McAfee QUICKCLEAN 1.0 Instrukcja Użytkownika Pobierz pdf (Strona 19)

Example import file

<?xml version="1.0" encoding="UTF-8"?>

<FileName>HackIt.exe</FileName>

<MD5Hash>0xDEF30CBEA881149C2AFFDF9A059FB751</MD5Hash>

</FileReputation>

<FileName>trayMan.dll</FileName>

<Comment>Comment for ALTTAB</Comment>

</FileReputation>

<FileName>cabinet.dll</FileName>

<MD5Hash>0xDEF30CBEA881149C2AFFDF9A059FB759</MD5Hash>

<Comment>Comment for cabinet.dll</Comment>

</FileReputation>

<Comment>Comment for PORTABLEDEVICEAPI</Comment>

</FileReputation>

<SHA1Hash>0xCAC3CB1EFE7FD53A9AC2C8825DACCC22EDFDFED7</SHA1Hash>

<MD5Hash>0xC693E642ACFBDD76433AF6BE3C3EEE6F</MD5Hash>

<Comment>Comment for PORTABLEDEVICECONNECTAPI</Comment>

</FileReputation>

</TIEReputations>

Change reputations using the McAfee ePO Web API

Use the McAfee ePO Web API to use scripts to change the default reputation for files and certificates.

Threat Intelligence Exchange includes the tie.setReputations command for use with the McAfee

ePO Web API. Use the core.help command to see details about syntax and options used with the

tie.setReputations command. Additional syntax includes:

tie.setReputations [fileReps] [certReps]

Json string for file and/or certificate reputation(s) with Base64 encoded hash

values.Atleast one of fileReps or certReps needs to be specified.Both can be

specified too.

Parameters:

fileReps (param 1) - Json string of file reputation(s). Ex

[{"sha1":"frATnSF1c5s8yw0REAZ4IL5qvSk=","md5":"8se7isyX+S6Yei1Ah9AhsQ==","reputation":"99"},

{"sha1":"d3HtjhR0Eb3qN6c+vVxeqVVe0t4=","md5":"V+0uApv5yjk4PSpnHvT7UA==","reputation":"99"}]

certReps (param 2) - Json string of certificate reputation(s). Ex

[{"sha1":"frATnSF1c5s8yw0REAZ4IL5qvSk=","publicKeySha1":"frATnSF1c5s8yw0REAZ4IL5qvSk=","reput

ation":"99"}]]

For details about using the Web API, see the McAfee ePO Web Scripting Guide.

Determine where a file ran in your environment

See which systems in your environment ran a particular file. You can see the system name and the

date the file first ran on that system.

Using Threat Intelligence Exchange

Determine where a file ran in your environment

2

McAfee Threat Intelligence Exchange 1.0.0 Product Guide

19

McAfee QUICKCLEAN 1.0 Instrukcja Użytkownika Strona 19

Komentarze do niniejszej Instrukcji

McAfee QUICKCLEAN 1.0 Instrukcja Użytkownika Strona 19

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Licencje / aktualizacje oprogramowania McAfee QUICKCLEAN 1.0