Important
This DLP Events API (/api/v2/events) will be deprecated by the end of 2024, and we recommend that you migrate to the new API (DLP SaaS Incidents API) before the end of Q3 2024.The DLP SaaS Incidents API provides these additional features:
Increased retention period
Improved filter capabilities, utilizing JSON:API
Improved response body and additional attributes
For more information about the new API, see DLP SaaS Incident API call to get incidents.
The Events GET API call provides read access to threat events available in ePO - SaaS. This API provides limited details or summary of DLP incidents, but you can see the detailed DLP incident information in Incident Details page.
Make sure that your endpoints (DLP agents and NDLP appliances) are managed by ePO - SaaS.
Obtain the client Id of your user account. The client ID is required to obtain the access token. To obtain the client_id required, log in to the ePO - SaaS console, open a new tab and go to:
https://auth.ui.trellix.com/support.html
Retrieve an access token required in the Events API call using the POST call
https://iam.cloud.trellix.com/iam/v1.0/token:Example to retrieve the access token for threat events using cURL command:
curl -L -k -XPOST 'https://iam.cloud.trellix.com/iam/v1.0/token' --data "username=<admin_username>" --data "password=<admin_password>" --data "client_id=0oawz1wagXnxG7lUr2p6" --data "grant_type=password" --data-urlencode "scope=epo.evt.r dp.im.r" -H "accept: application/json" -H "content-type: application/x-www-form-urlencoded" -H "cache-control: no-cache"
The access token is valid for an hour. After the token expires, you can retrieve a new token before submitting the API again.
The response to Step 2 contains an access token, use this token to retrieve threat events. Here's a sample threat events API call using a cURL command:
Note
REST API calls to query and update Trellix DLP – SaaS incident details are not currently supported.
curl -X GET 'https://arevents.manage.trellix.com/eventservice/api/v2/events?type=incidents since=<since_date>&until=<until_date>&sort=asc&limit=10' -H 'Authorization: Bearer <Access_Token>' -H 'cache-control: no-cache'
Note
You can query for threat events if you are using Trellix Endpoint.
Data retention period — The retention period for an incident query is 3 days. Queries that exceed the retention period succeed but only threat events from the last 3 days are returned.