Posts by mcafee

mcafee added a new version:

Quote

McAfee Threat Intelligence Exchange (TIE) DXL Python Client Library 0.3.0 Release

• Added support for external reputation providers (TIE 3.0)

mcafee added a new version:

Quote

McAfee Active Response (MAR) DXL Python Client Library 0.2.1 Release

• Added context support for queries (#7)

mcafee added a new version:

Quote

Cisco pxGrid nodes for Node-RED using DXL 0.1.1 Release

• Added session notification node

mcafee added a new solution:

Quote

Prerequisites

• The OpenDXL and McAfee ePolicy Orchestrator (ePO) DXL modules have been added to the Node-RED palette.
• A DXL client has been configured in Node-RED (see Client Configuration).
• An ePO DXL service is running and available on the DXL fabric. If version 5.0 or later of the DXL ePO extensions are installed on your ePO server, an ePO DXL service should already be running on the fabric. If you are using an earlier version of the DXL ePO extensions, you can use the ePO DXL Python Service.
• The Node-RED DXL client is authorized to invoke the ePO DXL service, and the user that is connecting to the ePO server (within the ePO DXL service) has permission to execute the "system.findTag" remote command (see Client Authorization).

Here is the Node-RED flow content for this solution:

Code

1. [
2. {
3. "id": "a6c49432.25d5b8",
4. "type": "tab",
5. "label": "ePO Remote Command Example",
6. "disabled": false,
7. "info": "This sample invokes and displays the results of a `system.findTag` remote\r\ncommand via the ePO DXL service. The results of the find command are displayed\r\non the Node-RED `debug` tab.\r\n\r\n### Prerequisites\r\n\r\n* The samples configuration step has been completed (see\r\n [Client Configuration](https://opendxl.github.io/node-red-contrib-dxl/jsdoc/tutorial-configuration.html)).\r\n* A ePO DXL service is running and available on the DXL fabric. If version 5.0\r\n or later of the DXL ePO extensions are installed on your ePO server, an ePO\r\n DXL service should already be running on the fabric. If you are using an\r\n earlier version of the DXL ePO extensions, you can use the\r\n [ePO DXL Python Service](https://github.com/opendxl/opendxl-epo-service-python).\r\n* The DXL client associated with the `Find tags in ePO` node is authorized to\r\n invoke the ePO DXL service, and the user that is connecting to the ePO server\r\n (within the ePO DXL service) has permission to execute the `system.findTag`\r\n remote command (see\r\n [Client Authorization](https://opendxl.github.io/opendxl-epo-client-python/pydoc/authorization.html)).\r\n\r\n### Setup\r\n\r\n* If more than one ePO service is available on the DXL fabric that the DXL\r\n client is connecting to, edit the `Find tags in ePO` node and set the `ePO Id`\r\n property to that of the ePO service through which the remote command should be\r\n performed. By default, the `ePO Id` property is empty, in which case the\r\n client attempts to dynamically determine the id of the ePO service to\r\n communicate with.\r\n* Edit the `Set search text` node and modify the `Payload` property with the\r\n search text to use for the system find tag command. For example:\r\n\r\n ```json\r\n {\"searchText\":\"broker\"}\r\n ```\r\n\r\n* To deploy the flow, press the `Deploy` button in the upper-right corner of the\r\n screen. If Node-RED is able to properly connect to the DXL fabric, a green dot\r\n with the word `connected` should appear under the `Find tags in ePO` node.\r\n\r\n### Running\r\n\r\nTo exercise the flow, double-click the button on the left side of the\r\n`Set search text` node.\r\n\r\n### Output\r\n\r\nThe following output should appear in the Node-RED `debug` tab:\r\n\r\n```\r\n? [ object ]\r\n```\r\n\r\nAfter clicking on the right arrow button to expand the contents of the object,\r\noutput similar to the following should appear\r\n\r\n```\r\n? 0: object\r\n tagId: 3\r\n tagName: \"DXLBROKER\"\r\n tagNotes: \"DXL Broker\"\r\n```\r\n\r\n### Details\r\n\r\nThe flow exercises the nodes below.\r\n\r\n#### Set search text\r\n\r\nThis is an `inject` input node which starts the flow. This node injects a new\r\nmessage with a JSON-formatted document as the `payload`. The document\r\nspecifies the parameters to use for the ePO remote command. The parameters for\r\nthe \"system.findTag\" command include a `searchText` key with a corresponding\r\nvalue to be used as the text for the search.\r\n\r\nTo see the full list of remote commands and parameters that the ePO server\r\nsupports, a node which invokes the `core.help` remote command with an\r\nempty JSON document `{}` as the `payload` parameter could be included in a flow.\r\n\r\n#### Find tags in ePO\r\n\r\nThis is an `epo remote command` node. This node connects to the DXL fabric and\r\nsends a DXL `Request` message to the ePO service.\r\n\r\nThe `Command` property specifies the target remote command as `system.findTag`.\r\n\r\nThe DXL request message contains parameters set in the `payload` by the\r\n`Set search text` node.\r\n \r\nThe `Return` property is set to \"a parsed JSON object\" and the `Format` property\r\nis set to \"JSON\" to indicate that the payload for the response should be\r\nadded to the output message as a JavaScript object decoded from JSON.\r\n\r\n#### Output tags\r\n\r\nThis is a `debug` output node. This node outputs the `payload` set on\r\nthe message by the `Find tags in ePO` node. The output should include the\r\nresponse received from the DXL fabric for the `system.findTag` command.\r\n"
8. },
9. {
10. "id": "f8520e86.9988a",
11. "type": "dxl-epo-remote-command",
12. "z": "a6c49432.25d5b8",
13. "name": "Find tags in ePO",
14. "command": "system.findTag",
15. "client": "dc14e134.3cbdc",
16. "returnType": "obj",
17. "x": 330,
18. "y": 100,
19. "wires": [
20. [
21. "9f57edf.3a8841"
22. ]
23. ]
24. },
25. {
26. "id": "946b44fc.150d48",
27. "type": "inject",
28. "z": "a6c49432.25d5b8",
29. "name": "Set search text",
30. "topic": "",
31. "payload": "{\"searchText\":\"<specify-search-text>\"}",
32. "payloadType": "json",
33. "repeat": "",
34. "crontab": "",
35. "once": false,
36. "onceDelay": 0.1,
37. "x": 140,
38. "y": 100,
39. "wires": [
40. [
41. "f8520e86.9988a"
42. ]
43. ]
44. },
45. {
46. "id": "9f57edf.3a8841",
47. "type": "debug",
48. "z": "a6c49432.25d5b8",
49. "name": "Debug: Output tags",
50. "active": true,
51. "tosidebar": true,
52. "console": false,
53. "tostatus": false,
54. "complete": "payload",
55. "x": 530,
56. "y": 100,
57. "wires": []
58. },
59. {
60. "id": "160fe741.ab7209",
61. "type": "comment",
62. "z": "a6c49432.25d5b8",
63. "name": "Supply the tag search text to use in the 'Set search text' node ",
64. "info": "",
65. "x": 260,
66. "y": 40,
67. "wires": []
68. }
69. ]

Display More

Display More

mcafee added a new solution:

Quote

Prerequisites

• The OpenDXL and McAfee ePolicy Orchestrator (ePO) DXL modules have been added to the Node-RED palette.
• A DXL client has been configured in Node-RED (see Client Configuration).
• An ePO DXL service is running and available on the DXL fabric. If version 5.0 or later of the DXL ePO extensions are installed on your ePO server, an ePO DXL service should already be running on the fabric. If you are using an earlier version of the DXL ePO extensions, you can use the ePO DXL Python Service.
• The Node-RED DXL client is authorized to invoke the ePO DXL service, and the user that is connecting to the ePO server (within the ePO DXL service) has permission to execute the "system.find" remote command (see Client Authorization).

Here is the Node-RED flow content for this solution:

