The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Configure third-party data consumers

  • Published on Sep 12, 2026
  • 1 minute(s) read
Prev Next

Use raw Trellix ESM data in third-party applications.

Configure an event forwarding rule on Trellix ESM with an external certificate and a target topic.

Download the root certificate and the certificate configured for the forwarding rule.

  1. On the computer that hosts the data consumer, add an entry to the host file: <DSB_IP> <DSB_GUID>. Where DSP_IP is the IP address of the VM that hosts the Trellix Data Streaming Bus and DSB_GUID is the value from /etc/NitroGuard/devSettings.conf on the same VM.

  2. Configure the third-party application.

    1. Set the topic to the target topic created when you configured the event forwarding rule.

    2. Specify the port on the Trellix Data Streaming Bus VM that allows external access (default is 9092).

    3. Enter the IP address of the VM that hosts the Trellix Data Streaming Bus.

    4. Specify the root certificate and the certificate configured for the forwarding rule.

:

Related articles
  • Configure third-party data consumers
    Enterprise Security Manager > Enterprise Security Manager 11.7.x > ESM 11.7.x Installation Guide > Deploy a Trellix ESM solution on a VM > Post-deployment tasks
  • Configure Message Forwarding
    Enterprise Security Manager > Enterprise Security Manager 11.7.x > ESM 11.7.x Product Guide > PG - ESM - Tuning McAfee ESM > Tuning your ESM configuration > Data sharing
  • Configure Message Forwarding
    Enterprise Security Manager > Enterprise Security Manager 11.6.x > ESM 11.6.x Product Guide > PG - ESM - Tuning McAfee ESM > Tuning your ESM configuration > Data sharing