Threat Intelligence Exchange and Active Response servers are tagged as a DXLBROKER after you disable the DXL Broker service

Technical Articles ID: KB89300
Last Modified: 8/3/2021

Environment

McAfee Active Response (MAR) 2.x
McAfee Data Exchange Layer (DXL) 4.x
McAfee Threat Intelligence Exchange (TIE) Server - all supported versions

For details of TIE Server supported environments, see KB83368.

Problem

When you install the McAfee Threat Intelligence or McAfee Active Response server, you can also install the DXL Broker service.

You might see an issue if you later disable the DXL broker service. The TIE or MAR server might still be tagged as DXLBROKER and show in the DXL Topology.
This tagging might give administrators the impression that the DXL broker is still in use.

Workaround

To disable the DXL broker service completely:

NOTE: You must log on as root to perform all commands.

Verify that the DXL broker rpm is installed with the following command:

rpm -qa | grep dxl

This command outputs an entry similar to the following (the version of DXL broker might be different):

dxlbroker-3.0.0-285.mlos2.x86_64
Remove the rpm dxlbroker-3.0.0-285.mlos2.x86_64 with the following command:

rpm -e dxlbroker-3.0.0-285.mlos2.x86_64
Delete the DXLBROKER tag from TIE or MAR server.
Perform a wake-up call on the server where you removed the DXL broker.

The DXLBROKER tag no longer appears and the server no longer appears on the DXL Topology or DXL Fabric pages.

To re-enable the DXL broker service, you must log on to your TIE or MAR server and use the change-services script. There is no need to reinstall the RPM because the script installs the DXL broker RPM automatically.

Affected Products

Configuration
Install/Uninstall
Known Issue/Product Defect
McAfee Active Response 2.x
Threat Intelligence Exchange Server 3.x
Threat Intelligence Exchange Server 2.3.x
Threat Intelligence Exchange Server 2.2.x

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Knowledge Center

Threat Intelligence Exchange and Active Response servers are tagged as a DXLBROKER after you disable the DXL Broker service

Environment

Problem

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

Threat Intelligence Exchange and Active Response servers are tagged as a DXLBROKER after you disable the DXL Broker service

Environment

Problem

Workaround

Affected Products

Languages:

Choose your region

Title

Title