Posts by ibmresilient

ibmresilient added a new solution:

Quote

The McAfee Threat Intelligence Exchange function searches for information on a file hash within Threat Intelligence Exchange. The function takes as an input a file hash along with the type of hash and returns information relative to the file. This information can come from any of the providers (Enterprise, GTI, ATD, MWG) in addition to a system list. The example searches on artifacts of hash types MD5, SHA1, and SHA256 and populates a results data table with Enterprise file provider information.

ibmresilient added a new solution:

Quote

This integration with IBM Resilient automatically searches TIE for reputation when IOCs and artifacts are tracked within the Resilient IRP, alerting the incident response team to significant IOCs. This ensures that security analysts can operationalize threat intelligence data in real time, allowing them to focus energy on investigation and response.

ibmresilient added a new solution:

Quote

The McAfee Publish to DXL function is able to publish synchronous/asynchronous messages to different topics. This can be done using a service or event. Examples include tagging a system and setting a trust level in TIE. Information provided in the payload input is then added as an incident note.

ibmresilient added a new solution:

Quote

The McAfee ePO function applies a tag to a system in ePO. The function takes as input a tag and a system or a list of system's hostnames/IP addresses, and then applies the tag to the provided system in ePO. The function assumes the list of systems and the provided tag are validate within ePO. The example adds the tag "Shut Down" to systems based on an artifact type of IP address or System Name, and specifies in the description that the "Shut Down" tag was applied to this system.