Installation The installation includes several components and clients. McAfee ePO extensions McAfee ePO proxy and Cloud Bridge configuration Threat Intelligence Exchange server Data Exchange Layer brokers Active Response server Active Response aggregators Active Response clients on endpoints Active Response content packages RequirementsFor a successful installation, check that these minimum requirements are met before installing Active Response components. Install the McAfee ePO extensions The extensions for Active Response, Threat Intelligence Exchange, and Data Exchange Layer are included in a single bundle file. Configure McAfee ePO proxy server settings (optional) If your company uses proxy addresses, enter the IP address for the Active Response server in the McAfee ePO proxy settings. Configure the McAfee ePO Cloud Bridge server settingsMcAfee ePO Cloud Bridge is an extension that you install on your local McAfee ePO server, allowing you to link your on-premise McAfee ePO server to your McAfee ePO Cloud account. Install the Threat Intelligence Exchange server Install and configure the Threat Intelligence Exchange server. TIE provides file and certificate reputation information and enables you to block or allow them from running in your environment based on their reputation. Install the Active Response serverActive Response server is provided as an .iso image, packaging a McAfee® Linux Operating System (MLOS) instance. Configure the DXL broker extension Broker extensions are additional features that can be enabled on a Data Exchange Layer broker to add new functionality created by other managed products. Enable the Trace broker extension used by Active Response. Install aggregators You are not required to install an aggregator to use Active Response. However, aggregators reduce the amount of DXL bandwidth required, and increase the number of managed endpoints supported. Manage Active Response clientsUse these tasks to manage the Active Response client on endpoints. Install content packagesInstall content packages to get new collectors and reactions, or new versions of existing built-in collectors and reactions.