Trellix TIE Reputation Change Connector

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

Time Zone

The time zone steps are for ThreatQ v5 only.  ThreatQ v6 users should skip these steps.  

You should ensure all ThreatQ devices are set to the correct time, time zone, and date (UTC is recommended), and using a clock source available to all.

To identify which time zone is closest to your present location, use the timedatectl command with the list-timezones command line option.

For example, enter the following command to list all available time zones in Europe:

Enter the following command, as root, to change the time zone to UTC:

1. Download the connector integration file from the ThreatQ Marketplace.  
2. Transfer the connector whl file to the /tmp/ directory on your instance.
3. SSH into your instance.
4. Move the connector whl file from its /tmp/ location to the following directory: /opt/tqvenv
5. Navigate to the custom connector container:
   kubectl exec -n threatq -it deployments/custom-connectors -- /bin/bash

   Copy Code

6. Create your python 3 virtual environment:
   python3.6 -m venv /opt/tqvenv/<environment_name>

   Copy Code

7. Active the new environment:
   source /opt/tqvenv/<environment_name>/bin/activate

   Copy Code

8. Run the pip upgrade command:
   pip install --upgrade pip

   Copy Code

9. Install the required dependencies:
   pip install threatqsdk threatqcc setuptools==59.6.0

   Copy Code

10. Install the connector:
    pip install /opt/tqvenv/tq_conn_trellix_tie_reputation_change-<version>-py3-none-any.whl

    Copy Code

11. Perform an initial run of the connector:
    /opt/tqvenv/<environment_name>/bin/tq_conn_trellix_tie_reputation_change

    Copy Code

12. Enter the following parameters when prompted:

    Parameter	Description
    ThreatQ Host	Leave this field blank as it will be set dynamically.
    ThreatQ Client ID	This is the OAuth id that can be found at Settings Gear → User Management → API details within the user’s details.
    ThreatQ Username	This is the Email Address of the user in the ThreatQ System for integrations.
    ThreatQ Password	The password for the above ThreatQ account.
    Status	This is the default status for objects that are created by this Integration.

    Example Output

    /opt/tqvenv/<environment_name>/bin/tq-conn-trellix-tie-reputation-change
    ThreatQ Host:  
    ThreatQ Client ID: <ClientID> 
    ThreatQ Username: <EMAIL ADDRESS> 
    ThreatQ Password: <PASSWORD>
    Status: Review 
    Connector configured. Set information in UI

You will still need to configure and then enable the connector. 

1. Navigate to the ThreatQ Marketplace and download the .whl file for the integration.
2. Create the following directory:
   mkdir /opt/tqvenv/

   Copy Code

3. Install python 3.6:
   sudo yum install -y python36 python36-libs python36-devel python36-pip

   Copy Code

4. Create a virtual environment:
   python3.6 -m venv /opt/tqvenv/<environment_name>

   Copy Code

5. Activate the virtual environment:
   source /opt/tqvenv/<environment_name>/bin/activate

   Copy Code

6. Run the pip upgrade command:
   pip install --upgrade pip

   Copy Code

7. Install the required dependencies: 
   pip install threatqsdk threatqcc setuptools==59.6.0

   Copy Code

8. Transfer the whl file to the /tmp directory on your ThreatQ instance.  
9. Install the connector on your ThreatQ instance:
   pip install /tmp/tq_conn_trellix_tie_reputation_change-<version>-py3-none-any.whl 

   Copy Code

   A driver called tq-conn-trellix-tie-reputation-change will be installed.   After installing, a script stub will appear in /opt/tqvenv/<environment_name>/bin/tq-conn-trellix-tie-reputation-change.

10. Once the application has been installed, a directory structure must be created for all configuration, logs and files, using the mkdir -p command. Use the commands below to create the required directories:
    mkdir -p /etc/tq_labs/ mkdir -p /var/log/tq_labs/

    Copy Code

11. Perform an initial run using the following command:
    /opt/tqvenv/<environment_name>/bin/tq-conn-trellix-tie-reputation-change -ll /var/log/tq_labs/ -c /etc/tq_labs/ -v3

    Copy Code

12. Enter the following parameters when prompted:

    Parameter	Description
    ThreatQ Host	This is the host of the ThreatQ instance, either the IP Address or Hostname as resolvable by ThreatQ.
    ThreatQ Client ID	This is the OAuth id that can be found at Settings Gear → User Management → API details within the user’s details.
    ThreatQ Username	This is the Email Address of the user in the ThreatQ System for integrations.
    ThreatQ Password	The password for the above ThreatQ account.
    Status	This is the default status for objects that are created by this Integration.

    Example Output

    /opt/tqvenv/<environment_name>/bin/tq-conn-trellix-tie-reputation-change -ll /var/log/tq_labs/ -c /etc/tq_labs/ -v3
    ThreatQ Host: <ThreatQ Host IP or Hostname> 
    ThreatQ Client ID: <ClientID> 
    ThreatQ Username: <EMAIL ADDRESS> 
    ThreatQ Password: <PASSWORD> 
    Status: Review
    Connector configured. Set information in UI

You will still need to configure and then enable the connector.

Copy Code

Copy Code

ThreatQ version 6 aggregates the logs for all custom connectors to its output container.  You can access the container's log using the following command:

Copy Code

The connector log directory was created in 10 of the installation process and is identified using the -ll argument flag when executing the driver.

The custom connector configuration file can be found in the following directory: /etc/tq_labs/.  

The custom connector configuration file was created in step 10 of the install process and identified using the -c argument flag when executing the driver. 

PDF Guides