Active Response and air-gap enviroment

[Blue88]

Hello,

Is it possible to use Active Response or just the MAR search without connecting to the McAfee cloud?

Can I update the Tie Reputation db manually in order to see my cases in the Active Response Search in an air-gap environment (no internet connection)?

Thanks in advance!

[bbarnes]

Hello Blue88Report, 

Registration of Active Response and operating the product in a way that will not generate any UI errors does require active cloud connectivity.  MAR search is a feature that does NOT leverage the cloud, it is primarily used instead to store threat and telemetry data. 

I am not sure I understand your follow up question:

"Can I update the Tie Reputation db manually in order to see my cases in the Active Response Search in an air-gap environment (no internet connection)?"

Active response UI can be used to issue reputation overrides with TIE server. However, that functionality is only available when viewing MAR threats (the cloud connected UI). I am not sure that answers your questions, if you could perhaps clarify I can try to get you a better answer.

Thanks 

Brian Barnes

[Blue88]

Hello Brian,

Thanks for the reply!

I'm updating the Tie Reputation manually using the "file override" option. Will it correspond with the Active Repose search in case of any hits?

Thanks in advance!

[bbarnes · Accepted solution]

Hello, 

I do not believe so. ENS ATP is the primary endpoint product that will consume TIE reputation. The MAR search capabilities are limited to the information the collectors you call actually collect. I am afraid none of the collectors pull an inventory of TIE reputations into the search results. 

The threats area (the part requiring cloud connectivity) does perform this lookup for any acknowledged potential threats. However, it does not do it for ALL files. 

I hope this information helps!

Brian