Trellix recommends that you specify every configuration file setting (for which you do not want the agent default values) when you create a custom configuration channel. See Agent Configuration File Reference.
The only exceptions to this are the values for the credentials and serverlist sections of the configuration file and the following individual configuration settings: channel, id, name, ts, type, and version. The values for these configuration file settings cannot be specified using custom configuration channels and any attempts to do so will be overridden by the Endpoint Security (HX) API with values established during Endpoint Security (HX) server and agent deployment.
To create a custom configuration channel:
Use the API to request the custom configuration channel be added. Here is a sample cURL request.
curl 'http://<HX_IP_address>:<port_number>/hx/api/v3/host_policies/channels' -X 'POST' --data-binary '{"name”:”<name>","host_sets":[ {"_id":<host_set_ID1>}, {"_id":<host_set_ID2>},...], "description":"<description>","priority":<priority> configuration: {"<key1>":"<value1>", "<key2>":"<value2>",...}' -H 'X-FeApi-Token: <API_token>' -H 'Accept: application/json' -H 'Content-Type: application/json'To identify host set IDs, see Identifying Host Set IDs Using the API. For information about priority settings, see Understanding Configuration Channel Priorities. For information about the configuration settings (the key/value pairs in the cURL request above), see Agent Configuration File Reference.
For complete information on API custom configuration channel endpoints, see the Endpoint Security (HX) REST API Guide.