Insert HASH SHA256 using OpenDXL

[jmcg_bycn]

Hello,

Using OpenDXL I insert multiple hash SHA1 or MD5 one at a time.

But when I need to insert only SHA256, the process is taking 2sec instead of 0,1s like others HASH (SHA1 or MD5).

Wanted to know if you ever had the same issue ? Because I have over 13K of SHA256 to insert and 2s per hash is very long

Code is based on : https://opendxl.github.io/opendxl-tie-client-python/pydoc/basicsetexternalreputationexample.html

[dfirstbr]

Hi jmcg_bycn

You should always use all of the hashes that are available for a given file. If you set the reputation for the MD5 separately to SHA1 or SHA256 and they're all for the same file, there will be no way that 'TIE' will be able to recognize the same file when the file is new to the environment. 

The best configuration is to ensure that all hashes are combined and are used every time.
​
Also, concerning OpenDxl; To gain further support, you will need to go to opendxl.com or file an issue on github https://github.com/opendxl/opendxl-tie-client-python/issues.

I'll inform the SR owner of this response and confirm accordingly. Thanks!

[jmcg_bycn]

Hello,

We do not have any information regarding the file from our external rep provider, this is why we treat each hash separately.

Now, from our testing, each hash is integrate successfully in TIE, but SHA256 is taking way more time than others hash while it's the same process.

Don't you acknowledge there is an issue here ?

Have you try it ?

[dfirstbr]

Hi jmcg_bycn

It is possible that the way that you're building the opendxl option isn't quite right. Unfortunately I'm unable to assist you further to review that, so I would urge you to use the links I've provide to take this further.  

-dene

[jmcg_bycn]

Ok. This is one way to tell that you just don't want to investigate on this behavior on McAfee side.

I will urge to create a issue there then.

[dfirstbr]

Hi jmcg_bycn

That is absolutely not the case.

This is not the best forum to be able to address an issue with opendxl. As I've mentioned before, the best forum to help and assist you further would be the links that I 've provide earlier.

The development team for opendxl is active on this site and they'll be able to help in resolving any issue with opendxl.

-dene

[jmcg_bycn]

Well the thing I try to understand is : The issue is from OpenDXL ? or TieServer ?

This is why I ask here. And I also ask if you could try it on your side with a TieServer so I can understand where is my issue.

Also, I doubt that the OpenDXL community will be able to help me if the issue is on TieServer.