Node-RED Flow: Search for IP Addresses of MAR Clients via DXL

mcafee added a new solution:

Quote

Prerequisites

• The OpenDXL and McAfee Active Response (MAR) DXL modules have been added to the Node-RED palette.
• A DXL client has been configured in Node-RED (see Client Configuration).
• A MAR DXL service is running and available on the DXL fabric.
• The Node-RED DXL client is authorized to perform MAR search (see Authorize Client to Perform MAR Search).

Here is the Node-RED flow content for this solution:

Code

1. [
2. {
3. "id": "4d70f507.87bd5c",
4. "type": "tab",
5. "label": "MAR Basic Search Example",
6. "disabled": false,
7. "info": "This sample executes a `McAfee Active Response` search for the IP addresses of\r\nhosts that have an Active Response client installed. The IP addresses found are\r\ndisplayed on the Node-RED `debug` tab.\r\n\r\n### Prerequisites\r\n\r\n* The samples configuration step has been completed (see\r\n [Client Configuration](https://opendxl.github.io/node-red-contrib-dxl/jsdoc/tutorial-configuration.html)).\r\n* A McAfee Active Response (MAR) service is available on the DXL fabric.\r\n* The DXL client associated with the\r\n`Search MAR for hosts` node has been authorized to perform MAR searches\r\n (see [Authorize Client to Perform MAR Search](https://opendxl.github.io/opendxl-client-python/pydoc/marsendauth.html)).\r\n\r\n### Setup\r\n\r\nTo deploy the flow, press the `Deploy` button in the upper-right corner of the\r\n screen. If Node-RED is able to properly connect to the DXL fabric, a green dot\r\n with the word `connected` should appear under the `Search MAR for hosts` node.\r\n\r\n### Running\r\n\r\nTo exercise the flow, double-click the button on the left side of the\r\n`Specify search projections` node.\r\n\r\n### Output\r\n\r\nThe IP addresses found should appear in the Node-RED `debug` tab. For example:\r\n\r\n~~~\r\n[ \"192.168.130.152\", \"192.168.130.133\"]\r\n~~~\r\n\r\n### Details\r\n\r\nThe flow exercises the nodes below.\r\n\r\n#### Specify search projections\r\n\r\nThis is an `inject` input node which starts the flow. This node injects a new\r\nmessage with a `payload` property which specifies that the IP addresses of\r\nhosts which are found should be projected into the search results:\r\n\r\n```json\r\n[\r\n {\r\n \"name\": \"HostInfo\",\r\n \"outputs\": [\r\n \"ip_address\"\r\n ]\r\n }\r\n]\r\n```\r\n\r\n#### Set projections request parameter\r\n\r\nThis is a `change` node which copies the value from the `payload` property on\r\nthe message to the `projections` property. The `Search MAR for hosts` node uses\r\nthe `projections` property when constructing the parameters for the MAR search. \r\n\r\n#### Search MAR for hosts\r\n\r\nThis is a `mar search` node. This node connects to the DXL fabric and sends a\r\nsearch request to the MAR service using the `msg.projections` property set by\r\nthe `Set projections request parameter` node.\r\n\r\nThe `Limit` property specifies that up to the first \"10\" result items should be\r\nprovided.\r\n\r\nThe `Return` property is set to \"a parsed JSON object\" to indicate that the\r\n`payload` for the response should be added to the output message as a JavaScript\r\nobject decoded from JSON.\r\n\r\n#### Extract host IP addresses\r\n\r\nThis is a `function` node. This node includes a JavaScript code snippet which\r\niterates over the search result items that were set on the `msg.payload`\r\nproperty by the `Search MAR for hosts` node. The source code for the code\r\nsnippet is included below:\r\n\r\n```javascript\r\nmsg.payload = \r\n msg.payload.map(function (processEntry) {\r\n return processEntry.output[\"HostInfo|ip_address\"]\r\n })\r\nreturn msg\r\n```\r\n\r\nThe `HostInfo|ip_address` value for\r\neach item is captured. An array with just the ip addresses of the hosts which\r\nwere returned in the search results is set onto the `msg.payload` property.\r\n\r\n#### Output IP addresses\r\n\r\nThis is a `debug` output node. This node outputs the array of host IP addresses\r\nwritten to the `msg.payload` property by the `Extract host IP addresses` node."
8. },
9. {
10. "id": "e18fdc9e.6feae",
11. "type": "dxl-mar-search",
12. "z": "4d70f507.87bd5c",
13. "name": "Search MAR for hosts",
14. "pollInterval": 5,
15. "client": "2ed0ce07.039942",
16. "projections": "",
17. "limit": "10",
18. "textFilter": "",
19. "sortBy": "",
20. "sortDirection": "",
21. "returnType": "obj",
22. "x": 280,
23. "y": 220,
24. "wires": [
25. [
26. "be60e18f.08cfb"
27. ]
28. ]
29. },
30. {
31. "id": "340bdcc6.7f4904",
32. "type": "inject",
33. "z": "4d70f507.87bd5c",
34. "name": "Specify search projections",
35. "topic": "",
36. "payload": "[{\"name\":\"HostInfo\",\"outputs\":[\"ip_address\"]}]",
37. "payloadType": "json",
38. "repeat": "",
39. "crontab": "",
40. "once": false,
41. "onceDelay": 0.1,
42. "x": 150,
43. "y": 40,
44. "wires": [
45. [
46. "a2cb13bf.388be"
47. ]
48. ]
49. },
50. {
51. "id": "39e7184f.da87a8",
52. "type": "debug",
53. "z": "4d70f507.87bd5c",
54. "name": "Debug: Output IP addresses",
55. "active": true,
56. "tosidebar": true,
57. "console": false,
58. "tostatus": false,
59. "complete": "payload",
60. "x": 480,
61. "y": 420,
62. "wires": []
63. },
64. {
65. "id": "be60e18f.08cfb",
66. "type": "function",
67. "z": "4d70f507.87bd5c",
68. "name": "Extract host IP addresses",
69. "func": "msg.payload = \n msg.payload.map(function (processEntry) {\n return processEntry.output[\"HostInfo|ip_address\"]\n })\nreturn msg",
70. "outputs": 1,
71. "noerr": 0,
72. "x": 390,
73. "y": 320,
74. "wires": [
75. [
76. "39e7184f.da87a8"
77. ]
78. ]
79. },
80. {
81. "id": "a2cb13bf.388be",
82. "type": "change",
83. "z": "4d70f507.87bd5c",
84. "name": "Set projections request parameter",
85. "rules": [
86. {
87. "t": "set",
88. "p": "projections",
89. "pt": "msg",
90. "to": "payload",
91. "tot": "msg"
92. }
93. ],
94. "action": "",
95. "property": "",
96. "from": "",
97. "to": "",
98. "reg": false,
99. "x": 260,
100. "y": 120,
101. "wires": [
102. [
103. "e18fdc9e.6feae"
104. ]
105. ]
106. }
107. ]

Display More