Code

1. [
2. {
3. "id": "c73cd652.3f9f08",
4. "type": "tab",
5. "label": "ePO System Find Example",
6. "disabled": false,
7. "info": "This sample invokes and displays the results of a `system.find` remote command\r\nvia the ePO DXL service. The results of the find command are displayed on the\r\nNode-RED `debug` tab.\r\n\r\n### Prerequisites\r\n\r\n* The samples configuration step has been completed (see\r\n [Client Configuration](https://opendxl.github.io/node-red-contrib-dxl/jsdoc/tutorial-configuration.html)).\r\n* A ePO DXL service is running and available on the DXL fabric. If version 5.0\r\n or later of the DXL ePO extensions are installed on your ePO server, an ePO\r\n DXL service should already be running on the fabric. If you are using an\r\n earlier version of the DXL ePO extensions, you can use the\r\n [ePO DXL Python Service](https://github.com/opendxl/opendxl-epo-service-python).\r\n* The DXL client associated with the `Find systems in ePO` node is\r\n authorized to invoke the ePO DXL service, and the user that is connecting to\r\n the ePO server (within the ePO DXL service) has permission to execute the\r\n `system.find` remote command (see\r\n [Client Authorization](https://opendxl.github.io/opendxl-epo-client-python/pydoc/authorization.html)).\r\n\r\n### Setup\r\n\r\n* If more than one ePO service is available on the DXL fabric that the DXL\r\n client is connecting to, edit the `Find systems in ePO` node and set the\r\n `ePO Id` property to that of the ePO service through which the remote command\r\n should be performed. By default, the `ePO Id` property is empty, in which case\r\n the client attempts to dynamically determine the id of the ePO service to\r\n communicate with.\r\n* Edit the `Specify search text` node and modify the `Payload` property with\r\n the search text to use for the system find command. For example:\r\n\r\n ```\r\n broker\r\n ```\r\n\r\n* To deploy the flow, press the `Deploy` button in the upper-right corner of the\r\n screen. If Node-RED is able to properly connect to the DXL fabric, a green dot\r\n with the word `connected` should appear under the `Find systems in ePO` node.\r\n\r\n### Running\r\n\r\nTo exercise the flow, double-click the button on the left side of the\r\n`Specify search text` node.\r\n\r\n### Output\r\n\r\nThe following output should appear in the Node-RED `debug` tab:\r\n\r\n```\r\n? [ object ]\r\n```\r\n\r\nAfter clicking on the right arrow button to expand the contents of the object,\r\noutput similar to the following should appear:\r\n\r\n```\r\n? array[1]\r\n ? 0: object\r\n EPOComputerProperties.ParentID: 2\r\n EPOComputerProperties.ComputerName\": \"mysystem\",\r\n EPOComputerProperties.Description\": null,\r\n...\r\n```\r\n\r\n### Details\r\n\r\nThe flow exercises the nodes below.\r\n\r\n#### Specify search text\r\n\r\nThis is an `inject` input node which starts the flow. This node injects a new\r\nmessage with a `payload` property which specifies the search text to use for the\r\nsystem find command.\r\n\r\n#### Set searchText request parameter\r\n\r\nThis is a `change` node which copies the value from the `payload` property on\r\nthe message to the `searchText` property. The `Find systems in ePO` node uses the `searchText` property when constructing\r\nthe parameters for the `system.find` remote command. \r\n\r\n#### Find systems in ePO\r\n\r\nThis is an `epo system find` node. This node connects to the DXL fabric and\r\nsends a DXL `Request` message to the ePO service. The message specifies the\r\ntarget remote command as `system.find`.\r\n\r\nThe request message also includes the `msg.searchText` property set by the\r\n`Set searchText request parameter` node.\r\n \r\nThe `Return` property is set to \"a parsed JSON object\" and the `Format` property\r\nis set to \"JSON\" to indicate that the payload for the response should be\r\nadded to the output message as a JavaScript object decoded from JSON.\r\n\r\n#### Output result\r\n\r\nThis is a `debug` output node. This node outputs the `payload` set on\r\nthe message by the `Find systems in ePO` node. The output should include\r\nthe response received from the DXL fabric for the `system.find` command."
8. },
9. {
10. "id": "1b9edb70.07a2d5",
11. "type": "inject",
12. "z": "c73cd652.3f9f08",
13. "name": "Specify search text",
14. "topic": "",
15. "payload": "<specify-search-text>",
16. "payloadType": "str",
17. "repeat": "",
18. "crontab": "",
19. "once": false,
20. "onceDelay": 0.1,
21. "x": 130,
22. "y": 100,
23. "wires": [
24. [
25. "cd9123b6.2492f"
26. ]
27. ]
28. },
29. {
30. "id": "af069888.ffe238",
31. "type": "debug",
32. "z": "c73cd652.3f9f08",
33. "name": "Debug: Output systems",
34. "active": true,
35. "tosidebar": true,
36. "console": false,
37. "tostatus": false,
38. "complete": "payload",
39. "x": 530,
40. "y": 300,
41. "wires": []
42. },
43. {
44. "id": "1b3a4932.b46f37",
45. "type": "dxl-epo-system-find",
46. "z": "c73cd652.3f9f08",
47. "name": "",
48. "client": "31714476.e2a4ec",
49. "searchNameOnly": "",
50. "epoUniqueId": "",
51. "returnType": "obj",
52. "x": 280,
53. "y": 300,
54. "wires": [
55. [
56. "af069888.ffe238"
57. ]
58. ]
59. },
60. {
61. "id": "cd9123b6.2492f",
62. "type": "change",
63. "z": "c73cd652.3f9f08",
64. "name": "Set searchText request parameter",
65. "rules": [
66. {
67. "t": "set",
68. "p": "searchText",
69. "pt": "msg",
70. "to": "payload",
71. "tot": "msg"
72. },
73. {
74. "t": "set",
75. "p": "searchNameOnly",
76. "pt": "msg",
77. "to": "false",
78. "tot": "bool"
79. }
80. ],
81. "action": "",
82. "property": "",
83. "from": "",
84. "to": "",
85. "reg": false,
86. "x": 260,
87. "y": 200,
88. "wires": [
89. [
90. "1b3a4932.b46f37"
91. ]
92. ]
93. },
94. {
95. "id": "70002f7e.8a701",
96. "type": "comment",
97. "z": "c73cd652.3f9f08",
98. "name": "Supply the system search text to use in the 'Set search text' node",
99. "info": "",
100. "x": 250,
101. "y": 40,
102. "wires": []
103. }
104. ]

Display More

mcafee added a new solution:

Quote

Prerequisites

• The OpenDXL and McAfee ePolicy Orchestrator (ePO) DXL modules have been added to the Node-RED palette.
• A DXL client has been configured in Node-RED (see Client Configuration).
• An ePO DXL service is running and available on the DXL fabric. If version 5.0 or later of the DXL ePO extensions are installed on your ePO server, an ePO DXL service should already be running on the fabric. If you are using an earlier version of the DXL ePO extensions, you can use the ePO DXL Python Service.
• The Node-RED DXL client is authorized to invoke the ePO DXL service, and the user that is connecting to the ePO server (within the ePO DXL service) has permission to execute the "DxlBrokerMgmt.createEpoThreatEvent" remote command (see Client Authorization).

Here is the Node-RED flow content for this solution:

Code

1. [
2. {
3. "id": "a1d1dbd.b4d6328",
4. "type": "tab",
5. "label": "ePO Create Threat Event Example",
6. "disabled": false,
7. "info": "This sample invokes and displays the results of a\n`DxlBrokerMgmt.createEpoThreatEvent` remote command via the ePO DXL service.\nThe results of the event creation command are displayed on the Node-RED `debug`\ntab.\n\n### Prerequisites\n\n* The samples configuration step has been completed (see\n [Client Configuration](https://opendxl.github.io/node-red-contrib-dxl/jsdoc/tutorial-configuration.html)).\n* A ePO DXL service is running and available on the DXL fabric. If version 5.0\n or later of the DXL ePO extensions are installed on your ePO server, an ePO\n DXL service should already be running on the fabric. If you are using an\n earlier version of the DXL ePO extensions, you can use the\n [ePO DXL Python Service](https://github.com/opendxl/opendxl-epo-service-python).\n* The DXL client associated with the `Create threat event in ePO` node is\n authorized to invoke the ePO DXL service, and the user that is connecting to\n the ePO server (within the ePO DXL service) has permission to execute the\n `DxlBrokerMgmt.createEpoThreatEvent` remote command (see\n [Client Authorization](https://opendxl.github.io/opendxl-epo-client-python/pydoc/authorization.html)).\n\n### Setup\n\n* If more than one ePO service is available on the DXL fabric that the DXL\n client is connecting to, edit the `Create threat event in ePO` node and set the\n `ePO Id` property to that of the ePO service through which the remote command\n should be performed. By default, the `ePO Id` property is empty, in which case\n the client attempts to dynamically determine the id of the ePO service to\n communicate with.\n* Edit the `Set threat event parameters` node and modify the `msg.ip4Address`\n and `msg.agentGuid` properties with the value of an IPv4 address and McAfee\n agent GUID for the threat event to be created. Note that the value for the\n `msg.agentGuid` property must be that of a valid McAfee agent previously seen\n by the ePO server in order for the event to be created properly.\n* Modify the content in the `Format full ePO threat event` template node with\n appropriate information for the type of event to be created.\n* To deploy the flow, press the `Deploy` button in the upper-right corner of the\n screen. If Node-RED is able to properly connect to the DXL fabric, a green dot\n with the word `connected` should appear under the `Create threat event in ePO`\n node.\n\n### Running\n\nTo exercise the flow, double-click the button on the left side of the\n`Inject current timestamp` node.\n\n### Output\n\nAn entry similar to the following should appear in the `debug` tab for the\n`Output event` node:\n\n```\n? { eventMsgType: \"McAfee Common Event\", eventMsgVersion: \"1.0\", event: object }\n```\n\nAfter clicking on the right arrow button to expand the contents of the object,\noutput similar to the following should appear:\n\n```\n? object\n eventMsgType: \"McAfee Common Event\"\n eventMsgVersion: \"1.0\"\n ? event: object\n category: \"This is the event category\"\n ...\n ? source: object\n ipv4: \"10.0.0.254\"\n...\n```\n\nOn successful creation of an event, a message similar to the following should\nappear in the `debug` tab for the `Output result` node:\n\n```\n\"Successfully created new ePO Threat Event for AgentGuid:'12345678-9012-3456-7890-12345678ABCD'\"\n```\n\n### Details\n\nThe flow exercises the nodes below.\n\n#### Inject current timestamp\n\nThis is an `inject` input node which starts the flow. This node injects a new\nmessage with a `payload` property which specifies the current system timestamp\n(as a numeric value representing milliseconds since January 1, 1970).\n\n#### Set threat event parameters\n\nThis is a `change` node which sets values for the `ipv4Address` and `agentGuid`\nproperties on the message. The `Format full ePO threat event` template node\nuses these values when formatting the content of the full threat event payload.\n\n#### Get current date as ISO string\n\nThis is a `function` node which uses the value from the timestamp `payload`\ninjected by the `Inject current timestamp` node to set a `currentDate` message\nproperty with the timestamp value formatted as an ISO string. The\n`Format full ePO threat event` template node uses this value when formatting the\ncontent of the full threat event payload.\n\n#### Format full ePO threat event\n\nThis is a `template` node which constructs the full threat event payload to\nsend to the ePO server. The node produces a payload which conforms to the\n\"McAfee Common Event\" format. The payload is stored as a JavaScript object to\nthe `event` property on the message.\n\n#### Output event\n\nThis is a `debug` output node. This node outputs the contents of the `event`\nproperty set on the message by the `Format full ePO threat event` node.\n\n#### Create threat event in ePO\n\nThis is an `epo threat event create` node. This node connects to the DXL fabric\nand sends a DXL `Request` message to the ePO service. The message specifies the\ntarget remote command as `DxlBrokerMgmt.createEpoThreatEvent`.\n\nThe request message also includes the `msg.event` property set by the\n`Format full ePO threat event` node.\n \nThe `Return` property is set to \"a parsed JSON object\" and the `Format` property\nis set to \"JSON\" to indicate that the payload for the response should be\nadded to the output message as a JavaScript object decoded from JSON.\n\n#### Output result\n\nThis is a `debug` output node. This node outputs the `payload` set on\nthe message by the `Create threat event in ePO` node. The output should include\nthe response received from the DXL fabric for the\n`DxlBrokerMgmt.createEpoThreatEvent` command."
8. },
9. {
10. "id": "23fb9acf.4763a6",
11. "type": "template",
12. "z": "a1d1dbd.b4d6328",
13. "name": "Format full ePO threat event",
14. "field": "event",
15. "fieldType": "msg",
16. "format": "handlebars",
17. "syntax": "mustache",
18. "template": "{\n \"eventMsgType\": \"McAfee Common Event\",\n \"eventMsgVersion\": \"1.0\",\n \"event\": {\n \"category\": \"This is the event category\",\n \"eventDesc\": \"This is the event description\",\n \"threatActionTaken\": \"blocked\",\n \"threatHandled\": 1,\n \"threatName\": \"This is the threat name\",\n \"threatSeverity\": 1,\n \"threatType\": \"This is the threat type\",\n \"analyzer\": {\n \"detectionMethod\": \"This is the detection method\",\n \"detectedUTC\": \"{{currentDate}}\",\n \"id\": \"MY_ANALYZER_0123\",\n \"name\": \"My Analyzer\",\n \"version\": \"1.2.3\"\n },\n \"entity\": { \n \"id\": \"{{agentGuid}}\" \n },\n \"source\": {\n \"ipv4\": \"{{ipv4Address}}\",\n \"mac\": \"\"\n },\n \"target\": {\n\t \"ipv4\": \"{{ipv4Address}}\",\n\t \"mac\": \"\",\n\t \"port\": 0\n\t}\n }\n}",
19. "output": "json",
20. "x": 200,
21. "y": 300,
22. "wires": [
23. [
24. "efa60b16.e2a988",
25. "6c3dd002.9d8a9"
26. ]
27. ]
28. },
29. {
30. "id": "bb9f7043.5406f",
31. "type": "inject",
32. "z": "a1d1dbd.b4d6328",
33. "name": "Inject current timestamp",
34. "topic": "",
35. "payload": "",
36. "payloadType": "date",
37. "repeat": "",
38. "crontab": "",
39. "once": false,
40. "onceDelay": 0.1,
41. "x": 140,
42. "y": 40,
43. "wires": [
44. [
45. "f75fccdd.1b9"
46. ]
47. ]
48. },
49. {
50. "id": "923d51f6.723f2",
51. "type": "comment",
52. "z": "a1d1dbd.b4d6328",
53. "name": "Set the IP address and agent GUID for the event",
54. "info": "",
55. "x": 560,
56. "y": 120,
57. "wires": []
58. },
59. {
60. "id": "efa60b16.e2a988",
61. "type": "dxl-epo-threat-event-create",
62. "z": "a1d1dbd.b4d6328",
63. "name": "",
64. "client": "24599b64.76f314",
65. "searchNameOnly": "",
66. "epoUniqueId": "",
67. "returnType": "obj",
68. "x": 200,
69. "y": 400,
70. "wires": [
71. [
72. "79ea3d97.2b4104"
73. ]
74. ]
75. },
76. {
77. "id": "79ea3d97.2b4104",
78. "type": "debug",
79. "z": "a1d1dbd.b4d6328",
80. "name": "Debug: Output result",
81. "active": true,
82. "tosidebar": true,
83. "console": false,
84. "tostatus": false,
85. "complete": "payload",
86. "x": 520,
87. "y": 400,
88. "wires": []
89. },
90. {
91. "id": "f75fccdd.1b9",
92. "type": "change",
93. "z": "a1d1dbd.b4d6328",
94. "name": "Set threat event parameters",
95. "rules": [
96. {
97. "t": "set",
98. "p": "ipv4Address",
99. "pt": "msg",
100. "to": "10.0.0.254",
101. "tot": "str"
102. },
103. {
104. "t": "set",
105. "p": "agentGuid",
106. "pt": "msg",
107. "to": "12345678-9012-3456-7890-12345678ABCD",
108. "tot": "str"
109. }
110. ],
111. "action": "",
112. "property": "",
113. "from": "",
114. "to": "",
115. "reg": false,
116. "x": 200,
117. "y": 120,
118. "wires": [
119. [
120. "d0c6a116.28a89"
121. ]
122. ]
123. },
124. {
125. "id": "d0c6a116.28a89",
126. "type": "function",
127. "z": "a1d1dbd.b4d6328",
128. "name": "Get current date as ISO string",
129. "func": "msg.currentDate = new Date(msg.payload).toISOString()\nreturn msg",
130. "outputs": 1,
131. "noerr": 0,
132. "x": 210,
133. "y": 200,
134. "wires": [
135. [
136. "23fb9acf.4763a6"
137. ]
138. ]
139. },
140. {
141. "id": "41f9ada8.9dbb34",
142. "type": "comment",
143. "z": "a1d1dbd.b4d6328",
144. "name": "Fill in event details (e.g., data for a host intrusion detection)",
145. "info": "",
146. "x": 590,
147. "y": 300,
148. "wires": []
149. },
150. {
151. "id": "6c3dd002.9d8a9",
152. "type": "debug",
153. "z": "a1d1dbd.b4d6328",
154. "name": "Debug: Output event",
155. "active": true,
156. "tosidebar": true,
157. "console": false,
158. "tostatus": false,
159. "complete": "event",
160. "x": 520,
161. "y": 240,
162. "wires": []
163. }
164. ]

