Changing reputations with Trellix ePO - On-prem Web API

Use the remote command provided by the Threat Intelligence Exchange server to automate reputation overrides of files and certificates using Trellix ePO - On-prem Web API.

We recommend that you enable an external reputation provider configuring OpenDXL and visualizing the reputation score on TIE Reputations page.

Tip

Best practice: Periodically reconcile the overrides against other reputations and remove those reputations that are already covered for maintaining the adaptive capabilities. You can see the TIE Server Override dashboard that shows redundant and conflicting overrides.

Threat Intelligence Exchange server includes the tie.setReputations command. Use the core.help command to see details about syntax and options. Data passed to the Web API calls must be URL-encoded.

JSON strings represent files and certificates with the Base64 hashes encoded and reputation scores.

Note

You need a minimum one hash value present and Base64 values have to be URL escaped.

The command syntax is tie.setReputations [fileReps] [certReps]. You must specify at least one fileReps or one certReps. Both can be provided in the same payload call.

See example of JSON string of file reputations. You need a minimum one hash value present. The optional parameters are name and comment.

fileReps =[{"sha1"."frATnSF1c5s8yw0REAZ4IL5qvSk=","md5":"
8se7isyX+S6Yei1Ah9AhsQ==","sha256":"39Gv4ExOzWr5SMNMrObQJ3A3SSSzEoz2MFi4X8YNAVQ=","reputation":"99"}
{"sha1":"d3HtjhR0Eb3qN6c+vVxeqVVe0t4=","md5":"V+0uApv5yjk4PSpnHvT7UA==","reputation":"85"}]

You need one attribute, minimum. The others are optional. For example, you can have a SHA-1 hash value only.

Tip

Best practice: Use as many hash types as possible for a given file because integrating products might not honor all.

See example of JSON string of certificate reputations:

certReps = [{"sha1":"frATnSF1c5s8yw0REAZ4IL5qvSk=","publicKeySha1":"
frATnSF1c5s8yw0REAZ4IL5qvSk=","reputation":"99"}] 

The attributes SHA-1 and reputation are mandatory. publicKeySha1 is required.

For details about using this API, see Trellix ePolicy Orchestrator - On-premises Web Scripting Guide or the online Help forTrellix ePO - On-prem.