The DXL Broker stops working or isn't correctly tagged during installation

Technical Articles ID: KB88600
Last Modified: 2023-06-20 06:36:54 Etc/GMT

Environment

Active Response 2.x
Data Exchange Layer (DXL) 5.x, 4.x
Threat Intelligence Exchange (TIE) Server - all supported versions

For details of TIE Server-supported environments, see KB83368 - Supported platforms for Threat Intelligence Exchange Server.

Problem 1

When you perform a standalone DXL installation, the DXL Broker installation completes and is displayed in the ePO Console System Tree. But, it's not tagged as a DXLBROKER.

Problem 2

When a TIE installation includes the option to install DXL Broker on the same server, the DXL Broker handshake status never completes and the installation hangs.

Problem 3

After an Active Response installation that includes the option to install DXL Broker on the same server, the DXL Broker installation is selected as DONE. The Active Response server displays in the ePO System Tree, but it isn't tagged as a DXL Broker. Instead, it's incorrectly tagged as MARSERVER. The server isn't displayed in the DXL Fabric, nor is it listed in the DXL Topology.

System Change

You disabled the McAfee Agent (MA) policy option: Retrieve all system and product properties (recommended). If unchecked retrieve only a subset of properties.

Cause

MA is only sending a subset of properties. The MA installed on the DXL Broker is needed to send custom properties back to the ePO server.

Solution

Edit the MA Policy applied to the System Tree group by performing the following steps:

Log on to the ePO console with an account that can edit policies.
Select System Tree and locate the group where your DXL Broker is listed.
Select the Assigned Policies tab.
In the Product drop-down, select McAfee Agent.
Select the General policy option that's configured, for example, My Default.
Enable the following option in Agent Server Communication:

Retrieve all system and product properties (recommended). If unchecked retrieve only a subset of properties.

NOTE: This setting is needed, and must always be kept for managing DXL Brokers. Any change in policies can affect other endpoints if the policy is used by other groups. If your default policy is applied to other groups that require different settings, create a policy for MA with this option selected. Apply it only to the DXL Broker servers.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

The DXL Broker stops working or isn't correctly tagged during installation

Environment

Problem 1

Problem 2

Problem 3

System Change

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

The DXL Broker stops working or isn't correctly tagged during installation

Environment

Problem 1

Problem 2

Problem 3

System Change

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title