McAfee OpenDXL Bridge

Introduction

This project focus around real-time bi-directional data sharing (bridging) between McAfee Data Exchange Layer and 3rd party data networks.

Motivation

• Enable OpenDXL community to quickly create new integration use cases
• Excel integration-adoption of OpenDXL
• Create easy to use data bridging platform

Getting Started

Main Bridge Service components

• McAfee OpenDXL wrapper : McAfee python Client service, responsible for securely collecting and forwarding data from and to McAfee Data Exchange layer (DXL).
• Node-RED : Flow based graphical programming tool, enables easy wiring (coding) of 3rd party data source feeds (hardware devices, APIs, data sets and online data services) and manages data traffic orchestration into McAfee Data Exchange Layer (DXL).

Prerequisites

• CentOS Minimal release v7: free and open source Linux computing platform
• Mosquito MQTT Message Broker release v1.4: Open source (EPL/EDL licensed) message broker that implements the MQTT protocol versions 3.1 and 3.1.1
• Eclipse Paho MQTT python client v1.1: Linux client class library which enable applications to connect to an MQTT broker to publish messages, and to subscribe to topics and receive published messages
• Node-RED version 0.16.2(npm): Flow based programming tool for wiring together hardware devices, APIs and online data services
• McAfee OpenDXL python Client
• McAfee Data Exchange Layer Broker v3.x: MFE DXL Fabric Message broker
• McAfee ePolicy Orchestrator v5.3: Single console for Endpoint Security Management

Installing Bride Service

Mosquitto MQTT Broker, Paho MQTT Client & Node-RED framework

1.Installing Mosquitto Broker & paho mqtt client from Package in CentOS 7:

$ sudo yum install epel-release
$ sudo yum -y install mosquitto
$ pip install paho-mqtt

2.Installing Node-RED in CentOS 7:

$ sudo yum install nodejs
$ sudo npm install -g --unsafe-perm node-red

McAfee OpenDXL Client

Installation & Configuration MFE OpenDXL Client in CentOS 7:

1. Python SDK Installation link
2. Certificate Files Creation link
3. ePO Certificate Authority (CA) Import link
4. ePO Broker Certificates Export link
5. Edit MFE dxlclient.conf File link

Running Bridge Service

install Python3-function within Node-RED framework

$ npm install -g node-red-contrib-python3-function

Create NodeRed-OpenDXL Publisher Node

1. Browse to URL Node-Red Admin UI (Port:1880)
2. Drop new Python3 function into dashboard flow

3. Edit new NodeRed-OpenDXL Function Node in Dashboard Flow and enter below python code (additionaly see file OpenDXL_Pub_Node-Red.py):

python code:

import os
import sys
from dxlclient.client import DxlClient
from dxlclient.client_config import DxlClientConfig
from dxlclient.message import Event
EVENT_TOPIC = str(msg['topic']).encode()
CONFIG_FILE = "/var/McAfee/opendxl/examples/dxlclient.config"
config = DxlClientConfig.create_dxl_config_from_file(CONFIG_FILE)
with DxlClient(config) as client:
  client.connect()
  event = Event(EVENT_TOPIC)
  event.payload = str(msg['payload']).encode()
  client.send_event(event)
  return msg

Start-up OpenDXL Bridge Service

In order to use the data bridge (wrapper) service, run OpenDXL_Bridge.py script on the CentOS system:

$ python OpenDXL_Bridge.py

OpenDXL Bridge Service Output

After starting the python script and sucessfully setting-up the Node-Red framework below screen output will be displayed:

Received DXL Topic: /mcafee/event/dxl/brokerregistry/topicadded

Send MQTT Payload: {“topic”:#”}

Example Flows OpenDXL Briding in Node-Red

See below a snapshot of a couple of Use-cases to integrate 3rd party data using OpenDXL Bridge Service and Node-RED:

Versioning

For the versions available, see the tags on this repository.

Authors

Martin de Jongh - Project design & Bridge Service programmer - McAfee

Acknowledgments

• Martin Ohl - Supporting developer OpenDXL-NodeRed wrapper code - McAfee
• Chris Smith- Development team OpenDXL Client - McAfee
• Thomas Maxeiner - Project Coach - McAfee