file reputation in case of certificate reputation

[jeromekleinen]

Hello,

I am trying to use dxl/tie to enrich some logs collected in my organization with a file reputation. In my log files I only have md5 hashes available.

Usually this is sufficient to get the file reputation. The only edge case are executables that inherit their rating from their certificate. Using the tie dxl client you can get the reputation of a certificate, but this data is not available in my logs.

Is there any workaround for these cases in order to get the correct inherited rating? For example, a dxl call to get all the known certificates for a certain md5 hash?

Thanks,

Jerome

[jbarlow-mcafee]

Hi @jksecurity,

There is a "file info" topic that you may be able to query with the hash(es) (including an MD5) of a file. One of the fields that can be included in the query results is a certSha1. From the certSha1 value, you could presumably then use the TieClient.get_certificate_reputation() API to get the reputation of the certificate, as you mentioned.

For reference, you can see an experimental attempt to add the "file info" functionality to the OpenDXL TIE Python client here:

mveken@9e4cf2a

Please note, though, that the "file info" functionality is not considered a supported API in TIE, is not guaranteed to continue working properly, and may change/be dropped in the future. For these reasons, this functionality is not currently (and may not ever be) included in the OpenDXL TIE Python client.