Posts by lugerp

  • Block Hash in OpenDXL and Search Hashes in all the Endpoints

    Hi Pablo.


    I think you will find this link to be useful:


    In this package take a look at basic_set_external_file_reputation.py -- in this script, it checks to see if a hash already exists in TIE and is not, sets a reputation. I took this script and added a list of hashes from a file and set as malicious.


    There are other example scripts such as get a reputation as well.


    Hope this helps,

    Pete

  • Set TIE Reputation issue

    I've been working on creating a flow to utilize the new 3rd party reputation option in TIE 3.0. The TIE servers are at 3.0.0.480 and I've configured the External certificate authorizations and policy. I am also able to see file and cert reputations being changed over the DXL fabric. For some reason, however, when I try to use the Set File Reputation Node - I get nothing. It's as if the Node doesn't even run; there's no debug message coming out and the reputation doesn't change. Even using the notepad example.


    I'm wondering if this node is not compatible with TIE 3.0? Has anyone else had any luck with it? I guess my next step would be to pull out wireshark.


    Thanks for any help you can provide!

    Pete