cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Insert HASH SHA256 using OpenDXL

Hello,

Using OpenDXL I insert multiple hash SHA1 or MD5 one at a time.

But when I need to insert only SHA256, the process is taking 2sec instead of 0,1s like others HASH (SHA1 or MD5).

Wanted to know if you ever had the same issue ? Because I have over 13K of SHA256 to insert and 2s per hash is very long

 

Code is based on : https://opendxl.github.io/opendxl-tie-client-python/pydoc/basicsetexternalreputationexample.html

6 Replies
dfirstbr
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 7

Re: Insert HASH SHA256 using OpenDXL

Hi jmcg_bycn

You should always use all of the hashes that are available for a given file. If you set the reputation for the MD5 separately to SHA1 or SHA256 and they're all for the same file, there will be no way that 'TIE' will be able to recognize the same file when the file is new to the environment. 

The best configuration is to ensure that all hashes are combined and are used every time.

Also, concerning OpenDxl; To gain further support, you will need to go to opendxl.com or file an issue on github https://github.com/opendxl/opendxl-tie-client-python/issues.

I'll inform the SR owner of this response and confirm accordingly. Thanks!

 

 

Re: Insert HASH SHA256 using OpenDXL

Hello,

We do not have any information regarding the file from our external rep provider, this is why we treat each hash separately.

Now, from our testing, each hash is integrate successfully in TIE, but SHA256 is taking way more time than others hash while it's the same process.

Don't you acknowledge there is an issue here ?

Have you try it ?

 

dfirstbr
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 7

Re: Insert HASH SHA256 using OpenDXL

Hi jmcg_bycn

It is possible that the way that you're building the opendxl option isn't quite right. Unfortunately I'm unable to assist you further to review that, so I would urge you to use the links I've provide to take this further.  

-dene

 

Re: Insert HASH SHA256 using OpenDXL

Ok. This is one way to tell that you just don't want to investigate on this behavior on McAfee side.

I will urge to create a issue there then.

 

dfirstbr
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 7

Re: Insert HASH SHA256 using OpenDXL

Hi jmcg_bycn

That is absolutely not the case.

This is not the best forum to be able to address an issue with opendxl. As I've mentioned before, the best forum to help and assist you further would be the links that I 've provide earlier.

The development team for opendxl is active on this site and they'll be able to help in resolving any issue with opendxl.

-dene

 

 

Re: Insert HASH SHA256 using OpenDXL

Well the thing I try to understand is : The issue is from OpenDXL ? or TieServer ?

This is why I ask here. And I also ask if you could try it on your side with a TieServer so I can understand where is my issue.

Also, I doubt that the OpenDXL community will be able to help me if the issue is on TieServer.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community