Skip to content

Instantly share code, notes, and snippets.

View chrissmith-mcafee's full-sized avatar

Chris Smith chrissmith-mcafee

View GitHub Profile
@chrissmith-mcafee
chrissmith-mcafee / mar-basic-search-example.json
Created October 3, 2018 23:03
This Node-RED flow executes a `McAfee Active Response` search for the IP addresses of hosts that have an Active Response client installed.
[
{
"id": "4d70f507.87bd5c",
"type": "tab",
"label": "MAR Basic Search Example",
"disabled": false,
"info": "This sample executes a `McAfee Active Response` search for the IP addresses of\r\nhosts that have an Active Response client installed. The IP addresses found are\r\ndisplayed on the Node-RED `debug` tab.\r\n\r\n### Prerequisites\r\n\r\n* The samples configuration step has been completed (see\r\n [Client Configuration](https://opendxl.github.io/node-red-contrib-dxl/jsdoc/tutorial-configuration.html)).\r\n* A McAfee Active Response (MAR) service is available on the DXL fabric.\r\n* The DXL client associated with the\r\n`Search MAR for hosts` node has been authorized to perform MAR searches\r\n (see [Authorize Client to Perform MAR Search](https://opendxl.github.io/opendxl-client-python/pydoc/marsendauth.html)).\r\n\r\n### Setup\r\n\r\nTo deploy the flow, press the `Deploy` button in the upper-right corner of the\r\n screen. If Node-RED is able to properly co
@chrissmith-mcafee
chrissmith-mcafee / mar-basic-paging-example.json
Created October 3, 2018 22:44
This Node-RED flow executes a `McAfee Active Response` search for the running processes on a particular endpoint as specified by its IP address. The names of the processes found are retrieved and captured one page (up to 5 items) at a time.
[
{
"id": "15c35c35.087ac4",
"type": "tab",
"label": "MAR Basic Paging Example",
"disabled": false,
"info": "This sample executes a `McAfee Active Response` search for the running processes\r\non a particular endpoint as specified by its IP address. The names of the\r\nprocesses found are retrieved and captured one page (up to 5 items) at a time.\r\nThe resulting process names captured across all pages are displayed on the\r\nNode-RED `debug` tab.\r\n\r\n### Prerequisites\r\n\r\n* The samples configuration step has been completed (see\r\n [Client Configuration](https://opendxl.github.io/node-red-contrib-dxl/jsdoc/tutorial-configuration.html)).\r\n* A McAfee Active Response (MAR) service is available on the DXL fabric.\r\n* The DXL client associated with the\r\n`Search MAR for host` node has been authorized to perform MAR searches\r\n (see [Authorize Client to Perform MAR Search](https://opendxl.github.io/opendxl-client-python/pydoc/marsendauth.html)).\r\n\r\n### S
@chrissmith-mcafee
chrissmith-mcafee / gist:f0f118cbe87a6ff8ac7590c33848705e
Created May 17, 2018 22:52
Tag System in ePO when Cisco ISE Policy Applied
[
{
"id": "3fdb538d.d675ac",
"type": "tab",
"label": "Tag System when ISE Policy Applied",
"disabled": false,
"info": ""
},
{
"id": "9f34056c.e12c6",
@chrissmith-mcafee
chrissmith-mcafee / gist:962ac3456842c88610c97e5129b1b9f2
Last active May 17, 2018 22:47
Persist ePO Threat Events in Elasticsearch
[
{
"id": "7b37e26c.74758c",
"type": "tab",
"label": "Persist ePO Threat Events in Elasticsearch",
"disabled": false,
"info": ""
},
{
"id": "42926814.22ae18",