Display More

mcafee added a new solution:

Quote

Prerequisites

• The OpenDXL and McAfee Threat Intelligence Exchange (TIE) DXL modules have been added to the Node-RED palette.
• A DXL client has been configured in Node-RED (see Client Configuration).
• A TIE server is installed and available on the DXL fabric.

Here is the Node-RED flow content for this solution:

Code

1. [
2. {
3. "id": "e6aa430b.c2db4",
4. "type": "tab",
5. "label": "TIE Get Certificate Reputation Example",
6. "disabled": false,
7. "info": "This sample invokes the TIE DXL service to retrieve the reputation of a\r\ncertificate (as identified by hashes). The response to the TIE request is\r\nprinted to the Node-RED `debug` tab.\r\n\r\n### Prerequisites\r\n\r\n* The samples configuration step has been completed (see\r\n [Client Configuration](https://opendxl.github.io/node-red-contrib-dxl/jsdoc/tutorial-configuration.html)).\r\n* A TIE service is available on the DXL fabric.\r\n\r\n### Setup\r\n\r\n* Edit the `Specify hash request parameters` node and modify the `msg.sha1`\r\n rule with the hash of the certificate and the `msg.publicKeySha1` rule with\r\n the hash of the public key that you want to use for the lookup. Note that\r\n the `msg.publicKeySha1` property is optional so this value can be set to an\r\n empty string or the property may be removed entirely if the public key is\r\n not known.\r\n\r\n* To deploy the flow, press the `Deploy` button in the upper-right corner of the\r\n screen. If Node-RED is able to properly connect to the DXL fabric, a green dot\r\n with the word `connected` should appear under the\r\n `Get reputation from TIE` node.\r\n\r\n### Running\r\n\r\nTo exercise the flow, double-click the button on the left side of the \r\n`Start flow` node.\r\n\r\n### Output\r\n\r\nThe output in the Node-RED `debug` tab should appear similar to the following:\r\n\r\n```\r\n? { 2: object, 4: object }\r\n```\r\n\r\nClick on the right arrow buttons to expand the contents of the object. The\r\ncontent should look similar to the following:\r\n\r\n```\r\n? object\r\n ? 2: object\r\n ? attributes: object\r\n 2108821: \"94\"\r\n 2109077: \"1454912619\"\r\n 2117524: \"0\"\r\n 2120596: \"0\"\r\n createDate: 1476318514\r\n providerId: 2\r\n trustLevel: 99\r\n ? 4: object\r\n ? attributes: object\r\n 2109333: \"12\"\r\n 2109589: \"1476318514\"\r\n 2139285: \"7318349394477075\r\n createDate: 1476318514\r\n providerId: 4\r\n trustLevel: 0\r\n```\r\n\r\nThe `key` for each entry in the object corresponds to a particular `provider` of\r\nthe associated `reputation`. The list of certificate reputation providers can\r\nbe found in the\r\n[CertProvider documentation](https://opendxl.github.io/opendxl-tie-client-javascript/jsdoc/module-CertProvider.html)\r\nin the TIE JavaScript client SDK.\r\n\r\nThe McAfee Global Threat Intelligence (GTI) service is identified in the results\r\nas `providerId: 2`. The trust level associated with the GTI response\r\n(`trustLevel: 99`) indicates that the certificate is known good.\r\n\r\nSee the \r\n[TrustLevel documentation](https://opendxl.github.io/opendxl-tie-client-javascript/jsdoc/module-TrustLevel.html)\r\nin the TIE JavaScript client SDK for the list of standard trust levels.\r\n\r\n### Details\r\n\r\nThe flow exercises the nodes below.\r\n\r\n#### Start flow\r\n\r\nThis is an `inject` input node which starts the flow.\r\n\r\n#### Set hash request parameters\r\n\r\nThis is a `change` node which sets the hash of the certificate to the\r\n`msg.sha1` property and the hash of the associated public key to the\r\n`msg.publicKeySha1` property. The `Get reputation from TIE` node uses the\r\n`sha1` and `publicKeySha1` properties when constructing the parameters for the\r\nTIE first references request. \r\n\r\n#### Get reputation from TIE\r\n\r\nThis is a `tie get certificate reputation` node. This node connects to\r\nthe DXL fabric and sends a DXL `Request` message to the TIE service to lookup\r\ncertificate reputation information.\r\n\r\nThe request message also includes the `sha1` and `publicKeySha1` properties set\r\nby the `Set hash request parameters` node.\r\n\r\nThe `Return` property is set to \"a parsed JSON object\" to indicate that the\r\npayload for the response should be added to the output message as a JavaScript\r\nobject decoded from JSON.\r\n\r\n#### Output first references\r\n\r\nThis is a `debug` output node. This node outputs the `payload` set on\r\nthe message by the `Get reputation from TIE` node. The output should\r\ninclude information for reputation data for the certificate."
8. },
9. {
10. "id": "a148f5e2.763d88",
11. "type": "dxl-tie-get-certificate-reputation",
12. "z": "e6aa430b.c2db4",
13. "name": "Get reputation from TIE",
14. "client": "2ed0ce07.039942",
15. "returnType": "obj",
16. "x": 330,
17. "y": 200,
18. "wires": [
19. [
20. "14798663.f923fa"
21. ]
22. ]
23. },
24. {
25. "id": "14798663.f923fa",
26. "type": "debug",
27. "z": "e6aa430b.c2db4",
28. "name": "Debug: Output reputation",
29. "active": true,
30. "tosidebar": true,
31. "console": false,
32. "tostatus": false,
33. "complete": "payload",
34. "x": 590,
35. "y": 200,
36. "wires": []
37. },
38. {
39. "id": "caeea8f4.abe3c8",
40. "type": "inject",
41. "z": "e6aa430b.c2db4",
42. "name": "Start flow",
43. "topic": "",
44. "payload": "",
45. "payloadType": "str",
46. "repeat": "",
47. "crontab": "",
48. "once": false,
49. "onceDelay": 0.1,
50. "x": 100,
51. "y": 40,
52. "wires": [
53. [
54. "44a5cb23.7a8ad4"
55. ]
56. ]
57. },
58. {
59. "id": "44a5cb23.7a8ad4",
60. "type": "change",
61. "z": "e6aa430b.c2db4",
62. "name": "Set hash request parameters",
63. "rules": [
64. {
65. "t": "set",
66. "p": "sha1",
67. "pt": "msg",
68. "to": "6eae26db8c13182a7947982991b4321732cc3de2",
69. "tot": "str"
70. },
71. {
72. "t": "set",
73. "p": "publicKeySha1",
74. "pt": "msg",
75. "to": "3b87a2d6f39770160364b79a152fcc73bae27adf",
76. "tot": "str"
77. }
78. ],
79. "action": "",
80. "property": "",
81. "from": "",
82. "to": "",
83. "reg": false,
84. "x": 240,
85. "y": 120,
86. "wires": [
87. [
88. "a148f5e2.763d88"
89. ]
90. ]
91. },
92. {
93. "id": "5aaa4a15.cfe6b4",
94. "type": "comment",
95. "z": "e6aa430b.c2db4",
96. "name": "Supply the cert hashes in the 'Specify hash request parameters' node",
97. "info": "",
98. "x": 460,
99. "y": 60,
100. "wires": []
101. },
102. {
103. "id": "2ed0ce07.039942",
104. "type": "dxl-client",
105. "z": "",
106. "configFile": "/data/dxl/dxlclient.config",
107. "name": "",
108. "keepAliveInterval": "1800",
109. "reconnectDelay": "1"
110. }
111. ]

