How to Integrate Replit with McAfee

1// check-trellix-secrets.js
2const hasApiKey = !!process.env.TRELLIX_API_KEY;
3const hasUserPass = !!(process.env.TRELLIX_USERNAME && process.env.TRELLIX_PASSWORD);
4const hasUrl = !!process.env.TRELLIX_EPO_URL;
5
6if (!hasUrl) throw new Error('TRELLIX_EPO_URL missing. Set in Replit Secrets (lock icon 🔒).');
7if (!hasApiKey && !hasUserPass) throw new Error('Set TRELLIX_API_KEY or TRELLIX_USERNAME + TRELLIX_PASSWORD in Secrets.');
8
9console.log('Trellix ePO config OK.');
10console.log('ePO URL:', process.env.TRELLIX_EPO_URL);
11console.log('Auth method:', hasApiKey ? 'API Key' : 'Username/Password');

1// trellix.js — Trellix ePO (McAfee) REST API integration for Node.js on Replit
2const axios = require('axios');
3const express = require('express');
4const https = require('https');
5
6const app = express();
7app.use(express.json());
8
9const EPO_URL = process.env.TRELLIX_EPO_URL;
10const API_KEY = process.env.TRELLIX_API_KEY;
11
12// HTTP client — for on-premises ePO with self-signed certs:
13// add httpsAgent: new https.Agent({ rejectUnauthorized: false }) for dev only
14const epoClient = axios.create({
15  baseURL: EPO_URL,
16  headers: {
17    'Authorization': `Bearer ${API_KEY}`,
18    'Content-Type': 'application/json',
19    'Accept': 'application/json'
20  }
21});
22
23// For on-premises ePO with basic auth instead of API key:
24const makeBasicAuthClient = () => {
25  const credentials = Buffer.from(
26    `${process.env.TRELLIX_USERNAME}:${process.env.TRELLIX_PASSWORD}`
27  ).toString('base64');
28  return axios.create({
29    baseURL: EPO_URL,
30    headers: {
31      'Authorization': `Basic ${credentials}`,
32      'Content-Type': 'application/json'
33    }
34  });
35};
36
37// Get device/system list from ePO
38app.get('/api/devices', async (req, res) => {
39  const { search = '', limit = 100 } = req.query;
40  try {
41    // On-premises ePO command: system.find
42    const response = await epoClient.get('/remote/system.find', {
43      params: {
44        searchText: search,
45        ':output': 'json'
46      }
47    });
48    // ePO wraps results in array
49    const devices = Array.isArray(response.data) ? response.data.slice(0, limit) : [response.data];
50    res.json({ devices, count: devices.length });
51  } catch (err) {
52    res.status(err.response?.status || 500).json({ error: err.message });
53  }
54});
55
56// Execute a stored ePO query by ID
57app.get('/api/query/:queryId', async (req, res) => {
58  try {
59    const response = await epoClient.get('/remote/core.executeQuery', {
60      params: {
61        queryId: req.params.queryId,
62        ':output': 'json'
63      }
64    });
65    res.json({ results: response.data });
66  } catch (err) {
67    res.status(err.response?.status || 500).json({ error: err.message });
68  }
69});
70
71// Get recent threat detections
72app.get('/api/threats', async (req, res) => {
73  const { hours = 24 } = req.query;
74  const since = new Date(Date.now() - hours * 3600000).toISOString();
75  try {
76    // Query EPOEvents table for recent threats
77    const response = await epoClient.get('/remote/core.executeQuery', {
78      params: {
79        target: 'EPOEvents',
80        select: '(select EPOEvents.ThreatName EPOEvents.HostName EPOEvents.ThreatSeverity EPOEvents.DetectedUTC)',
81        where: `(where (ge EPOEvents.DetectedUTC "${since}"))`,
82        order: '(order (desc EPOEvents.DetectedUTC))',
83        ':output': 'json'
84      }
85    });
86    res.json({ threats: response.data, since });
87  } catch (err) {
88    res.status(err.response?.status || 500).json({ error: err.message });
89  }
90});
91
92app.listen(3000, '0.0.0.0', () => console.log('Trellix ePO server running on port 3000'));

1# trellix_api.py — Trellix ePO (McAfee) REST API for Python on Replit
2import os
3import requests
4from flask import Flask, request, jsonify
5import base64
6
7EPO_URL = os.environ['TRELLIX_EPO_URL']
8API_KEY = os.environ.get('TRELLIX_API_KEY')
9USERNAME = os.environ.get('TRELLIX_USERNAME')
10PASSWORD = os.environ.get('TRELLIX_PASSWORD')
11
12# Build session with appropriate auth
13session = requests.Session()
14session.verify = True  # Set to CA cert path for on-premises ePO, False only for dev
15
16if API_KEY:
17    # Trellix Cloud or newer ePO with API key
18    session.headers.update({'Authorization': f'Bearer {API_KEY}', 'Accept': 'application/json'})
19else:
20    # On-premises ePO with basic auth
21    creds = base64.b64encode(f'{USERNAME}:{PASSWORD}'.encode()).decode()
22    session.headers.update({'Authorization': f'Basic {creds}', 'Accept': 'application/json'})
23
24app = Flask(__name__)
25
26@app.route('/api/devices')
27def get_devices():
28    search = request.args.get('search', '')
29    try:
30        response = session.get(f'{EPO_URL}/remote/system.find', params={
31            'searchText': search,
32            ':output': 'json'
33        })
34        response.raise_for_status()
35        devices = response.json()
36        if not isinstance(devices, list):
37            devices = [devices]
38        return jsonify({'devices': devices, 'count': len(devices)})
39    except requests.HTTPError as e:
40        return jsonify({'error': str(e)}), e.response.status_code
41
42@app.route('/api/threats')
43def get_threats():
44    from datetime import datetime, timedelta
45    hours = int(request.args.get('hours', 24))
46    since = (datetime.utcnow() - timedelta(hours=hours)).strftime('%Y-%m-%dT%H:%M:%S')
47    try:
48        response = session.get(f'{EPO_URL}/remote/core.executeQuery', params={
49            'target': 'EPOEvents',
50            'select': '(select EPOEvents.ThreatName EPOEvents.HostName EPOEvents.ThreatSeverity EPOEvents.DetectedUTC)',
51            'where': f'(where (ge EPOEvents.DetectedUTC "{since}"))',
52            'order': '(order (desc EPOEvents.DetectedUTC))',
53            ':output': 'json'
54        })
55        response.raise_for_status()
56        return jsonify({'threats': response.json(), 'since': since})
57    except requests.HTTPError as e:
58        return jsonify({'error': str(e)}), e.response.status_code
59
60if __name__ == '__main__':
61    app.run(host='0.0.0.0', port=3000)