Automated threat intelligence collection with McAfee ATD, OpenDXL and MISP
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Failed to load latest commit information.



This integration is focusing on the automated threat intelligence collection with McAfee ATD, OpenDXL and MISP. McAfee Advanced Threat Defense (ATD) will produce local threat intelligence that will be pushed via DXL. An OpenDXL wrapper will subscribe and parse indicators ATD produced and will import indicators into a threat intelligence management platform (MISP). The wrapper will also upload the ATD PDF report and original detonated sample to MISP.

screen shot 2018-06-25 at 08 36 45

Component Description

McAfee Advanced Threat Defense (ATD) is a malware analytics solution combining signatures and behavioral analysis techniques to rapidly identify malicious content and provides local threat intelligence. ATD exports IOC data in STIX format in several ways including the DXL.

MISP threat sharing platform is free and open source software helping information sharing of threat and cyber security indicators.


Download the Latest Release

  • Extract the release .zip file

MISP platform installation (Link) (tested with MISP 2.4.92)

Requests (Link)

PyMISP library installation (Link)

git clone
cd PyMISP/
python install

OpenDXL SDK (Link)

git clone
cd opendxl-client-python/
python install

Certificate Files Creation (Link). DXL 4.x support a simplyfied way to create certificates (Link).

McAfee ATD solution (tested with ATD 4.4)


McAfee ATD receives files from multiple sensors like Endpoints, Web Gateways, Network IPS or via Rest API. ATD will perform malware analytics and produce local threat intelligence. After an analysis every indicator of comprise will be published via the Data Exchange Layer (topic: /mcafee/event/atd/file/report).

The receives DXL messages from ATD, prepares the JSON and loads

Change the CONFIG_FILE path in the file.

CONFIG_FILE = "/path/to/config/file"

The script receives the JSON messages from ATD, parses IOCs and use the Python API from MISP (PyMISP) to create a new threat event, add atributes and asign a tag.

Change the following information

screen shot 2018-06-22 at 17 54 39

The MISP auth key can be found under the automation section in MISP.

Change the tag assignment in line 185

misp.add_tag(event, str("ATD:Report"))

Make sure that you added the tag in MISP.

The script will also download the PDF and original detonated sample from ATD and upload it to MISP. Make sure that the ATD user specified in line 18 is authorized to download reports and samples.

Run the OpenDXL wrapper



nohup python &


With this use case, ATD produces local intelligence and contributes information to an intelligence management platform like MISP. MISP is able to aggregate global, community and locally produced intelligence.