Display More

mcafee added a new solution:

Quote

Prerequisites

• The OpenDXL and McAfee Threat Intelligence Exchange (TIE) DXL modules have been added to the Node-RED palette.
• A DXL client has been configured in Node-RED (see Client Configuration).
• A TIE server is installed and available on the DXL fabric.

Here is the Node-RED flow content for this solution:

Code

1. [
2. {
3. "id": "39707d18.0f97d2",
4. "type": "tab",
5. "label": "TIE Get File Reputation Example",
6. "disabled": false,
7. "info": "This sample invokes the TIE DXL service to retrieve the reputation of a file (as\r\nidentified by hashes). The response to the TIE request is printed to the\r\nNode-RED `debug` tab.\r\n\r\n### Prerequisites\r\n\r\n* The samples configuration step has been completed (see\r\n [Client Configuration](https://opendxl.github.io/node-red-contrib-dxl/jsdoc/tutorial-configuration.html)).\r\n* A TIE service is available on the DXL fabric.\r\n\r\n### Setup\r\n\r\n* To deploy the flow, press the `Deploy` button in the upper-right corner of the\r\n screen. If Node-RED is able to properly connect to the DXL fabric, a green dot\r\n with the word `connected` should appear under the `Get reputation from TIE`\r\n node.\r\n\r\n### Running\r\n\r\nTo exercise the flow for the \"notepad.exe\" file, double-click the button on the\r\nleft side of the `Start Notepad.exe lookup flow` node.\r\n\r\nTo exercise the flow for the \"EICAR Standard Anti-Virus Test File\" file,\r\ndouble-click the button on the left side of the `Start EICAR lookup flow` node.\r\n\r\n### Output\r\n\r\nThe output in the Node-RED `debug` tab after the flow is run for the\r\n`notepad.exe` file should appear similar to the following:\r\n\r\n```\r\n? { 1: object, 3: object }\r\n```\r\n\r\nClick on the right arrow buttons to expand the contents of the object. The\r\ncontent should look similar to the following:\r\n\r\n```\r\n? object\r\n ? 1: object\r\n ? attributes: object\r\n 2120340: \"2139160704\"\r\n createDate: 1451502875\r\n providerId: 1\r\n trustLevel: 99\r\n ? 3: object\r\n ? attributes: object\r\n 2101652: \"17\"\r\n 2102165: \"1451502875\"\r\n 2111893: \"21\"\r\n 2114965: \"0\"\r\n 2139285: \"72339069014638857\"\r\n createDate: 1526675921\r\n providerId: 3\r\n trustLevel: 99\r\n```\r\n\r\nThe `key` for each entry in the object corresponds to a particular `provider` of\r\nthe associated `reputation`. The list of file reputation providers can\r\nbe found in the\r\n[FileProvider documentation](https://opendxl.github.io/opendxl-tie-client-javascript/jsdoc/module-FileProvider.html)\r\nin the TIE JavaScript client SDK.\r\n\r\nThe McAfee Global Threat Intelligence (GTI) service is identified in the results\r\nas `providerId: 1`. The trust level associated with the GTI response\r\n(`trustLevel: 99`) indicates that the file is known good.\r\n\r\nThe output in the Node-RED `debug` tab after the flow is run for the `EICAR`\r\nfile should also appear similar to the following:\r\n\r\n```\r\n? { 1: object, 3: object }\r\n```\r\n\r\nClick on the right arrow buttons to expand the contents of the object. The\r\ncontent should look similar to the following:\r\n\r\n```\r\n? object\r\n ? 1: object\r\n ? attributes: object\r\n 2120340: \"2139162632\"\r\n createDate: 1451504331\r\n providerId: 1\r\n trustLevel: 1\r\n ? 3: object\r\n ? attributes: object\r\n 2101652: \"11\"\r\n 2102165: \"1451504331\"\r\n 2111893: \"22\"\r\n 2114965: \"0\"\r\n 2139285: \"72339069014638857\"\r\n createDate: 1451504331\r\n providerId: 3\r\n trustLevel: 0\r\n```\r\n\r\nThe trust level associated with the GTI response (`trustLevel: 1`) indicates\r\nthat the file is known bad.\r\n\r\nSee the \r\n[TrustLevel documentation](https://opendxl.github.io/opendxl-tie-client-javascript/jsdoc/module-TrustLevel.html)\r\nin the TIE JavaScript client SDK for the list of standard trust levels.\r\n\r\n### Details\r\n\r\nThe flow exercises the nodes below.\r\n\r\n#### Start lookup flow\r\n\r\nThese are `inject` input nodes which start the flow.\r\n\r\n#### Set hashes request parameter\r\n\r\nThese are `change` nodes which set values for different hash types &mdash;\r\n`md5`, `sha1`, and `sha256` &mdash; onto an object which is stored to the\r\n`hashes` property on the message. The `Get reputation from TIE` node uses\r\nthe `hashes` property when constructing the parameters for the TIE reputation\r\nrequest. \r\n\r\n#### Get reputation from TIE\r\n\r\nThis is a `tie get file reputation` node. This node connects to\r\nthe DXL fabric and sends a DXL `Request` message to the TIE service to lookup\r\nfile reputation information.\r\n\r\nThe request message includes the `hashes` properties set by the\r\n`Set hashes request parameter` nodes.\r\n\r\nThe `Return` property is set to \"a parsed JSON object\" to indicate that the\r\npayload for the response should be added to the output message as a JavaScript\r\nobject decoded from JSON.\r\n\r\n#### Output reputation\r\n\r\nThis is a `debug` output node. This node outputs the `payload` set on\r\nthe message by the `Get reputation from TIE` node. The output should\r\ninclude information for reputation data for the file."
8. },
9. {
10. "id": "51a672e5.8eeacc",
11. "type": "dxl-tie-get-file-reputation",
12. "z": "39707d18.0f97d2",
13. "name": "Get reputation from TIE",
14. "client": "2ed0ce07.039942",
15. "returnType": "obj",
16. "x": 650,
17. "y": 200,
18. "wires": [
19. [
20. "5fba5195.75416"
21. ]
22. ]
23. },
24. {
25. "id": "5fba5195.75416",
26. "type": "debug",
27. "z": "39707d18.0f97d2",
28. "name": "Debug: Output reputation",
29. "active": true,
30. "tosidebar": true,
31. "console": false,
32. "tostatus": false,
33. "complete": "payload",
34. "x": 770,
35. "y": 300,
36. "wires": []
37. },
38. {
39. "id": "6f2b0eb8.3ccf1",
40. "type": "change",
41. "z": "39707d18.0f97d2",
42. "name": "Set hashes request parameter for Notepad.exe",
43. "rules": [
44. {
45. "t": "set",
46. "p": "hashes",
47. "pt": "msg",
48. "to": "payload",
49. "tot": "msg"
50. },
51. {
52. "t": "set",
53. "p": "hashes.md5",
54. "pt": "msg",
55. "to": "f2c7bb8acc97f92e987a2d4087d021b1",
56. "tot": "str"
57. },
58. {
59. "t": "set",
60. "p": "hashes.sha1",
61. "pt": "msg",
62. "to": "7eb0139d2175739b3ccb0d1110067820be6abd29",
63. "tot": "str"
64. },
65. {
66. "t": "set",
67. "p": "hashes.sha256",
68. "pt": "msg",
69. "to": "142e1d688ef0568370c37187fd9f2351d7ddeda574f8bfa9b0fa4ef42db85aa2",
70. "tot": "str"
71. }
72. ],
73. "action": "",
74. "property": "",
75. "from": "",
76. "to": "",
77. "reg": false,
78. "x": 300,
79. "y": 120,
80. "wires": [
81. [
82. "51a672e5.8eeacc"
83. ]
84. ]
85. },
86. {
87. "id": "373b1de9.ad69a2",
88. "type": "change",
89. "z": "39707d18.0f97d2",
90. "name": "Set hashes request parameter for EICAR",
91. "rules": [
92. {
93. "t": "set",
94. "p": "hashes",
95. "pt": "msg",
96. "to": "payload",
97. "tot": "msg"
98. },
99. {
100. "t": "set",
101. "p": "hashes.md5",
102. "pt": "msg",
103. "to": "44d88612fea8a8f36de82e1278abb02f",
104. "tot": "str"
105. },
106. {
107. "t": "set",
108. "p": "hashes.sha1",
109. "pt": "msg",
110. "to": "3395856ce81f2b7382dee72602f798b642f14140",
111. "tot": "str"
112. },
113. {
114. "t": "set",
115. "p": "hashes.sha256",
116. "pt": "msg",
117. "to": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",
118. "tot": "str"
119. }
120. ],
121. "action": "",
122. "property": "",
123. "from": "",
124. "to": "",
125. "reg": false,
126. "x": 280,
127. "y": 300,
128. "wires": [
129. [
130. "51a672e5.8eeacc"
131. ]
132. ]
133. },
134. {
135. "id": "b473334d.8f843",
136. "type": "inject",
137. "z": "39707d18.0f97d2",
138. "name": "Start Notepad.exe lookup flow",
139. "topic": "",
140. "payload": "{}",
141. "payloadType": "json",
142. "repeat": "",
143. "crontab": "",
144. "once": false,
145. "onceDelay": 0.1,
146. "x": 160,
147. "y": 40,
148. "wires": [
149. [
150. "6f2b0eb8.3ccf1"
151. ]
152. ]
153. },
154. {
155. "id": "2a870a65.7cfd26",
156. "type": "inject",
157. "z": "39707d18.0f97d2",
158. "name": "Start EICAR lookup flow",
159. "topic": "",
160. "payload": "{}",
161. "payloadType": "json",
162. "repeat": "",
163. "crontab": "",
164. "once": false,
165. "onceDelay": 0.1,
166. "x": 140,
167. "y": 200,
168. "wires": [
169. [
170. "373b1de9.ad69a2"
171. ]
172. ]
173. }
174. ]

Display More

mcafee added a new solution:

Quote

Prerequisites

• The OpenDXL and McAfee ePolicy Orchestrator (ePO) DXL modules have been added to the Node-RED palette.
• A DXL client has been configured in Node-RED (see Client Configuration).
• An ePO DXL service is running and available on the DXL fabric. If version 5.0 or later of the DXL ePO extensions are installed on your ePO server, an ePO DXL service should already be running on the fabric. If you are using an earlier version of the DXL ePO extensions, you can use the ePO DXL Python Service.
• The Node-RED DXL client is authorized to invoke the ePO DXL service, and the user that is connecting to the ePO server (within the ePO DXL service) has permission to execute the "system.clearTag" remote command (see Client Authorization).

