category: Messaging and Conferencing
provider: Trellix
commonfields:
  id: McAfee DXL
  version: -1
sectionorder:
  - Connect
  - Collect
configuration:
- display: Broker CA certificates content (see `brokercerts.crt` in the instructions).
  name: broker_ca_bundle
  required: true
  type: 12
  section: Connect
- display: Client certificates content (see `client.crt` in the instructions).
  name: cert_file
  required: true
  type: 12
  section: Connect
- display: Client private key content (e.g. `client.key`)
  name: private_key
  required: true
  type: 14
  section: Connect
- display: Brokers URLs (comma separated list in the form of [ssl://]<hostname>[:port]). Get the hostname & port from the `brokerlist.properties` file in the instructions. Note that the broker should be reachable from the Demisto server.
  name: broker_urls
  required: true
  type: 0
  section: Connect
- defaultvalue: DXL_PUSH_IP
  display: The topic for which to publish the 'dxl-push-ip'.
  name: push_ip_topic
  type: 0
  required: false
  section: Connect
- defaultvalue: DXL_PUSH_URL
  display: The topic for which to publish the 'dxl-push-url'.
  name: push_url_topic
  type: 0
  required: false
  section: Connect
- defaultvalue: DXL_PUSH_DOMAIN
  display: The topic for which to publish the 'dxl-push-domain'.
  name: push_domain_topic
  type: 0
  required: false
  section: Connect
- defaultvalue: DXL_PUSH_HASH
  display: The topic for which to publish the 'dxl-push-hash'.
  name: push_hash_topic
  type: 0
  required: false
  section: Connect
description: McAfee DXL client.
display: McAfee DXL
name: McAfee DXL
script:
  commands:
  - arguments:
    - description: The topic for which to publish the message.
      name: topic
      required: true
    - description: The event payload.
      name: payload
      required: true
    description: Sends the specified event to the DXL fabric.
    name: dxl-send-event
  - arguments:
    - description: The IP address to push to the DXL fabric.
      name: ip
      required: true
    - auto: PREDEFINED
      description: 'The new trust level for the IP address. Can be: "NOT_SET", "KNOWN_MALICIOUS", "MOST_LIKELY_MALICIOUS", "UNKNOWN", "MIGHT_BE_TRUSTED", "MOST_LIKELY_TRUSTED", "KNOWN_TRUSTED", or "KNOWN_TRUSTED_INSTALLER".'
      name: trust_level
      predefined:
      - NOT_SET
      - KNOWN_MALICIOUS
      - MOST_LIKELY_MALICIOUS
      - MIGHT_BE_MALICIOUS
      - UNKNOWN
      - MIGHT_BE_TRUSTED
      - MOST_LIKELY_TRUSTED
      - KNOWN_TRUSTED
      - KNOWN_TRUSTED_INSTALLER
      required: true
    - description: The topic for which to publish the 'dxl-push-ip'.
      name: topic
    description: The push IP address to the DXL fabric.
    name: dxl-push-ip
  - arguments:
    - description: The URL to push to the DXL fabric.
      name: url
      required: true
    - auto: PREDEFINED
      description: 'The new trust level for the URL. Can be: "NOT_SET", "KNOWN_MALICIOUS", "MOST_LIKELY_MALICIOUS", "UNKNOWN", "MIGHT_BE_TRUSTED", "MOST_LIKELY_TRUSTED", "KNOWN_TRUSTED", or "KNOWN_TRUSTED_INSTALLER".'
      name: trust_level
      predefined:
      - NOT_SET
      - KNOWN_MALICIOUS
      - MOST_LIKELY_MALICIOUS
      - MIGHT_BE_MALICIOUS
      - UNKNOWN
      - MIGHT_BE_TRUSTED
      - MOST_LIKELY_TRUSTED
      - KNOWN_TRUSTED
      - KNOWN_TRUSTED_INSTALLER
      required: true
    - description: The topic for which to publish the 'dxl-push-url'.
      name: topic
    description: The push URL to the DXL fabric.
    name: dxl-push-url
  - arguments:
    - description: The domain to push to the DXL fabric.
      name: domain
      required: true
    - auto: PREDEFINED
      description: 'The new trust level for the domain. Can be: "NOT_SET", "KNOWN_MALICIOUS", "MOST_LIKELY_MALICIOUS", "UNKNOWN", "MIGHT_BE_TRUSTED", "MOST_LIKELY_TRUSTED", "KNOWN_TRUSTED", or "KNOWN_TRUSTED_INSTALLER".'
      name: trust_level
      predefined:
      - NOT_SET
      - KNOWN_MALICIOUS
      - MOST_LIKELY_MALICIOUS
      - MIGHT_BE_MALICIOUS
      - UNKNOWN
      - MIGHT_BE_TRUSTED
      - MOST_LIKELY_TRUSTED
      - KNOWN_TRUSTED
      - KNOWN_TRUSTED_INSTALLER
      required: true
    - description: The topic for which to publish the 'dxl-push-domain'.
      name: topic
    description: The push domain to the DXL fabric.
    name: dxl-push-domain
  - arguments:
    - description: The hash to push to the DXL fabric.
      name: hash
      required: true
    - auto: PREDEFINED
      description: 'The new trust level for the domain. Can be: "NOT_SET", "KNOWN_MALICIOUS", "MOST_LIKELY_MALICIOUS", "UNKNOWN", "MIGHT_BE_TRUSTED", "MOST_LIKELY_TRUSTED", "KNOWN_TRUSTED", or "KNOWN_TRUSTED_INSTALLER".'
      name: trust_level
      predefined:
      - NOT_SET
      - KNOWN_MALICIOUS
      - MOST_LIKELY_MALICIOUS
      - MIGHT_BE_MALICIOUS
      - UNKNOWN
      - MIGHT_BE_TRUSTED
      - MOST_LIKELY_TRUSTED
      - KNOWN_TRUSTED
      - KNOWN_TRUSTED_INSTALLER
      required: true
    - description: The topic for which to publish the 'dxl-push-hash'.
      name: topic
    description: The push hash to the DXL fabric.
    name: dxl-push-hash
  dockerimage: demisto/dxl:1.0.0.10133006
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- McAfee DXL - Test
fromversion: 5.0.0