If you are using an On-prem Endpoint Security (HX) server, you must configure your Endpoint Security (HX) on-prem server to securely authenticate and connect with the Trellix cloud platform. This involves setting up an authentication protocol (OIDC) and then enabling the connection agent (Helix Connect Client).
Before configuring, make sure you are logged in to the Endpoint Security (HX) server.
OIDC configuration
This procedure establishes a trust relationship between your on-prem HX server and Trellix's central Identity and Access Management (IAM) service using the OpenID Connect (OIDC) standard. This allows your server to securely authenticate and prove its identity before exchanging data.
Run the following commands to verify the existing OIDC configuration.
show aaa authentication oidc issuer # "Issuer" URL should be set to "https://iam.cloud.trellix.com/iam-appl/v2". sh aaa authentication oidc # "Web Policy" should be set to "allowed" or "required".
If the OIDC is not configured, configure it by running the following commands..
aaa authentication oidc issuer url https://iam.cloud.trellix.com/iam-appl/v2 # Sets IAM Issuer URL. aaa authentication oidc web policy allowed # Enables OIDC based authentication.
To verify if the Client ID is generated, run the following commands.
show aaa authentication oidc client # "Client ID" is generated on successful enabling of OIDC authentication.
HelixConnect configuration
This procedure activates the HelixConnect client that creates a persistent and secure data channel from your on-prem Endpoint Security (HX) server to the Helix cloud platform. This channel is used to stream data from your EDR workspace to the Endpoint Security (HX) server.
To verify the status of HelixConnect client, run the following command.
show helixconnect # "Feature Enabled" should be set to "yes" and "Status" should be "Connected"
If HelixConnect client is not configured, configure it by running the following commands.
helixconnect registration-url <URL> # Sets API Registration URL # US Region URL: https://api.feconnect.fireeye.com # EU Region URL: https://api.eu.feconnect.fireeye.com # AP Region URL: https://api.ap.feconnect.fireeye.com helixconnect enable # Enables helixconnect
Note
Enabling takes a few minutes to complete. After you run the
helixconnect enablecommand, wait for a few minutes before running theshow helixconnectcommand to confirm that HelixConnect is successfully enabled.
For more details about HelixConnect configuration, connectivity, and troubleshooting, see the HelixConnect Integration Guide.