Data Exchange Layer

Easy, one-to-many app integrations and instant communication

Data Sheet

Secure, fast messaging across apps

Now you can enrich security operations and connect security solutions into an effective team. The Data Exchange Layer (DXL) communication fabric connects and optimizes security actions across multiple vendor products, as well as internally developed and open source solutions. Enterprises gain secure, real-time access to new data and lightweight, instant interactions with other products. New integration with Cisco pxGrid extends your reach end-to-end with better identity services and automated threat mitigation.

Download DXL Components

OpenDXL: An open standard and ecosystem

Enabling more applications to run across the DXL fabric, the OpenDXL open source project helps developers and enterprises freely leverage DXL. The OpenDXL community and resources at empower DXL integrations, provide a catalog for available apps, support implementations, and nurture new ideas.


OpenDXL.comOpenDXL IntegrationsOpenDXL SDK on GitHub

OpenDXL Idea Book

Read 15 easy ways to integrate, orchestrate, and expedite security operations.

Change your security dynamics


Shorten threat mitigation workflows

Rapid sharing of information and orchestration of tasks shrink the time to detect, contain, and correct newly identified threats. Integration with Cisco pxGrid adds visibility, apps, and data from a second vendor ecosystem.


Reduce integration complexity

A new set of deployment, development, and configuration tools helps you get actively integrating in just five minutes and simplifies defining policies and services across fabrics.


Increase the value of your applications

Applications throughout your infrastructure can now share the timely threat data they generate and work together to take action immediately. Messages can trigger automated responses from McAfee ePolicy Orchestrator to update, clean, quarantine, and more.

Get Started

DXL 5.0 acts as the behind-the-scenes communication layer for McAfee MVISION device-to-cloud interchanges.

Learn More >

Find out how to connect McAfee and Cisco ecosystems and their insights and application capabilities for policy-driven, automated threat mitigation.

Read Brief >

Watch customers who are embracing DXL discuss the incredible value of integrating security technologies to gain huge efficiencies.

Watch Video >

This 14-minute video walks you through integration use cases and technical configuration for Cisco ISE/pxGrid and McAfee ePO and DXL.

Watch Video >

How it works

Develop once

The DXL application framework increases integration flexibility and simplicity. Unlike typical integrations, each application connects to the universal DXL communication fabric with just one integration process. Applications can attach and communicate over a universal orchestration layer. One app publishes a message or calls a service; one or more apps consume the message or respond to the service request.

As is the goal for any standard, the interaction is independent of the underlying proprietary architecture. Integrations are much simpler because of this abstraction from vendor-specific APIs and requirements. A new Docker container can package all the capabilities required to create and test a service within a single image for easy development.

Wrap once

A bootstrap utility makes it easy to wrap and distribute services built around an existing API. It provides a template and generates files to enable standardized distributions as Python packages or Docker containers.

This model helps you extend your own or a commercial product, to publish data onto DXL. For a more sophisticated app, these sorts of actions can be scripted together to drive a waterfall or simultaneous set of actions—an orchestrated response with or without human involvement.

Deploy once

Deploy a standardized integration and communication layer over your existing network with a small DXL client and broker that manages message exchanges. All DXL traffic is contained within your network, offering data privacy and operational control. A firewall-friendly model maintains a connection between client and server for continuous access to the latest information flowing over the DXL.

If something in the publishing or receiving application changes, the DXL abstraction layer insulates the rest of the deployment from the change, reducing risk and costs of integration maintenance.

Resources Community

Questions or concerns with your integration? Stop by for tools, tutorials, and support from experts and fellow developers.

Learn More >

OpenDXL Blogs

Follow the latest announcements about our open platform.

Learn More >

2019 SANS Automation & Integration Survey

Automation of key security and incident response (IR) tasks can balance out staff shortages and alert fatigue. This new SANS survey explores some of the misconceptions versus facts around automation and what to do about it.

Read Report >

Partner Business Center Login >

McAfee’s Enterprise-class Cybersecurity Technology Platform

ESG explores the top eight attributes of cybersecurity technology platforms that help automate and integrate previously disparate security controls.

Read Brief >