Here is the Node-RED flow content for this solution:

Code

1. [
2. {
3. "id": "1723c736.e448e9",
4. "type": "tab",
5. "label": "ePO System Clear Tag Example",
6. "disabled": false,
7. "info": "This sample invokes and displays the results of a `system.clearTag` remote\r\ncommand via the ePO DXL service. The results of the clear command are displayed\r\non the Node-RED `debug` tab.\r\n\r\n### Prerequisites\r\n\r\n* The samples configuration step has been completed (see\r\n [Client Configuration](https://opendxl.github.io/node-red-contrib-dxl/jsdoc/tutorial-configuration.html)).\r\n* A ePO DXL service is running and available on the DXL fabric. If version 5.0\r\n or later of the DXL ePO extensions are installed on your ePO server, an ePO\r\n DXL service should already be running on the fabric. If you are using an\r\n earlier version of the DXL ePO extensions, you can use the\r\n [ePO DXL Python Service](https://github.com/opendxl/opendxl-epo-service-python).\r\n* The DXL client associated with the `Clear system tag from ePO` node is\r\n authorized to invoke the ePO DXL service, and the user that is connecting to\r\n the ePO server (within the ePO DXL service) has permission to execute the\r\n `system.clearTag` remote command (see\r\n [Client Authorization](https://opendxl.github.io/opendxl-epo-client-python/pydoc/authorization.html)).\r\n\r\n### Setup\r\n\r\n* If more than one ePO service is available on the DXL fabric that the DXL\r\n client is connecting to, edit the `Clear system tag from ePO` node and set the\r\n `ePO Id` property to that of the ePO service through which the remote command\r\n should be performed. By default, the `ePO Id` property is empty, in which case\r\n the client attempts to dynamically determine the id of the ePO service to\r\n communicate with.\r\n* Edit the `Specify systems to clear tag from` node and modify the `Payload`\r\n property with the name(s) of the system(s) to clear the tag from. System names\r\n should be separated by commas. For example:\r\n\r\n ```\r\n system1,system2\r\n ```\r\n\r\n* Edit the `Clear system tag from ePO` node and modify the `Tag name` property\r\n with the name of the tag to clear. For example:\r\n\r\n ```\r\n mytag1\r\n ```\r\n \r\n* To deploy the flow, press the `Deploy` button in the upper-right corner of the\r\n screen. If Node-RED is able to properly connect to the DXL fabric, a green dot\r\n with the word `connected` should appear under the `Clear system tag from ePO`\r\n node.\r\n\r\n### Running\r\n\r\nTo exercise the flow, double-click the button on the left side of the\r\n`Specify systems to clear tag from` node.\r\n\r\n### Output\r\n\r\nThe number of systems that the tag was cleared from should appear in the\r\nNode-RED `debug` tab. For example:\r\n\r\n```\r\n2\r\n```\r\n\r\n### Details\r\n\r\nThe flow exercises the nodes below.\r\n\r\n#### Specify systems to clear tag from\r\n\r\nThis is an `inject` input node which starts the flow. This node injects a new\r\nmessage with a `payload` property which specifies the name(s) of the system(s)\r\nto clear the tag from.\r\n\r\n#### Set names request parameter\r\n\r\nThis is a `change` node which copies the value from the `payload` property on\r\nthe message to the `names` property. The `Clear system tag from ePO` node uses the `names` property\r\nwhen constructing the parameters for the `system.clearTag` remote command. \r\n\r\n#### Apply system tag in ePO\r\n\r\nThis is an `epo system clear tag` node. This node connects to the DXL fabric and\r\nsends a DXL `Request` message to the ePO service. The message specifies the\r\ntarget remote command as `system.clearTag`.\r\n\r\nThe request message also includes the `msg.names` property set by the\r\n`Set names request parameter` node and the `tagName` set in the\r\n`Tag name` property.\r\n \r\nThe `Return` property is set to \"a parsed JSON object\" and the `Format` property\r\nis set to \"JSON\" to indicate that the payload for the response should be\r\nadded to the output message as a JavaScript object decoded from JSON.\r\n\r\n#### Output result\r\n\r\nThis is a `debug` output node. This node outputs the `payload` set on\r\nthe message by the `Clear system tag from ePO` node. The output should include\r\nthe response received from the DXL fabric for the `system.clearTag` command."
8. },
9. {
10. "id": "bd18c65a.273748",
11. "type": "inject",
12. "z": "1723c736.e448e9",
13. "name": "Specify systems to clear tag from",
14. "topic": "",
15. "payload": "<specify-systems-to-clear-tag-from>",
16. "payloadType": "str",
17. "repeat": "",
18. "crontab": "",
19. "once": false,
20. "onceDelay": 0.1,
21. "x": 170,
22. "y": 100,
23. "wires": [
24. [
25. "684fc5a6.d1373c"
26. ]
27. ]
28. },
29. {
30. "id": "a8237152.66ba2",
31. "type": "debug",
32. "z": "1723c736.e448e9",
33. "name": "Debug: Output result",
34. "active": true,
35. "tosidebar": true,
36. "console": false,
37. "tostatus": false,
38. "complete": "payload",
39. "x": 580,
40. "y": 300,
41. "wires": []
42. },
43. {
44. "id": "5c2cef1a.30518",
45. "type": "dxl-epo-system-clear-tag",
46. "z": "1723c736.e448e9",
47. "name": "",
48. "tagName": "<specify-tag-to-clear>",
49. "client": "2ed0ce07.039942",
50. "returnType": "obj",
51. "x": 320,
52. "y": 300,
53. "wires": [
54. [
55. "a8237152.66ba2"
56. ]
57. ]
58. },
59. {
60. "id": "684fc5a6.d1373c",
61. "type": "change",
62. "z": "1723c736.e448e9",
63. "name": "Set names request parameter",
64. "rules": [
65. {
66. "t": "set",
67. "p": "names",
68. "pt": "msg",
69. "to": "payload",
70. "tot": "msg"
71. }
72. ],
73. "action": "",
74. "property": "",
75. "from": "",
76. "to": "",
77. "reg": false,
78. "x": 250,
79. "y": 200,
80. "wires": [
81. [
82. "5c2cef1a.30518"
83. ]
84. ]
85. },
86. {
87. "id": "1b8a001f.ba618",
88. "type": "comment",
89. "z": "1723c736.e448e9",
90. "name": "Supply the list of systems to untag in the 'Set search text' node ",
91. "info": "",
92. "x": 240,
93. "y": 40,
94. "wires": []
95. },
96. {
97. "id": "6fa0ef7f.f3a96",
98. "type": "comment",
99. "z": "1723c736.e448e9",
100. "name": "Supply the tag name in the 'Clear system tag from ePO' node ",
101. "info": "",
102. "x": 400,
103. "y": 360,
104. "wires": []
105. }
106. ]

Display More

mcafee added a new solution:

Quote

Prerequisites

• The OpenDXL and McAfee ePolicy Orchestrator (ePO) DXL modules have been added to the Node-RED palette.
• A DXL client has been configured in Node-RED (see Client Configuration).
• An ePO DXL service is running and available on the DXL fabric. If version 5.0 or later of the DXL ePO extensions are installed on your ePO server, an ePO DXL service should already be running on the fabric. If you are using an earlier version of the DXL ePO extensions, you can use the ePO DXL Python Service.
• The Node-RED DXL client is authorized to invoke the ePO DXL service, and the user that is connecting to the ePO server (within the ePO DXL service) has permission to execute the "system.applyTag" remote command (see Client Authorization).

