Solutions

This solution focuses on automated threat responses with McAfee ATD, OpenDXL and Check Point Firewalls.

The Check Point LEA/DXL Connector, combined with the Check Point Plug-in for McAfee ePO, forwards intelligence from Check Point Threat Prevention Blades over DXL.

The Wildfire TIE DXL Python application polls the Wildfire analysis data and updates TIE over the DXL fabric.

RIMalShare (Reputation Ingest - MalShare) employs Extract-Transform-Load (ETL) to import new threat indicators from malshare.com into your TIE Enterprise Reputations.

QChat (Quick Chat) is a chat room service leveraging the OpenDXL event invocation capabilities to create small, light-weight, and interactive chat rooms for use by incident responders and SOC personnel.

Allows Joe Sandbox to convict files and update the reputation in McAfee Threat Intelligence Exchange "TIE"

Allows FireEye to send HTTP JSON POST for reputation updates and also includes a manual URL for setting or retrieving TIE reputations for other integrations.

The focus of this project is around real-time bi-directional data sharing (bridging) between Data Exchange Layer and 3rd party data networks.

McAfee Active Response (MAR) client library for use with the OpenDXL Python Client

McAfee ePolicy Orchestrator (ePO) client library for use with the OpenDXL Python Client

MaxMind Host/IP Geolocation client library for use with the OpenDXL Python Client

McAfee Threat Intelligence Exchange (TIE) client library for use with the OpenDXL Python Client

VirusTotal API client library for use with the OpenDXL Python Client

Application which generates the structure and related files necessary for developing a Data Exchange Layer (DXL) integration with Python