Solutions

This flow utilizes McAfee Active Response (MAR) to adds sightings to MISP published events containing hash-based attributes.

OpenC2 client library for use with the OpenDXL Python Client

Invokes the ePO "system.findTag" remote command via DXL

Invokes the ePO "system.find" remote command via DXL

Ensures that systems within McAfee ePO are tagged to indicate what policies are currently applied within Cisco ISE Adaptive Network Control (ANC)

Allows FireEye appliances to send file reputation to McAfee TIE over the DXL.

Retrieves reputation of a certificate from TIE

This flow pulls all systems from ePO and creates a set difference with all systems from AD.

Invokes the ePO "system.applyTag" remote command via DXL

A library used to consume and produce records to a Data Exchange Layer (DXL) Streaming Service

Invokes the ePO "system.clearTag" remote command via DXL

This flow checks an e-mail address and sends the URLs in e-mail messages to Threat Grid for analysis.

Retrieves the reputation of a file from TIE

Executes a MAR search for running processes on hosts having MAR client installed