the Cortex XSOAR server." section: Connect - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: C - Fairly reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged type: 15 required: false section: Collect - defaultvalue: indicatorType name: feedExpirationPolicy display: "" options: - never - interval - indicatorType - suddenDeath type: 17 required: false section: Collect - defaultvalue: "20160" name: feedExpirationInterval display: "" type: 1 required: false section: Collect description: Connect to McAfee TIE using the McAfee DXL client. display: McAfee Threat Intelligence Exchange v2 name: McAfee Threat Intelligence Exchange V2 script: commands: - arguments: - default: true description: Hashes of the files to query. Supports "MD5", "SHA1", and "SHA256". isArray: true name: file required: true description: Retrieves the reputations for the specified hashes. Can be "MD5", "SHA1", or "SHA256". name: file outputs: - contextPath: File.Hashes.type description: The type of the hash. type: String - contextPath: File.Hashes.value description: The value of the hash. type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.Malicious.Vendor description: The vendor that reported the file as malicious. type: String - contextPath: File.Malicious.Description description: A description of why this file was found malicious. type: Number - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Reliability description: How reliable the score is (for example, "C - fairly reliable"). type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.Hash description: The value of the hash. type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.GTI.Provider_ID description: The identifier of the particular provider that provided the reputation. type: Number - contextPath: McAfee.TIE.FilesReputations.Reputations.GTI.Trust_Level description: The trust level for the reputation subject. type: Number - contextPath: McAfee.TIE.FilesReputations.Reputations.GTI.Create_Date description: The time this reputation was created (UTC timezone). type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.GTI.Provider description: The name of the particular provider that provided the reputation. type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.GTI.Original_Response description: The raw response as returned by the Global Threat Intelligence (GTI) reputation provider. type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.GTI.First_Contact description: The time the file was first seen (UTC timezone). type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.GTI.Prevalence description: The number of times the file has been requested. type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.ATD.Provider_ID description: The identifier of the particular provider that provided the reputation. type: Number - contextPath: McAfee.TIE.FilesReputations.Reputations.ATD.Trust_Level description: The trust level for the reputation subject. type: Number - contextPath: McAfee.TIE.FilesReputations.Reputations.ATD.Create_Date description: The time this reputation was created (UTC timezone). type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.ATD.Provider description: The name of the particular provider that provided the reputation. type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.ATD.GAM_Score description: The trust score reported by the Gateway Anti-Malware (GAM). type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.ATD.AV_Engine_Score description: The trust score reported by the Anti-Virus engine. type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.ATD.Sandbox_Score description: The trust score as a result of the sandbox evaluation. type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.ATD.Verdict description: The overall verdict (taking into consideration all available information). type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.ATD.Behaviors description: An encoded structure that contains observed behaviors of the file. type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.Enterprise.Provider_ID description: The identifier of the particular provider that provided the reputation. type: Number - contextPath: McAfee.TIE.FilesReputations.Reputations.Enterprise.Trust_Level description: The trust level for the reputation subject. type: Number - contextPath: McAfee.TIE.FilesReputations.Reputations.Enterprise.Create_Date description: The time this reputation was created (UTC timezone). type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.Enterprise.Provider description: The name of the particular provider that provided the reputation. type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.Enterprise.Server_Version description: The version of the TIE server that returned the reputations (encoded version string). type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.Enterprise.First_Contact description: The time the file was first seen (UTC timezone). type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.Enterprise.Prevalence description: The count of unique systems that have executed the file. type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.Enterprise.Enterprise_Size description: The count of systems within the local enterprise. type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.Enterprise.Min_Local_Rep description: The lowest reputation found locally on a system. type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.Enterprise.Max_Local_Rep description: The highest reputation found locally on a system. type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.Enterprise.Avg_Local_Rep description: The average reputation found locally on systems. type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.Enterprise.Parent_Min_Local_Rep description: The lowest reputation for the parent found locally on a system. type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.Enterprise.Parent_Max_Local_Rep description: The highest reputation for the parent found locally on a system. type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.Enterprise.Parent_Avg_Local_Rep description: The average reputation for the parent found locally on systems. type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.Enterprise.File_Name_Count description: The number of unique file names for the file. type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.Enterprise.Detection_Count description: The number of detections for the file or certificate. type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.Enterprise.Last_Detection_Time description: The last time a detection occurred (UTC timezone). type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.Enterprise.Is_Prevalent description: Whether the file is considered to be prevalent within the enterprise. type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.Enterprise.Child_File_Reps description: "The child file reputations (aggregate string) according to the following format: - The number of files. - The maximum trust level found across the files. - The minimum trust level found across the files. - The trust level for the last file. - The average trust level across the files." type: String - contextPath: McAfee.TIE.FilesReputations.Reputations.Enterprise.Parent_File_Reps description: "The parent file reputations (aggregate string) according to the following format: - The number of files. - The maximum trust level found across the files. - The minimum trust level found across the files. - The trust level for the last file. - The average trust level across the files." type: String - arguments: - default: true description: Hashes of the files for which to set the reputation. Can be "MD5", "SHA1", or "SHA256". name: file required: true - auto: PREDEFINED description: The new trust level for the files. name: trust_level predefined: - NOT_SET - KNOWN_MALICIOUS - MOST_LIKELY_MALICIOUS - MIGHT_BE_MALICIOUS - UNKNOWN - MIGHT_BE_TRUSTED - MOST_LIKELY_TRUSTED - KNOWN_TRUSTED - KNOWN_TRUSTED_INSTALLER required: true - description: A file name to associate with the specified files. name: filename - description: A comment to associate with the specified files. name: comment description: Sets the “Enterprise” reputation (trust level, filename, and comment) of the specified hashes. Hashes that represent the same file can have a different "Enterprise" reputation if they are given different reputations. Permissions are required to invoke this method. See the 'How-to' in the instance instruction. name: tie-set-file-reputation - arguments: - default: true description: 'Hashes of the files for which to search. Can be "MD5", "SHA1", or "SHA256".' name: file required: true - description: The maximum number of results to return. The default and maximum number is 500 results. name: query_limit description: Retrieves the set of systems which have referenced (typically executed) the specified hashes. name: tie-file-references outputs: - contextPath: File.Hashes.type description: The type of the hash. type: String - contextPath: File.Hashes.value description: The value of the hash. type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: McAfee.TIE.FilesReferences.References.AgentGuid description: The GUID of the system that referenced the file. type: String - contextPath: McAfee.TIE.FilesReferences.References.Date description: The time the system first referenced the file (UTC timezone). type: String - contextPath: McAfee.TIE.FilesReferences.Hash description: The value of the hash. type: String dockerimage: demisto/dxl:1.0.0.10133006 runonce: false script: "-" subtype: python3 type: python tests: - no tests fromversion: 5.0.0