The DXL broker stops working or is not correctly tagged during installation

Technische Artikel ID: KB88600
Zuletzt geändert am: 8/12/2021

Umgebung

McAfee Active Response (MAR) 2.x
McAfee Data Exchange Layer (DXL) 5.x, 4.x
McAfee Threat Intelligence Exchange (TIE) Server - all supported versions

For details of TIE Server supported environments, see KB83368.

Problem

You perform a standalone DXL installation. The DXL broker installation completes and is displayed in the ePO Console System Tree. But, it is not tagged as a DXLBROKER.

Problem

When a TIE installation includes the option to install DXL Broker on the same server, the DXL Broker handshake status never completes, and the installation hangs.

Problem

After a MAR installation that includes the option to install DXL Broker on the same server, the DXL Broker installation is selected as DONE. The MAR server displays in the ePO System Tree, but the MAR server is not tagged as a DXL broker. Instead, the MAR server is incorrectly tagged as MARSERVER. The MAR server is not displayed in the DXL Fabric, nor listed in DXL Topology.

Systemänderung

You disabled the McAfee Agent policy option: Retrieve all system and product properties (recommended). If unchecked retrieve only a subset of properties.

Ursache

McAfee Agent is only sending a subset of properties. The McAfee Agent installed on the DXL broker is needed to send custom properties back to the ePO server.

Lösung

Edit the McAfee Agent Policy applied to the System Tree group:

Log on to ePO console with an account that can edit policies.
Select System Tree and locate the group where your DXL broker is listed.
Select the Assigned Policies tab.
In the Product drop-down, select McAfee Agent.
Select the General policy option that is configured, for example, My Default.
Enable the following option in Agent Server Communication:

Retrieve all system and product properties (recommended). If unchecked retrieve only a subset of properties.

NOTE: This setting is needed, and must always be kept for managing DXL brokers. Any change in policies could affect other endpoints if the policy is used by other groups. If your default policy is applied to other groups that require different settings, create a policy for McAfee Agent with this option selected. Apply it only to the DXL broker servers.

Betroffene Produkte

Configuration
Data Exchange Layer 6.x
Data Exchange Layer 5.x
Install/Uninstall
Known Issue/Product Defect
McAfee Active Response 2.x
Threat Intelligence Exchange Server 2.3.x
Threat Intelligence Exchange Server 2.2.x
Troubleshooting

Sprachen:

Dieser Artikel ist in folgenden Sprachen verfügbar:

German
English United States
Spanish Spain
French
Italian
Japanese
Korean
Dutch
Portuguese Brasileiro
Chinese Simplified
Chinese Traditional

Technisches Glossar

Glossarbegriffe hervorheben

Im technischen Glossar werden Fachbegriffe erklärt.

Knowledge Center

The DXL broker stops working or is not correctly tagged during installation

Umgebung

Problem

Problem

Problem

Systemänderung

Ursache

Lösung

Betroffene Produkte

Sprachen:

Technisches Glossar

Title

Title

Knowledge Center

The DXL broker stops working or is not correctly tagged during installation

Umgebung

Problem

Problem

Problem

Systemänderung

Ursache

Lösung

Betroffene Produkte

Sprachen:

Technisches Glossar

Wählen Sie Ihre Region

Title

Title