Create a custom reaction

You can create a custom reaction to take on managed endpoints.

Select Menu → Catalog.
Click the Reactions tab, then click + Add to open the New Reaction page.
Enter a name and description for the reaction.
Enter the reaction's content.
1. Use the Type drop-down list to select the appropriate content type.
2. In the Content code editor, enter the commands or code that Trellix EDR executes on managed endpoints.
Note
Add content to Windows, Linux, and macOS tabs so that the reaction applies to Windows, Linux, macOS managed endpoints.
Click + Add to add an argument.
1. Enter a name for the argument.
  Important
  An argument's name must match the name given in the reaction's content between {{ and }}.
2. From the Type drop-down list, select a type for the argument values.
Set the Reaction Timeout to increase or decrease the default 60-second timeout limit. Increase the timeout limit for collectors that need more time to run.

Click Save to finish.

Note
If Save is disabled, check for problems in the form fields.

Details

Section	Option	Definition
Actions	Choose Columns	Opens the Choose Columns page allowing you to select the columns that are displayed in the catalog table.
	Delete	Removes the reaction from the Endpoint Detection and Response Catalog. Caution This action cannot be undone.
	Edit	Use this option to edit the custom reaction.
Reaction Summary	Name	Sets the reaction name.
Reaction Summary	Description	Sets the reaction description.
Reaction Content	Windows tab	Defines the reaction content for endpoints running Windows.
	Linux tab	Defines the reaction content for endpoints running Linux.
	macOS tab	Defines the reaction content for endpoints running macOS.
	Type	Selects a supported content type.
	Content	Sets the reaction content.
Reaction Arguments	Add Argument	Adds an argument for the reaction. After clicking Add Argument, use the empty text box to set a name and the drop-down list to set a type for the argument.
	+	Adds an argument.
	-	Deletes an argument.
Reaction Timeout	Timeout [sec]	Increase or decrease the timeout limit. Default is 60 seconds.

Important
You should not enable Debug mode when executing custom content with credentials. If the Client log is in Debug mode, the custom content executed in the endpoint will be logged.