Custom attributes are configurable data fields on an incident. You can use custom attributes to enrich and categorize an incident, along with the default incident information.
The automatically generated incident data captured by Trellix DLP, shown in DLP Incident Manager, is read-only and can't be edited or changed. For performing better analytics and understanding the patterns of incident data, enrich these incidents with custom attribute values. You can assign custom attributes in such a way that it provides better insights into the incident data.
Use custom attributes to assign an incident with user-related or incident-related information and set the attribute priority as needed. Attributes, such as user's Manager, that aren't available via LDAP can be configured using custom attributes. Custom attributes can also store data about actions taken on the incident, Employee ID, region of the user, reviewer, information related to remediation, the status of remediation, and notes.
After you define the custom attributes in ePO - On-prem, you can use a REST API call to associate custom attributes to an incident. To assign custom attributes to multiple incidents, it is expected to automate the assignment through a user-defined script. These attributes can be assigned to all incidents or specific incidents as needed. Custom attributes are assigned NULL values when created, and it is not mandatory to populate the values for all custom attributes. You can also modify the attributes assigned to an incident when needed. The association or disassociation of attributes happens upon a change in assignment. The REST API call only updates custom attributes as the default incident data is not editable.
The custom attribute APIs work coherently with a user-defined automation system to push data needed for incident analysis.
Note
The custom attribute values aren't shown in the DLP Incident Manager in this release, but are available only through the REST API call.
Workflow for assigning custom attributes and retrieving the updated incident details
Create, edit, or modify custom attributes from the Custom Attributes tab in DLP Incident Manager. For more information, see Configure custom attributes.
Retrieve all incident IDs for which you want to assign custom attribute values using the
incidents/idsGET API call. See Retrieve incident IDs.Execute the
customAttribute/listGET API call to see the list of configured custom attributes and the ID assigned to each custom attribute. The custom attribute IDs are needed when you assign an incident with custom attribute values as the API call expects a "key": "value" pair. See Retrieve the list of configured custom attributes.Execute the
customAttribute/{incidentId}PUT API call to assign custom attribute values. See Assign custom attributes to an incident.Retrieve the custom attribute information along with the default incident details using the
incidents/{incidentId}GET API call. See Retrieve incident details using REST API.
Supported data vectors with custom attributes
You can assign custom attributes to incidents generated for various data vectors as shown:
Data vector | Products | Input parameter for the REST API |
|---|---|---|
Data-in-Use | Trellix DLP Endpoint Trellix Device Control | incidentNature=1 |
Data-in-Motion | Trellix DLP Network Prevent Trellix DLP Network Monitor | incidentNature=1 |
Data-at-Rest - Endpoint | Trellix DLP Endpoint discovery | incidentNature=2 Reserved for Data at Rest - Endpoint discovery incidents and can be used when support for Endpoint discovery custom attributes is added into the product. |
Data-at-Rest - Network | Trellix DLP Discover | incidentNature=3 |