events section settings

The events section settings control how Endpoint Security (HX) xAgent handles real-time events and intelligence downloads.

Select a setting from the table below to go to the edit methods Trellix supports.

Setting Key	Default	Supported Edit Methods
Setting Key	Default	Web UI	CLI	API
active_collection_enabled	true	Yes	Yes	Yes
excludedPaths	---	Yes	Yes	Yes
excludedProcessNames	---	No	No	Yes
intel_poll_sec	900	Yes	Yes	Yes
intel_uri	`/content/v1/intel/default/win_iocv2`	No	Yes	Yes
max_db_size	100	No	No	Yes
storage_mode	---	No	No	Yes
udp_send_events	false	No	No	Yes

active_collection_enabled Key

The active_collection_enabled key indicates whether real-time data collection is allowed. Valid values are true (allow real-time data collection) and false (do not allow real-time data collection). The default is true.

Change this setting using one of the following methods:

Web UI .
API custom configuration channels (see Using API Custom Configuration Channels).
Manually on individual endpoints using a text editor (see Modifying the Configuration File for a Single Endpoint).

excludedPaths Key

The excludedPaths key specifies the files and folders to be excluded from monitoring of file write events for real-time indicator detection global exclusion policy. This policy must be enabled using the Web UI. If the policy is not enabled, this setting is ignored.

Use quotation marks (") to specify the file or folders you want excluded from real-time indicator detection and commas to separate each entry. Enclose the full list of files and folders in brackets ([]). For example:

"excludedPaths": [
    "%WINDIR%\\system32\\",
    "%ProgramData%\\FireEye\\xagt\\events.*"
]

File and folder exclusions apply to file write events only.
UNC names are supported in excludedPaths.
On Windows endpoints, file and folder paths must start with a drive letter followed by a colon (C:) or UNC name (\\Server\Share).
System environment variables are supported in excludedPaths:
- %ProgramFiles%, %ProgramFiles(x86)%, %ProgramW6432%, %CommonProgramFiles%, %ProgramData%
- %SystemDrive%, %SystemRoot%, %windir%
- %ALLUSERSPROFILE%, %PUBLIC%
  Important
  Use care when specifying system environment variables in folder paths. Their expanded paths may vary based on the installed version of Windows. For complete information about Windows environment variables, refer to your Windows documentation (Microsoft TechNet).
  User-specific environment variables are not supported because the Endpoint Security (HX) Agent runs on the endpoint as SYSTEM. For example, %HOMEDRIVE%\Users\*\Documents\*.* is an invalid path because it includes a user-specific environment variable.
  Wildcard characters (*) and (?) are not supported in file and folder paths.

The following table lists examples for excluding files and folders from real-time detection processing. Reference these examples when adding file and folder excludedPaths to your real-time indicator detection exclusion list.

Exclusion Method	Exclusion Example
Exclude a specific file name.	`myfile`
Exclude a specific file name located in a specific directory.	`C:\Users\Admin\Documents\myfile.txt`
Exclude all files in a specific directory.	`C:\Users\Admin\Documents*.TXT`
Exclude all files and sub directories in a specific directory.	`C:\Users\Admin\Documents\C:\Users\Admin\Documents`

Change this setting using one of the following methods:

Web UI (see Excluding Files, Folders, and Processes from RTID).
API custom configuration channels (see Using API Custom Configuration Channels).
Manually on individual endpoints using a text editor (see Modifying the Configuration File for a Single Endpoint).

excludedProcessNames Key

The excludedProcessNames key specifies the processes to be excluded from Windows real-time event monitoring, including registry, url, file, and image load events.

Note

The excludedProcessNames key is not available on macOS endpoints.

You must use the Web UI or the API to enable Real-Time Indicator Detection. The excludedProcessNames key is ignored if Real-Time Indicator Detection is not turned on.

Please note that certain classes of events (for example, DNS lookup events) are not included in excluded processes.

Specify the full path to the processes you want excluded from real-time monitoring in quotation marks ("), using commas to separate entries. Enclose the full list of files and folders in brackets ([]). For example:

"excludedProcessNames": [
    "%VS120COMNTOOLS%..\\..VC\\bin\\cl.exe",
    "%VS120COMNTOOLS%..\\..\\VC\\bin\\x86_amd64\\cl.exe",
    "%VS120COMNTOOLS%..\\..\\VC\\bin\\link.exe"    				
]

Change this setting using one of the following methods:

API custom configuration channels (see Using API Custom Configuration Channels ).
Manually on individual endpoints using a text editor (see Modifying the Configuration File for a Single Endpoint).

intel_poll_sec Key

The intel_poll_sec key specifies the interval (in seconds) at which polling for intelligence occurs. The default is 900 seconds.

