Integration Types
=================
Interaction with the DXL fabric is comprised of two primary roles; Information consumers and information providers.

Consumers
----------

Consumers receive information over the DXL fabric via its multiple communication models.

**Event subscriber**

    An event-based consumer subscribes to topics and passively receives events from publishers (one-to-many communication mode).

    Common use cases that leverage event subscriber integrations include:

    * Orchestration

        A client listens for a particular set of events. Once an event is received an orchestration work flow is initiated.

        For example, a security product detects that a particular endpoint is sending data to a known "command and control" target and as a reaction sends an event to the DXL fabric. A client listening for the particular event initiates an orchestration work flow that triggers a remediation process utilizing other products available on the fabric.

**Service invoker**

    A client that invokes methods on services registered on the DXL fabric. The client actively requests information from the service (one-to-one communication mode).

    Common use cases that leverage service invocation integrations include:

    * Data Collection

        Security services are invoked over the DXL fabric to query information in real-time (running-processes, etc.) or for forensics-based analysis.

    * Orchestration

        As part of an orchestration work flow various security services are invoked for the purpose of data collection, analytics, and remediation.

Providers
---------

Providers distribute information to the DXL fabric via its multiple communication models.

**Event publisher**

    A client that periodically publishes events to specific topics on the DXL fabric (one-to-many communication mode). These events will be delivered to consumers that are currently subscribed to those topics.

    Common use cases that leverage event publisher integrations include:

    * Threat Events

        Events are sent to the fabric to indicate the presence of a threat. For example, malware is detected on a particular endpoint.

    * Informational Events

        Events are sent to the fabric to announce a particular piece of information. For example, a new vulnerability has been published, a user logged into a system, etc.

**Service providers**

    A client that registers a service with the DXL fabric. A service is comprised of one or more methods that are exposed via corresponding topics. These service methods will be invoked by clients by sending a request message to a topic associated with a service-method. Once received, the service replies by sending a response message over the fabric back to the invoking client (one-to-one communication mode).

    Common service integration models include:

    * Native service

        A service is developed with a native DXL fabric integration. For example McAfee Threat Intelligence Exchange (TIE) natively supports communication with DXL fabrics.

    * Wrapped service

        A DXL service wrapper is created that delegates invocations to an existing service's API/SDK. For example, a security service that exposes a REST-based API can be easily wrapped by a DXL service wrapper to provides its functionality on the DXL fabric.