Create Reaction

Overview

This endpoint creates a custom reaction in the Trellix EDR environment. Provide a JSON payload that includes the reaction name, execution content (such as scripts), and required arguments. The response returns the created reaction with a unique identifier and associated metadata. Use this endpoint to define response actions that execute specific commands or scripts on endpoints.

Authentication

Authentication type: Bearer Token, API Key.

You can create a token using client credentials obtained through the developer portal. The API Key (x-api-key) is provided in your onboarding email or on the API Access Management page.

Path (or URL)

<HTTPS Method>
POST https://{Trellix EDR_gateway_URL}/edr/v2/reactions

Request

Request headers

Authorization: Bearer <your_bearer_token>
Content-Type: application/vnd.api+json
x-api-key: <your_api_key>

Request example

{
  "data": {
    "type": "reactions",
    "attributes": {
      "name": "_Check_New_reaction",
      "description": "Creating a new reaction",
      "contents": [
        {
          "platform": {
            "name": "windows"
          },
          "capability": {
            "name": "Execute Powershell Script"
          },
          "content": "ls"
        }
      ],
      "arguments": [
        {
          "name": "ABC",
          "type": "NUMBER"
        }
      ],
      "timeout": 60
    }
  }
}

Response

Response example

{
  "data": {
    "id": "587",
    "type": "customReactions",
    "attributes": {
      "catalogVersion": 0,
      "metadata": {},
      "hidden": false,
      "dbVersion": 0,
      "description": "Creating a new reaction",
      "timeout": 60,
      "internalArguments": {},
      "internalName": "_Check_New_reaction",
      "remediation": false,
      "task": "REACTION",
      "contents": [
        {
          "id": "11976",
          "platform": {
            "catalogVersion": 1307,
            "dbVersion": 0,
            "id": "1",
            "name": "windows",
            "topic": "/mcafee/mar/agent/query/windows",
            "enabled": true
          },
          "capability": {
            "catalogVersion": 1307,
            "dbVersion": 0,
            "id": "27",
            "name": "Execute PowerShell Script",
            "description": "Runs Windows PowerShell Scripts",
            "module": "SystemRuntime",
            "function": "executePS",
            "contentEnabled": true,
            "outputs": [],
            "formatArgs": {
              "hasHeaders": false,
              "delimiter": ","
            },
            "format": "CSV",
            "platforms": [
              {
                "catalogVersion": 1307,
                "dbVersion": 0,
                "id": "1",
                "name": "windows",
                "topic": "/mcafee/mar/agent/query/windows",
                "enabled": true
              }
            ],
            "platformSettings": [
              {
                "id": "5346",
                "platform": {
                  "catalogVersion": 1307,
                  "dbVersion": 0,
                  "id": "1",
                  "name": "windows",
                  "topic": "/mcafee/mar/agent/query/windows",
                  "enabled": true
                },
                "utf8Sensitive": false
              }
            ],
            "itemType": "CUSTOM",
            "catalogItems": [
              "REACTION",
              "COLLECTOR"
            ]
          },
          "content": "ls\r\n",
          "arguments": [],
          "utf8Sensitive": false
        }
      ],
      "availableForTrigger": true,
      "name": "_Check_New_reaction",
      "arguments": [
        {
          "id": "2946",
          "name": "abc",
          "type": "NUMBER",
          "optional": false
        }
      ],
      "availableOffline": false
    }
  },
  "links": {
    "self": "/edr/v2/reactions/587"
  }
}

Response codes