Change this setting using one of the following methods:

Web UI (see Configuring the Update Interval for Malware Protection Indicators).
API custom configuration channels (see Using API Custom Configuration Channels).
Manually on individual endpoints using a text editor (see Modifying the Configuration File for a Single Endpoint).

intel_uri Key

The intel_uri key identifies the URI from which intelligence is downloaded. The default is /content/v1/intel/ioc/win-current_xagent_win.

Change this setting using one of the following methods:

API custom configuration channels (see Using API Custom Configuration Channels).
Manually on individual endpoints using a text editor (see Modifying the Configuration File for a Single Endpoint).

max_db_size Key

The max_db_size key specifies the maximum size, in megabytes (MB), of the agent event database. The default is 100 MB.

Important

This setting is not the same setting as the Endpoint Security server default database size of 120 MB set using the Web UI and the API (see Setting the Global Policy Event Storage Use Limit).

Removing the max_db_size setting from the configuration file will cause the agent event database size to shrink.

Change this setting using one of the following methods:

API custom configuration channels (see Using API Custom Configuration Channels).
Manually on individual endpoints using a text editor (see Modifying the Configuration File for a Single Endpoint).

storage_mode Key

The storage_mode key identifies the agent's disk storage mode. Only change this setting if your host endpoints experience a degradation in I/O processing times.

Important

Changing storage mode may lead to the loss of historical data. Complete all incident response investigations on your host endpoint before changing the storage mode.

The table below describes the available storage modes.

Storage Mode	Description	Configuration
Conventional	This is the default storage mode. This storage mode stores write events in batches before writing them to the events database on disk. Important Use one of the other storage modes only if your endpoints experience a degradation in I/O processing times.	To select the default storage mode, remove the `storage_mode` key from the configuration file.
Memory-mapped I/O with log	This is the recommended memory-mapped storage mode. In this storage mode, read and write operations are backed by memory and backed by an on-disk journal file. Write transactions are written to the Write Ahead Log file (`events.db-wal`) then committed to the events database. The journal file prevents database corruption caused by unexpected restarts. This mode produces efficient disk I/O performance because read transactions are in memory. Memory-mapped I/O with log mode improves disk I/O performance for two reasons. Event processing does not need to transition to kernel mode to read and write data. Event data is stored in memory as much as possible and is written to the events database only when necessary. Before changing to this storage mode in your production environment, you should first determine the impact of the change in a test environment.	To select this storage mode, set the storage_mode key to `mmapiowithlog`.
In-memory	This storage mode stores the events database in memory. This mode increases memory usage, but improves disk I/O performance. Consider the following caveats before switching to in-memory storage mode. The in-memory events database is volatile. Events in the in-memory database are lost when the agent restarts or when event processing is restarted. Consequently, in-memory mode is best used for machines that remain running for long periods (such as servers). Any previous events database on disk remains untouched and unmodified. Events stored in it are not transferred to the in-memory database. If you switch back to the default storage mode, your agent resumes updating the events database on disk and the events in the in-memory database are lost.	To select this storage mode, set the `storage_mode` key to `inmemory`.
Memory-mapped I/O NOT RECOMMENDED	Use of this storage mode is not recommended because it may cause failure of Real-time Event storage and functionality. Please use MMAPIOWITHLOG. This storage mode uses memory mappings to back up read and write operations, and uses paging to optimize the read and write operations.	To select this storage mode, set the `storage_mode` key to `mmapio`.

Change this setting using one of the following methods:

API custom configuration channels (see Using API Custom Configuration Channels).
Manually on individual endpoints using a text editor (see Modifying the Configuration File for a Single Endpoint).
Manually by using the Endpoint Security UI.

udp_send_events Key

The udp_send_events key indicates whether UDP (network) events should be captured. Valid values are true (capture UDP events) and false (do not capture UDP events). The default is false.

Change this setting using one of the following methods:

API custom configuration channels (see Using API Custom Configuration Channels).
Manually on individual endpoints using a text editor (see Modifying the Configuration File for a Single Endpoint).