Hello,
I was wondering if is possible to use the openDXL to block a hash in all the endpoint (Mcafee products are in place) and also if is possible to search for specific hash an see if this hash exist in more than one endpoint.
Any idea or experience validating that this capability are possible?....
Regards,
Hi Pablo.
I think you will find this link to be useful:
In this package take a look at basic_set_external_file_reputation.py -- in this script, it checks to see if a hash already exists in TIE and is not, sets a reputation. I took this script and added a list of hashes from a file and set as malicious.
There are other example scripts such as get a reputation as well.
Hope this helps,
Pete