Here is the Node-RED flow content for this solution:

Code

1. [
2. {
3. "id": "3cab471f.fbdca8",
4. "type": "tab",
5. "label": "ePO System Apply Tag Example",
6. "disabled": false,
7. "info": "This sample invokes and displays the results of a `system.applyTag` remote\r\ncommand via the ePO DXL service. The results of the apply command are displayed\r\non the Node-RED `debug` tab.\r\n\r\n### Prerequisites\r\n\r\n* The samples configuration step has been completed (see\r\n [Client Configuration](https://opendxl.github.io/node-red-contrib-dxl/jsdoc/tutorial-configuration.html)).\r\n* A ePO DXL service is running and available on the DXL fabric. If version 5.0\r\n or later of the DXL ePO extensions are installed on your ePO server, an ePO\r\n DXL service should already be running on the fabric. If you are using an\r\n earlier version of the DXL ePO extensions, you can use the\r\n [ePO DXL Python Service](https://github.com/opendxl/opendxl-epo-service-python).\r\n* The DXL client associated with the `Apply system tag in ePO` node is\r\n authorized to invoke the ePO DXL service, and the user that is connecting to\r\n the ePO server (within the ePO DXL service) has permission to execute the\r\n `system.applyTag` remote command (see\r\n [Client Authorization](https://opendxl.github.io/opendxl-epo-client-python/pydoc/authorization.html)).\r\n\r\n### Setup\r\n\r\n* If more than one ePO service is available on the DXL fabric that the DXL\r\n client is connecting to, edit the `Apply system tag in ePO` node and set the\r\n `ePO Id` property to that of the ePO service through which the remote command\r\n should be performed. By default, the `ePO Id` property is empty, in which case\r\n the client attempts to dynamically determine the id of the ePO service to\r\n communicate with.\r\n* Edit the `Specify systems to tag` node and modify the `Payload` property with\r\n the name(s) of the system(s) to apply the tag to. System names should be\r\n separated by commas. For example:\r\n\r\n ```\r\n system1,system2\r\n ```\r\n\r\n* Edit the `Apply system tag in ePO` node and modify the `Tag name` property\r\n with the name of the tag to apply. For example:\r\n\r\n ```\r\n mytag1\r\n ```\r\n \r\n* To deploy the flow, press the `Deploy` button in the upper-right corner of the\r\n screen. If Node-RED is able to properly connect to the DXL fabric, a green dot\r\n with the word `connected` should appear under the `Apply system tag in ePO`\r\n node.\r\n\r\n### Running\r\n\r\nTo exercise the flow, double-click the button on the left side of the\r\n`Specify systems to tag` node.\r\n\r\n### Output\r\n\r\nThe number of systems that the tag was applied to should appear in the Node-RED\r\n`debug` tab. For example:\r\n\r\n```\r\n2\r\n```\r\n\r\n### Details\r\n\r\nThe flow exercises the nodes below.\r\n\r\n#### Specify systems to tag\r\n\r\nThis is an `inject` input node which starts the flow. This node injects a new\r\nmessage with a `payload` property which specifies the name(s) of the system(s)\r\nto apply the tag to.\r\n\r\n#### Set names request parameter\r\n\r\nThis is a `change` node which copies the value from the `payload` property on\r\nthe message to the `names` property. The `Apply system tag in ePO` node uses the `names` property when\r\nconstructing the parameters for the `system.applyTag` remote command. \r\n\r\n#### Apply system tag in ePO\r\n\r\nThis is an `epo system apply tag` node. This node connects to the DXL fabric and\r\nsends a DXL `Request` message to the ePO service. The message specifies the\r\ntarget remote command as `system.applyTag`.\r\n\r\nThe request message also includes the `msg.names` property set by the\r\n`Set names request parameter` node and the `tagName` set in the\r\n`Tag name` property.\r\n \r\nThe `Return` property is set to \"a parsed JSON object\" and the `Format` property\r\nis set to \"JSON\" to indicate that the payload for the response should be\r\nadded to the output message as a JavaScript object decoded from JSON.\r\n\r\n#### Output result\r\n\r\nThis is a `debug` output node. This node outputs the `payload` set on\r\nthe message by the `Apply system tag in ePO` node. The output should include\r\nthe response received from the DXL fabric for the `system.applyTag` command."
8. },
9. {
10. "id": "dfbc08fd.29a308",
11. "type": "inject",
12. "z": "3cab471f.fbdca8",
13. "name": "Specify systems to tag",
14. "topic": "",
15. "payload": "<specify-systems-to-tag>",
16. "payloadType": "str",
17. "repeat": "",
18. "crontab": "",
19. "once": false,
20. "onceDelay": 0.1,
21. "x": 140,
22. "y": 40,
23. "wires": [
24. [
25. "35c99ba3.eb1b44"
26. ]
27. ]
28. },
29. {
30. "id": "eebb5fc1.e8327",
31. "type": "debug",
32. "z": "3cab471f.fbdca8",
33. "name": "Debug: Output result",
34. "active": true,
35. "tosidebar": true,
36. "console": false,
37. "tostatus": false,
38. "complete": "payload",
39. "x": 560,
40. "y": 220,
41. "wires": []
42. },
43. {
44. "id": "d0651085.b90f3",
45. "type": "dxl-epo-system-apply-tag",
46. "z": "3cab471f.fbdca8",
47. "name": "",
48. "tagName": "<specify-tag-to-apply>",
49. "client": "2ed0ce07.039942",
50. "epoUniqueId": "",
51. "returnType": "obj",
52. "x": 290,
53. "y": 220,
54. "wires": [
55. [
56. "eebb5fc1.e8327"
57. ]
58. ]
59. },
60. {
61. "id": "35c99ba3.eb1b44",
62. "type": "change",
63. "z": "3cab471f.fbdca8",
64. "name": "Set names request parameter",
65. "rules": [
66. {
67. "t": "set",
68. "p": "names",
69. "pt": "msg",
70. "to": "payload",
71. "tot": "msg"
72. }
73. ],
74. "action": "",
75. "property": "",
76. "from": "",
77. "to": "",
78. "reg": false,
79. "x": 230,
80. "y": 120,
81. "wires": [
82. [
83. "d0651085.b90f3"
84. ]
85. ]
86. },
87. {
88. "id": "91c0d2cd.6c4a1",
89. "type": "comment",
90. "z": "3cab471f.fbdca8",
91. "name": "Supply the list of systems to tag in the 'Set search text' node ",
92. "info": "",
93. "x": 540,
94. "y": 40,
95. "wires": []
96. },
97. {
98. "id": "5ccd91fd.367b5",
99. "type": "comment",
100. "z": "3cab471f.fbdca8",
101. "name": "Supply the tag name in the 'Apply system tag in ePO' node ",
102. "info": "",
103. "x": 370,
104. "y": 280,
105. "wires": []
106. }
107. ]

Display More

mcafee added a new version:

Quote

McAfee ePolicy Orchestrator (ePO) DXL Node-RED Client Nodes 0.1.1 Release

• Added threat event creation node
• Updated samples

mcafee added a new solution:

Quote

Prerequisites

• The OpenDXL and McAfee ePolicy Orchestrator (ePO) DXL modules have been added to the Node-RED palette.
• A DXL client has been configured in Node-RED (see Client Configuration).
• An ePO DXL service is running and available on the DXL fabric. If version 5.0 or later of the DXL ePO extensions are installed on your ePO server, an ePO DXL service should already be running on the fabric. If you are using an earlier version of the DXL ePO extensions, you can use the ePO DXL Python Service.
• The Node-RED DXL client is authorized to receive "ePO Threat Event Automatic Response Events" (see Client Authorization).
• Under the "Automatic Responses" page on the ePO server, ensure that a "Send Threat Event via DXL" response is set to "Enabled".

Here is the Node-RED flow content for this solution:

Code

1. [
2. {
3. "id": "ed863b5.ec467c8",
4. "type": "tab",
5. "label": "ePO Receive Threat Event Example",
6. "disabled": false,
7. "info": "This sample registers with the DXL fabric to receive threat event notifications\r\nfrom ePO via the ePO DXL service. The payload in the event message received from\r\nthe DXL fabric is printed to the Node-RED `debug` tab.\r\n\r\n### Prerequisites\r\n\r\n* The samples configuration step has been completed (see\r\n [Client Configuration](https://opendxl.github.io/node-red-contrib-dxl/jsdoc/tutorial-configuration.html)).\r\n* The client is authorized to receive \"ePO Threat Event Automatic Response Events\"\r\n (see [Client Authorization](https://opendxl.github.io/opendxl-epo-service-python/pydoc/authorization.html#client-authorization)).\r\n* Under the `Automatic Responses` page on the ePO server, ensure that a\r\n `Send Threat Event via DXL` response is set to `Enabled`.\r\n\r\n### Setup\r\n\r\n* To deploy the flow, press the `Deploy` button in the upper-right corner of the\r\n screen. If Node-RED is able to properly connect to the DXL fabric, a green dot\r\n with the word `connected` should appear under the `Receive ePO threat event`\r\n node.\r\n* By default, the `Topic` configured for the `Send Threat Event via DXL`\r\n automatic response on the ePO server is set to\r\n \"/mcafee/event/epo/threat/response\". If you have changed this to a different \r\n value, edit the `Receive ePO threat event` node and set the value for\r\n the `Topic` property to be the same as the `Topic` value used for the automatic\r\n response on the ePO server.\r\n\r\n### Output\r\n\r\nWhen an ePO threat event is received, the following output should appear in the\r\nNode-RED `debug` tab:\r\n\r\n```\r\n? [ object ]\r\n```\r\n\r\nClick on the right arrow button to expand the contents of the object. The\r\ncontent may be similar to the following:\r\n\r\n```\r\n? object\r\n eventMsgVersion: \"1.0\"\r\n eventMsgType: \"McAfee Common Event\"\r\n ? event: object\r\n category: \"(This is the event category)\"\r\n ...\r\n ? source: object\r\n ipv4: \"10.0.0.254\"\r\n...\r\n```\r\n\r\n### Details\r\n\r\nThe flow exercises the nodes below.\r\n\r\n#### Receive ePO threat event\r\n\r\nThis is an `epo threat event` input node which starts the flow. This node\r\ninjects a new message with a `payload` property which includes the information\r\nfrom the threat event.\r\n\r\n#### Output result\r\n\r\nThis is a `debug` output node. This node outputs the `payload` set on\r\nthe message by the `Receive ePO threat event` node."
8. },
9. {
10. "id": "8827ac7a.2d56d",
11. "type": "dxl-epo-threat-event in",
12. "z": "ed863b5.ec467c8",
13. "name": "Receive ePO threat event",
14. "topic": "",
15. "client": "2ed0ce07.039942",
16. "payloadType": "obj",
17. "x": 130,
18. "y": 40,
19. "wires": [
20. [
21. "1a5fa94b.5c5f27"
22. ]
23. ]
24. },
25. {
26. "id": "1a5fa94b.5c5f27",
27. "type": "debug",
28. "z": "ed863b5.ec467c8",
29. "name": "Debug: Output event payload",
30. "active": true,
31. "tosidebar": true,
32. "console": false,
33. "tostatus": false,
34. "complete": "payload",
35. "x": 400,
36. "y": 40,
37. "wires": []
38. }
39. ]

Display More

mcafee added a new solution:

Quote

Prerequisites

• The OpenDXL and McAfee Active Response (MAR) DXL modules have been added to the Node-RED palette.
• A DXL client has been configured in Node-RED (see Client Configuration).
• A MAR DXL service is running and available on the DXL fabric.
• The Node-RED DXL client is authorized to perform MAR search (see Authorize Client to Perform MAR Search).

