cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
malware-alerts
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 1 of 3

HTTP 400 using Web API tie.setReputations

Hi,

 

Trying to use the Web API to set reputation override for some files and am having issues getting to work properly.

The command I'm using is:

 

tie.setReputations?fileReps=[{"sha1":"QTBGQ0Y0NjYxODQ2ODQwNjRCMDhDNTREQUYyQUE0NDM1NkYyNjQ4Mw==","md5":"QjNFRDdDRTZBNzMwNDFBODczRTZERkU0MzQxOTgxN0M=","reputation":"99"}]

 

I Base64 encoded both the SHA1 and MD5 hashes (actual hashes according to the TIE File reputation Information page in ePO):

 

SHA1=A0FCF466184684064B08C54DAF2AA44356F26483 -- BASE64: QTBGQ0Y0NjYxODQ2ODQwNjRCMDhDNTREQUYyQUE0NDM1NkYyNjQ4Mw== (this is what I use in the URL)

MD5=B3ED7CE6A73041A873E6DFE43419817C --  BASE64: QjNFRDdDRTZBNzMwNDFBODczRTZERkU0MzQxOTgxN0M= (this is what I use in the URL)

 

When I run the command I keep getting HTTP 400 (bad request) but fail to see what I'm doing wrong in the command?

Any help is appreciated.

Tags (3)
2 Replies
malware-alerts
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 3

Re: HTTP 400 using Web API tie.setReputations

Turns out that the command has to be encoded (not just when using a browser but even when using a tool like curl), in the following fashion:


/tie.setReputations?fileReps=%5B%7B%22sha1%22%3A%22oPz0ZhhGhAZLCMVNryqkQ1byZIM=%22%2C%22md5%22%3A%22s+185qcwQahz5t/kNBmBfA==%22%2C%22reputation%22%3A%2299%22%7D%5D
kofmans1
Level 8
Report Inappropriate Content
Message 3 of 3

Re: HTTP 400 using Web API tie.setReputations

Whatever I tried there was no luck with setting TIE reputation via API. I tried it with and without URL encoding. Can maybe somebody provide with example of full URL which could be processed  without errors?

I know about alternatives with McAfee 2.7 based python client and with DXL client. But I am looking for universal approach in IOCs synchronization. Thanks in advance.

 

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community