Fortinet Document Library

Version:


Table of Contents

1.0.0
Copy Link

About the connector

McAfee Open Data Exchange Layer (DXL) is an initiative to create adaptive systems of interconnected services that communicate and share information for real-time, accurate security decisions and actions.

This document provides information about the McAfee OpenDXL connector, which facilitates automated interactions with McAfee OpenDXL using FortiSOAR™ playbooks. Add the McAfee OpenDXL connector as a step in FortiSOAR™ playbooks and perform automated operations, such as sending a request and message to a topic on McAfee OpenDX based on which a response is received from McAfee OpenDXL.

Version information

Connector Version: 1.0.0

Authored By: Fortinet

Certified: No

Installing the connector

All connectors provided by FortiSOAR™ are delivered using a FortiSOAR™ repository. Therefore, you must set up your FortiSOAR™ repository and use the yum command to install connectors:

yum install cyops-connector-mcafee-open-dxl

For the detailed procedure to install a connector, click here

Prerequisites to configuring the connector

  • You must have the bundle file containing the broker CA certificates in the PEM format. You must also provide the client certificate key and the client private key in the PEM format.
  • You must also have the DXL message brokers that are available for connections on the fabric.
  • To access the FortiSOAR™ UI, ensure that port 443 is open through the firewall for the FortiSOAR™ instance.

Configuring the connector

For the procedure to configure a connector, click here

Configuration parameters

In FortiSOAR™, on the connectors page, select the McAfee OpenDXL connector and click Configure to configure the following parameters:

Parameter Description
Broker CA Bundle File Bundle file that contains the broker CA certificates in the PEM format.
Certificate PEM File Client certificate file in the PEM format
Private Key PEM File Client private key file in PEM format
Broker URLs (Semicolon Delimited) Semicolon (;) separated list of DXL message brokers that are available for connections on the fabric.

Actions supported by the connector

The following automated operations can be included in playbooks, and you can also use the annotations to access operations from FortiSOAR™ release 4.10.0 and onwards:

Function Description Annotation and Category
Publish Message to Topic Sends a request and message to a topic on McAfee OpenDXL, based on which a response is received from McAfee OpenDXL. publish_message
Miscellaneous

operation: Publish Message to Topic

Input parameters

Parameter Description
Topic DXL topic on McAfee OpenDXL to which you want to send the request.
Message Payload or message that you want to send to the specified DXL topic.

Output

The output contains the following populated JSON schema:
{
     "response": {}
}

Included playbooks

The Sample - McAfee-Open-DXL - 1.0.0 playbook collection comes bundled with the McAfee OpenDXL connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the McAfee OpenDXL connector.

  • Publish Message to Topic

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during connector upgrade and delete.

About the connector

McAfee Open Data Exchange Layer (DXL) is an initiative to create adaptive systems of interconnected services that communicate and share information for real-time, accurate security decisions and actions.

This document provides information about the McAfee OpenDXL connector, which facilitates automated interactions with McAfee OpenDXL using FortiSOAR™ playbooks. Add the McAfee OpenDXL connector as a step in FortiSOAR™ playbooks and perform automated operations, such as sending a request and message to a topic on McAfee OpenDX based on which a response is received from McAfee OpenDXL.

Version information

Connector Version: 1.0.0

Authored By: Fortinet

Certified: No

Installing the connector

All connectors provided by FortiSOAR™ are delivered using a FortiSOAR™ repository. Therefore, you must set up your FortiSOAR™ repository and use the yum command to install connectors:

yum install cyops-connector-mcafee-open-dxl

For the detailed procedure to install a connector, click here

Prerequisites to configuring the connector

Configuring the connector

For the procedure to configure a connector, click here

Configuration parameters

In FortiSOAR™, on the connectors page, select the McAfee OpenDXL connector and click Configure to configure the following parameters:

Parameter Description
Broker CA Bundle File Bundle file that contains the broker CA certificates in the PEM format.
Certificate PEM File Client certificate file in the PEM format
Private Key PEM File Client private key file in PEM format
Broker URLs (Semicolon Delimited) Semicolon (;) separated list of DXL message brokers that are available for connections on the fabric.

Actions supported by the connector

The following automated operations can be included in playbooks, and you can also use the annotations to access operations from FortiSOAR™ release 4.10.0 and onwards:

Function Description Annotation and Category
Publish Message to Topic Sends a request and message to a topic on McAfee OpenDXL, based on which a response is received from McAfee OpenDXL. publish_message
Miscellaneous

operation: Publish Message to Topic

Input parameters

Parameter Description
Topic DXL topic on McAfee OpenDXL to which you want to send the request.
Message Payload or message that you want to send to the specified DXL topic.

Output

The output contains the following populated JSON schema:
{
     "response": {}
}

Included playbooks

The Sample - McAfee-Open-DXL - 1.0.0 playbook collection comes bundled with the McAfee OpenDXL connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the McAfee OpenDXL connector.

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during connector upgrade and delete.