Here is the Node-RED flow content for this solution:

Code

1. [
2. {
3. "id": "4d70f507.87bd5c",
4. "type": "tab",
5. "label": "MAR Basic Search Example",
6. "disabled": false,
7. "info": "This sample executes a `McAfee Active Response` search for the IP addresses of\r\nhosts that have an Active Response client installed. The IP addresses found are\r\ndisplayed on the Node-RED `debug` tab.\r\n\r\n### Prerequisites\r\n\r\n* The samples configuration step has been completed (see\r\n [Client Configuration](https://opendxl.github.io/node-red-contrib-dxl/jsdoc/tutorial-configuration.html)).\r\n* A McAfee Active Response (MAR) service is available on the DXL fabric.\r\n* The DXL client associated with the\r\n`Search MAR for hosts` node has been authorized to perform MAR searches\r\n (see [Authorize Client to Perform MAR Search](https://opendxl.github.io/opendxl-client-python/pydoc/marsendauth.html)).\r\n\r\n### Setup\r\n\r\nTo deploy the flow, press the `Deploy` button in the upper-right corner of the\r\n screen. If Node-RED is able to properly connect to the DXL fabric, a green dot\r\n with the word `connected` should appear under the `Search MAR for hosts` node.\r\n\r\n### Running\r\n\r\nTo exercise the flow, double-click the button on the left side of the\r\n`Specify search projections` node.\r\n\r\n### Output\r\n\r\nThe IP addresses found should appear in the Node-RED `debug` tab. For example:\r\n\r\n~~~\r\n[ \"192.168.130.152\", \"192.168.130.133\"]\r\n~~~\r\n\r\n### Details\r\n\r\nThe flow exercises the nodes below.\r\n\r\n#### Specify search projections\r\n\r\nThis is an `inject` input node which starts the flow. This node injects a new\r\nmessage with a `payload` property which specifies that the IP addresses of\r\nhosts which are found should be projected into the search results:\r\n\r\n```json\r\n[\r\n {\r\n \"name\": \"HostInfo\",\r\n \"outputs\": [\r\n \"ip_address\"\r\n ]\r\n }\r\n]\r\n```\r\n\r\n#### Set projections request parameter\r\n\r\nThis is a `change` node which copies the value from the `payload` property on\r\nthe message to the `projections` property. The `Search MAR for hosts` node uses\r\nthe `projections` property when constructing the parameters for the MAR search. \r\n\r\n#### Search MAR for hosts\r\n\r\nThis is a `mar search` node. This node connects to the DXL fabric and sends a\r\nsearch request to the MAR service using the `msg.projections` property set by\r\nthe `Set projections request parameter` node.\r\n\r\nThe `Limit` property specifies that up to the first \"10\" result items should be\r\nprovided.\r\n\r\nThe `Return` property is set to \"a parsed JSON object\" to indicate that the\r\n`payload` for the response should be added to the output message as a JavaScript\r\nobject decoded from JSON.\r\n\r\n#### Extract host IP addresses\r\n\r\nThis is a `function` node. This node includes a JavaScript code snippet which\r\niterates over the search result items that were set on the `msg.payload`\r\nproperty by the `Search MAR for hosts` node. The source code for the code\r\nsnippet is included below:\r\n\r\n```javascript\r\nmsg.payload = \r\n msg.payload.map(function (processEntry) {\r\n return processEntry.output[\"HostInfo|ip_address\"]\r\n })\r\nreturn msg\r\n```\r\n\r\nThe `HostInfo|ip_address` value for\r\neach item is captured. An array with just the ip addresses of the hosts which\r\nwere returned in the search results is set onto the `msg.payload` property.\r\n\r\n#### Output IP addresses\r\n\r\nThis is a `debug` output node. This node outputs the array of host IP addresses\r\nwritten to the `msg.payload` property by the `Extract host IP addresses` node."
8. },
9. {
10. "id": "e18fdc9e.6feae",
11. "type": "dxl-mar-search",
12. "z": "4d70f507.87bd5c",
13. "name": "Search MAR for hosts",
14. "pollInterval": 5,
15. "client": "2ed0ce07.039942",
16. "projections": "",
17. "limit": "10",
18. "textFilter": "",
19. "sortBy": "",
20. "sortDirection": "",
21. "returnType": "obj",
22. "x": 280,
23. "y": 220,
24. "wires": [
25. [
26. "be60e18f.08cfb"
27. ]
28. ]
29. },
30. {
31. "id": "340bdcc6.7f4904",
32. "type": "inject",
33. "z": "4d70f507.87bd5c",
34. "name": "Specify search projections",
35. "topic": "",
36. "payload": "[{\"name\":\"HostInfo\",\"outputs\":[\"ip_address\"]}]",
37. "payloadType": "json",
38. "repeat": "",
39. "crontab": "",
40. "once": false,
41. "onceDelay": 0.1,
42. "x": 150,
43. "y": 40,
44. "wires": [
45. [
46. "a2cb13bf.388be"
47. ]
48. ]
49. },
50. {
51. "id": "39e7184f.da87a8",
52. "type": "debug",
53. "z": "4d70f507.87bd5c",
54. "name": "Debug: Output IP addresses",
55. "active": true,
56. "tosidebar": true,
57. "console": false,
58. "tostatus": false,
59. "complete": "payload",
60. "x": 480,
61. "y": 420,
62. "wires": []
63. },
64. {
65. "id": "be60e18f.08cfb",
66. "type": "function",
67. "z": "4d70f507.87bd5c",
68. "name": "Extract host IP addresses",
69. "func": "msg.payload = \n msg.payload.map(function (processEntry) {\n return processEntry.output[\"HostInfo|ip_address\"]\n })\nreturn msg",
70. "outputs": 1,
71. "noerr": 0,
72. "x": 390,
73. "y": 320,
74. "wires": [
75. [
76. "39e7184f.da87a8"
77. ]
78. ]
79. },
80. {
81. "id": "a2cb13bf.388be",
82. "type": "change",
83. "z": "4d70f507.87bd5c",
84. "name": "Set projections request parameter",
85. "rules": [
86. {
87. "t": "set",
88. "p": "projections",
89. "pt": "msg",
90. "to": "payload",
91. "tot": "msg"
92. }
93. ],
94. "action": "",
95. "property": "",
96. "from": "",
97. "to": "",
98. "reg": false,
99. "x": 260,
100. "y": 120,
101. "wires": [
102. [
103. "e18fdc9e.6feae"
104. ]
105. ]
106. }
107. ]

Display More

mcafee added a new solution:

Quote

Prerequisites

• The OpenDXL and McAfee Active Response (MAR) DXL modules have been added to the Node-RED palette.
• A DXL client has been configured in Node-RED (see Client Configuration).
• A MAR DXL service is running and available on the DXL fabric.
• The Node-RED DXL client is authorized to perform MAR search (see Authorize Client to Perform MAR Search).

opendxl.com/index.php?attachment/79/

Here is the Node-RED flow content for this solution:

