Posts by mohl1

Hi Christophe,

looks like that atd_subscriber and the forti_push.py work fine.

Seems that there are no IPs identified during the ATD analysis process hence the forti_push.py didn't get executed.

I've attached a DXL message from my ATD appliance (sample.txt). You can see in the DXL message the IP address that I am parsing out with the script to update Fortinet. My ATD has the following analyzer profile configured:

My guess is that the "Enable Malware Internet Access" needs to be enabled to receive network information like IPs / URLs. I will get this confirmed by one of our Technology Specialist for ATD and provide you with an update.

All the best,

Martin

mohl1 added a new version:

Quote

mohl1 added a new solution:

Quote

McAfee Advanced Threat Defense (ATD) will produce local threat intelligence that will be pushed via DXL. An OpenDXL wrapper will subscribe and parse IP and URL indicators ATD produced and will automatically update Infoblox RPZ rules.

mohl1 added a new version:

Quote

mohl1 added a new solution:

Quote

McAfee Advanced Threat Defense (ATD) will produce local threat intelligence that will be pushed via DXL. An OpenDXL wrapper will subscribe and parse IP indicators ATD produced and will automatically update Firewall rules.

mohl1 added a new version:

Quote

mohl1 added a new solution:

Quote

Based on tagging a script will extract suspicious MD5 hashes from an Threat Event and will launch automated McAfee Active Response lookups. If indicators are found within the enterprise the script will automatically retag the threat event, add sightings and comments with the findings.

mohl1 added a new version:

Quote

Updated OpenDXL Client Libraries version 4.0.0.416 included.

Automated certificate creation process during the test connectivity process.

Hi Christoph,

thanks for your post. How do you execute the scripts? The main purpose for the scripts is to receive the ATD DXL message and extract C2 communication.

First you execute the atd_subscriber.py . This will start a ATD subscriber that will wait for DXL messages from ATD.

As soon there is a DXL messages published, it will extract C2 communication and execute the forti_push.py script with the ip.

Here some more details.

In line 39 you see that the atd_subscriber.py script executes the forti_push.py script incl. the first argument (in this case the IP).

You can also execute the script directly e.g.

python forti_push.py 199.199.199.199

Please let us know how it goes.

Martin

mohl1 added a new version:

Quote

Initial release

mohl1 added a new version:

Quote

Initial release

mohl1 added a new solution:

Quote

McAfee Advanced Threat Defense (ATD) will produce local threat intelligence that will be pushed via DXL. An OpenDXL wrapper will subscribe and parse IP indicators ATD produced and will automatically update Firewall rules.

McAfee Advanced Threat Defense (ATD) is a malware analytics solution combining signatures and behavioral analysis techniques to rapidly identify malicious content and provides local threat intelligence. ATD exports IOC data in STIX format in several ways including the DXL. https://www.mcafee.com/in/prod…anced-threat-defense.aspx

Fortinet Firewalls provide high performance network security protection platform. https://www.fortinet.com/produ…-generation-firewall.html

mohl1 added a new version:

Quote

Version 1.1.0 includes an additional action with MAR. This allows to lookup md5 Hashes with McAfee Active Response.

mohl1 added a new solution:

Quote

IntelMQ is used to collect data from the Malware Intelligence Sharing Platform (MISP), to parse and push intelligence via OpenDXL.

MISP threat sharing platform is a free and open source software helping information sharing of threat and cyber security indicators.

IntelMQ is an orchestration solution for IT security teams (CERTs, CSIRTs and abuse departments) for collecting and processing security feeds. It's a community driven initiative called IHAP (Incident Handling Automation Project) which was conceptually designed by European CERTs/CSIRTs. Its main goal is to give incident responders an easy way to collect and process threat intelligence.

Display More

mohl1 added a new solution:

Quote

McAfee Advanced Threat Defense produces local threat intelligence that is published via DXL. An OpenDXL wrapper subscribes and parses indicators that ATD produces and executes automated Active Response searches across multiple DXL fabrics. The results are imported into a big data analytic platform.

McAfee Advanced Threat Defense (ATD) is a malware analytics solution combining signatures and behavioral analysis techniques to rapidly identify malicious content and provides the local threat intelligence for this solution. ATD exports IOC data in STIX format in several ways including DXL.

McAfee Active Response (MAR) is an incident response solution that leverage the DXL messaging fabric to support the threat hunting process and provide real time visibility.

Elasticsearch is a search engine that provides a distributed, multitenant-capable full-text search engine. Kibana is an open source data visualization plugin for Elasticsearch that provides visualization capabilities on top of the content indexed on Elasticsearch.

Display More

mohl1 added a new solution:

Quote

McAfee Advanced Threat Defense (ATD) produces local threat intelligence that is published via DXL. An OpenDXL wrapper subscribes and parses IP indicators that ATD produces and creates a subscribed list of IPs for the McAfee Web Gateway.

McAfee Advanced Threat Defense (ATD) is a malware analytics solution combining signatures and behavioral analysis techniques to rapidly identify malicious content and provides local threat intelligence. ATD exports IOC data in STIX format in several ways including DXL.

McAfee Web Gateway (MWG) delivers comprehensive security for all aspects of web traffic combined with industry-leading, proactive detection of zero-day malware with full coverage of web traffic, including SSL.

mohl1 added a new version:

Quote

mohl1 added a new solution:

Quote

McAfee Advanced Threat Defense (ATD) produces local threat intelligence that is published via DXL. An OpenDXL wrapper subscribes and parses indicators that ATD produces and imports indicators into a threat intelligence management platform (MISP).

McAfee Advanced Threat Defense (ATD) is a malware analytics solution combining signatures and behavioral analysis techniques to rapidly identify malicious content and provides local threat intelligence. ATD exports IOC data in STIX format in several ways including DXL.

MISP threat sharing platform is a free and open source software helping information sharing of threat and cyber security indicators.

mohl1 added a new version:

Quote

mohl1 added a new solution:

Quote

McAfee Advanced Threat Defense (ATD) produces local threat intelligence that is published via DXL. An OpenDXL wrapper subscribes and parses IP indicators from ATD and automatically updates Firewall rules, pushing new configurations to selected Firewalls.

McAfee Advanced Threat Defense (ATD) is a malware analytics solution combining signatures and behavioral analysis techniques to rapidly identify malicious content and provides local threat intelligence. ATD exports IOC data in STIX format in several ways including DXL.

Forcepoint Next Generation Firewalls combines fast, flexible networking with industry-leading security to connect and protect people and the data they use throughout diverse, evolving enterprise networks.