Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The Trellix TIE operation provides Get and Set actions against a TIE-configured server. 

• The Get action queries the configured  TIE server for any threat information for the indicator in question.
• The Set action sets the Enterprise Threat Level of the indicator in question on the Trellix TIE server.

The operation provides the following actions:

• Query Reputation - queries a Trellix TIE server for additional attributes relevant to certain indicators.
• Set Reputation - sets the Enterprise reputation for an indicator.

The operation is compatible with the following indicator types:

• MD5
• SHA-1
• SHA-256

Prerequisites

The integration requires the following:

• ePO hostname or IP Address, ePO username and ePO Password.

• The OpenDXL Python client used by this integration must have permission to send messages to the /mcafee/service/tie/file/reputation/set topic which is part of the TIE Server Set Enterprise Reputation authorization group. Run the Query Reputation action to generate the ePO managed certificates. Then log into Trellix ePO console to authorize the generated credentials.

  The following page provides an example of authorizing a Python client to send messages to an authorization group. While the example is based on McAfee Active Response (MAR), the instructions are the same with the exception of swapping the TIE Server Set Enterprise Reputation authorization group in place of Active Response Server API:

  https://opendxl.github.io/opendxl-client-python/pydoc/marsendauth.html

  Additionally, all prerequisites from the following link should be fulfilled:

  https://opendxl.github.io/opendxl-tie-client-python/pydoc/basicsetreputationexample.html#prerequisites

Installation

Perform the following steps to install the integration:

The same steps can be used to upgrade the integration to a new version.

1. Log into https://marketplace.threatq.com/.
2. Locate and download the integration .whl file.
3. Navigate to the integrations management page on your ThreatQ instance.
4. Click on the Add New Integration button.
5. Upload the .whl file using one of the following methods:
   • Drag and drop the file into the dialog box
   • Select Click to Browse to locate the file on your local machine

   ThreatQ will inform you if the operation already exists on the platform and will require user confirmation before proceeding. ThreatQ will also inform you if the new version of the operation contains changes to the user configuration. The new user configurations will overwrite the existing ones for the operation and will require user confirmation before proceeding.

The operation is now installed and will be displayed in the ThreatQ UI. You will still need to configure and then enable the operation.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Operation option from the Type dropdown (optional).
3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   PO IP	The IP Address of the Trellix EPO server.
   EPO Login	Your EPO login.
   EPO Password	Your EPO password.
   EPO Port	Optional - If left empty, the default port, 8443, will be used.

5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

Actions

The operation provides the following actions:

{
  "1": {
    "trustLevel": 1,
    "createDate": 1742561512,
    "attributes": {
      "2120340": "2134902792"
    },
    "providerId": 1
  },
  "3": {
    "trustLevel": 50,
    "createDate": 1742561512,
    "attributes": {
      "2101652": "0",
      "2114965": "0",
      "2098277": "0",
      "2139285": "289919230306943286",
      "2111893": "1",
      "2123156": "0",
      "2102165": "1742561512"
    },
    "providerId": 3
  }
}

Change Log

• Version 1.3.0
  • Updated integration name from McAfee TIE Operation to Trellix TIE Operation.
  • Updated the minimum ThreatQ version to 6.7.3.
• Version 1.2.0
  • Automatic certificate regeneration will now only be performed if credentials are changed.  
• Version 1.1.0
  • Fixed a Reputation bug.
  • Added Set Reputation Known Trusted Installer action.  
  • Attribute names synced with McAfee TIE Reputation Change integration.  
• Version 1.0.1
  • Updated dependancies.  
• Version 1.0.0
  • Initial Release