Code

1. [
2. {
3. "id": "15c35c35.087ac4",
4. "type": "tab",
5. "label": "MAR Basic Paging Example",
6. "disabled": false,
7. "info": "This sample executes a `McAfee Active Response` search for the running processes\r\non a particular endpoint as specified by its IP address. The names of the\r\nprocesses found are retrieved and captured one page (up to 5 items) at a time.\r\nThe resulting process names captured across all pages are displayed on the\r\nNode-RED `debug` tab.\r\n\r\n### Prerequisites\r\n\r\n* The samples configuration step has been completed (see\r\n [Client Configuration](https://opendxl.github.io/node-red-contrib-dxl/jsdoc/tutorial-configuration.html)).\r\n* A McAfee Active Response (MAR) service is available on the DXL fabric.\r\n* The DXL client associated with the\r\n`Search MAR for host` node has been authorized to perform MAR searches\r\n (see [Authorize Client to Perform MAR Search](https://opendxl.github.io/opendxl-client-python/pydoc/marsendauth.html)).\r\n\r\n### Setup\r\n\r\n* Edit the `Specify host to find` node and modify the `Payload` property with\r\n the IP address of a host to retrieve the process list from. For example:\r\n\r\n ```\r\n 192.168.1.1\r\n ```\r\n\r\n* To deploy the flow, press the `Deploy` button in the upper-right corner of the\r\n screen. If Node-RED is able to properly connect to the DXL fabric, a green dot\r\n with the word `connected` should appear under the `Search MAR for host` node.\r\n\r\n### Running\r\n\r\nTo exercise the flow, double-click the button on the left side of the\r\n`Specify host to find` node.\r\n\r\n### Output\r\n\r\nOutput similar to the following should appear in the Node-RED `debug` tab:\r\n\r\n```\r\n? [ array[5], array[5], array[5] ]\r\n```\r\n\r\nAfter clicking on the right arrow buttons to expand the contents of the array,\r\noutput similar to the following should appear:\r\n\r\n```\r\n? array[3]\r\n ? 0: array[5]\r\n 0: \"MARService.exe\"\r\n 1: \"OneDrive.exe\"\r\n 2: \"RuntimeBroker.exe\"\r\n 3: \"SearchIndexer.exe\"\r\n 4: \"SearchUI.exe\"\r\n ? 1: array[5]\r\n 0: \"ShellExperienceHost.exe\"\r\n 1: \"SkypeHost.exe\"\r\n 2: \"System\"\r\n 3: \"UpdaterUI.exe\"\r\n 4: \"VGAuthService.exe\"\r\n ? 2: array[5]\r\n 0: \"WUDFHost.exe\"\r\n 1: \"WmiApSrv.exe\"\r\n 2: \"WmiPrvSE.exe\"\r\n 3: \"WmiPrvSE.exe\"\r\n 4: \"[System Process]\"\r\n...\r\n```\r\n\r\n### Details\r\n\r\nThe flow exercises the nodes below.\r\n\r\n#### Specify host to find\r\n\r\nThis is an `inject` input node which starts the flow. This node injects a new\r\nmessage with a `payload` property which specifies the IP address of host to\r\nfind.\r\n\r\n#### Set search conditions\r\n\r\nThis is a `template` node which formats the IP address supplied on the\r\n`msg.payload` property by the `Specify host to find` node into the\r\n`conditions` property on the output message. The `Search MAR for host` node\r\nuses the `conditions` property when constructing the parameters for MAR\r\nsearch. \r\n\r\nThe JSON-formatted mustache template has the following:\r\n\r\n```json\r\n{\r\n \"or\": [{\r\n \"and\": [{\r\n \"name\": \"HostInfo\",\r\n \"output\": \"ip_address\",\r\n \"op\": \"EQUALS\",\r\n \"value\": \"{{payload}}\"\r\n }]\r\n }]\r\n}\r\n```\r\n\r\nIf the `payload` property on the input message, for example, were set to\r\n`192.168.1.1`, the resulting JavaScript object stored to the `conditions`\r\nproperty on the output message would be:\r\n\r\n```javascript\r\n{\r\n or: [{\r\n and: [{\r\n name: 'HostInfo',\r\n output: 'ip_address',\r\n op: 'EQUALS',\r\n value\": '192.168.1.1'\r\n }]\r\n }]\r\n}\r\n```\r\n\r\n#### Search MAR for host\r\n\r\nThis is a `mar search` node. This node connects to the DXL fabric and sends a\r\nsearch request to the MAR service to collect process information from a\r\nparticular system (as specified by the IP address in the `msg.conditions`\r\nproperty set by the `Set search conditions` node).\r\n\r\nThe JSON-formatted document provided for `Projections` property specifies that\r\n`Processes` for the target host should be returned:\r\n\r\n```json\r\n[\r\n {\r\n \"name\": \"Processes\"\r\n }\r\n]\r\n```\r\n\r\nThe `Limit` property specifies that up to the next \"5\" result items should be\r\nprovided per `page` of search results. This node is revisited repeatedly by the\r\n`More results available?` node until all of the result items available\r\nfor the search have been retrieved.\r\n\r\nThe `Sort by` and `Sort` properties, respectively, specify that the search\r\nresults should be sorted by the \"Processes|name\" field in \"Ascending\" order.\r\n\r\nThe `Return` property is set to \"a parsed JSON object\" to indicate that the\r\n`payload` for the response should be added to the output message as a JavaScript\r\nobject decoded from JSON.\r\n\r\n#### Extract process names\r\n\r\nThis is a `function` node. This node includes a JavaScript code snippet which\r\niterates over the search result items that were set on the `msg.payload`\r\nproperty by the `Search MAR for hosts` node. The source code for the code\r\nsnippet is included below:\r\n\r\n```javascript\r\nif (!msg.processes) {\r\n msg.processes = []\r\n}\r\n\r\nmsg.processes.push(\r\n msg.payload.map(function (processEntry) {\r\n return processEntry.output[\"Processes|name\"]\r\n })\r\n)\r\n\r\nreturn msg\r\n```\r\n\r\nAn array is assigned to the `processes` property in the message. Each element\r\nin the array contains an sub-array with the names of processes returned for\r\nthe previous page. New elements are appended to the array each time this node\r\nis revisited to capture a page of search results.\r\n\r\nFor example, the contents of the `processes` property after the first time this\r\nnode is visited within a flow might contain:\r\n\r\n```javascript\r\n[[\"MARService.exe\",\r\n \"OneDrive.exe\",\r\n \"RuntimeBroker.exe\",\r\n \"SearchIndexer.exe\", \r\n \"SearchUI.exe\"]]\r\n```\r\n\r\nAfter the second time this node is visited for a flow, the `processes` property\r\nmight contain:\r\n\r\n```javascript\r\n[[\"MARService.exe\",\r\n \"OneDrive.exe\",\r\n \"RuntimeBroker.exe\",\r\n \"SearchIndexer.exe\", \r\n \"SearchUI.exe\"],\r\n [\"ShellExperienceHost.exe\",\r\n \"SkypeHost.exe\",\r\n \"System\",\r\n \"UpdaterUI.exe\",\r\n \"VGAuthService.exe\"]]\r\n```\r\n\r\n#### More results available?\r\n\r\nThis is a `switch` node. This node routes the input message to a different\r\nnode based on the value of the `hasMoreItems` property.\r\n\r\nIf the value of `hasMoreItems` is `true`, additional items are available to be\r\nretrieved from the MAR server for the current search. In this case, the input\r\nmessage is routed back to the `Search MAR for host` node. When the\r\n`Search MAR for host` node is revisited, the next page of search results is\r\nobtained from the MAR server and forwarded along to the `Extract process names`\r\nnode.\r\n\r\nIf the value of `hasMoreItems` is `false`, no additional items are available\r\nto be retrieved from the MAR server for the current search. In this case, the\r\ninput message is routed to the `Output process names` node.\r\n\r\n#### Output process names\r\n\r\nThis is a `debug` output node. This node outputs the array of process names\r\nwritten by the `Extract process names` node to the `msg.processes` property\r\nfor each page of search results returned from the MAR server."
8. },
9. {
10. "id": "3fbfd464.d3a6cc",
11. "type": "inject",
12. "z": "15c35c35.087ac4",
13. "name": "Specify host to find",
14. "topic": "",
15. "payload": "<specify-host-ip-address>",
16. "payloadType": "str",
17. "repeat": "",
18. "crontab": "",
19. "once": false,
20. "onceDelay": 0.1,
21. "x": 130,
22. "y": 100,
23. "wires": [
24. [
25. "32c7d68f.2ed0ca"
26. ]
27. ]
28. },
29. {
30. "id": "53c77ace.c1e504",
31. "type": "switch",
32. "z": "15c35c35.087ac4",
33. "name": "More results available?",
34. "property": "hasMoreItems",
35. "propertyType": "msg",
36. "rules": [
37. {
38. "t": "true"
39. },
40. {
41. "t": "false"
42. }
43. ],
44. "checkall": "true",
45. "repair": false,
46. "outputs": 2,
47. "x": 190,
48. "y": 400,
49. "wires": [
50. [
51. "b6e234bf.312e78"
52. ],
53. [
54. "cd7c5168.252d9"
55. ]
56. ]
57. },
58. {
59. "id": "cd7c5168.252d9",
60. "type": "debug",
61. "z": "15c35c35.087ac4",
62. "name": "Debug: Output process names",
63. "active": true,
64. "tosidebar": true,
65. "console": false,
66. "tostatus": false,
67. "complete": "processes",
68. "x": 490,
69. "y": 400,
70. "wires": []
71. },
72. {
73. "id": "2a2240df.31f3b",
74. "type": "function",
75. "z": "15c35c35.087ac4",
76. "name": "Extract process names",
77. "func": "if (!msg.processes) {\n msg.processes = []\n}\n\nmsg.processes.push(\n msg.payload.map(function (processEntry) {\n return processEntry.output[\"Processes|name\"]\n })\n)\n\nreturn msg",
78. "outputs": 1,
79. "noerr": 0,
80. "x": 480,
81. "y": 280,
82. "wires": [
83. [
84. "53c77ace.c1e504"
85. ]
86. ]
87. },
88. {
89. "id": "b6e234bf.312e78",
90. "type": "dxl-mar-search",
91. "z": "15c35c35.087ac4",
92. "name": "Search MAR for host",
93. "pollInterval": 5,
94. "client": "42926d46.783374",
95. "projections": "[\n {\n \"name\": \"Processes\"\n }\n]",
96. "limit": "5",
97. "textFilter": "",
98. "sortBy": "Processes|name",
99. "sortDirection": "asc",
100. "returnType": "obj",
101. "x": 440,
102. "y": 180,
103. "wires": [
104. [
105. "2a2240df.31f3b"
106. ]
107. ]
108. },
109. {
110. "id": "32c7d68f.2ed0ca",
111. "type": "template",
112. "z": "15c35c35.087ac4",
113. "name": "Set search conditions",
114. "field": "conditions",
115. "fieldType": "msg",
116. "format": "json",
117. "syntax": "mustache",
118. "template": "{\n \"or\": [{\n \"and\": [{\n \"name\": \"HostInfo\",\n \"output\": \"ip_address\",\n \"op\": \"EQUALS\",\n \"value\": \"{{payload}}\"\n }]\n }]\n}",
119. "output": "json",
120. "x": 200,
121. "y": 180,
122. "wires": [
123. [
124. "b6e234bf.312e78"
125. ]
126. ]
127. },
128. {
129. "id": "c271164f.62d8b8",
130. "type": "comment",
131. "z": "15c35c35.087ac4",
132. "name": "Supply the IP address of the host to find in the 'Specify host to find' node",
133. "info": "",
134. "x": 270,
135. "y": 40,
136. "wires": []
137. }
138. ]

Display More

Display More

mcafee added a new version:

Quote

McAfee ePolicy Orchestrator (ePO) DXL Python Client Library 0.2.2 Release

• Combine commands and remote service ids together during lookup

mcafee added a new solution:

Quote

Overview

The McAfee Active Response (MAR) DXL Node-RED client package enables the development of flows in Node-RED which perform MAR searches via the Data Exchange Layer (DXL) fabric.

Documentation

See the Wiki for an overview of the McAfee Active Response (MAR) DXL Node-RED client package and examples.

See the McAfee Active Response (MAR) DXL Node-RED Client Documentation for installation instructions, API documentation, and examples.

mcafee added a new solution:

Quote

Overview

The McAfee Active Response (MAR) DXL JavaScript client library provides a high level wrapper for the MAR Data Exchange Layer (DXL) API.

The purpose of this library is to allow users to perform MAR searches without having to focus on lower-level details such as MAR-specific DXL topics and message formats.

Documentation

See the Wiki for an overview of the McAfee Active Response (MAR) DXL JavaScript client library and examples.

See the McAfee Active Response (MAR) DXL JavaScript Client Library Documentation for installation instructions, API documentation, and examples.

Display More

mcafee added a new solution:

Quote

Overview

The McAfee Threat Intelligence Exchange (TIE) DXL Node-RED client package enables the development of flows in Node-REDwhich use TIE features (manage reputations, determine where a file has executed, etc.) via the Data Exchange Layer (DXL) fabric.

Documentation

See the Wiki for an overview of the McAfee Threat Intelligence Exchange (TIE) DXL Node-RED client package and examples.

See the McAfee Threat Intelligence Exchange (TIE) DXL Node-RED Client Documentation for installation instructions, API documentation, and examples.

mcafee added a new solution:

Quote

Overview

The McAfee Threat Intelligence Exchange (TIE) DXL JavaScript client library provides a high level wrapper for the TIE Data Exchange Layer (DXL) API.

The purpose of this library is to allow users to access the features of TIE (manage reputations, determine where a file has executed, etc.) without having to focus on lower-level details such as TIE-specific DXL topics and message formats.

Documentation

See the Wiki for an overview of the McAfee Threat Intelligence (TIE) DXL JavaScript client library and examples.

See the McAfee Threat Intelligence (TIE) DXL JavaScript Client Library Documentation for installation instructions, API documentation, and examples.

Display More

mcafee added a new solution:

Quote

Overview

The Cisco pxGrid DXL Node-RED client package enables the development of flows in Node-RED which communicate with Cisco pxGrid via the Data Exchange Layer (DXL) fabric.

Documentation

See the Wiki for an overview of the Cisco pxGrid DXL Node-RED client package and examples.

See the Cisco pxGrid DXL Node-RED Client Documentation for installation instructions, API documentation, and examples.

Display More