The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Get IOC Streaming configuration

Prev Next

Returns the current configuration of the IOC Streaming module as a JSON result.

HTTP Verb

Server

GET

hx/api/services/config/tree

Query Parameters

Parameter

Notes

node_name=/config/ioc-streaming

Pulls the IOC Streaming configuration.

The information that is returned is a JSON dictionary with the following keys:

Response

Key

Notes

Data

List of configuration properties. Each property has the following attributes:

  • name: The name of the configuration property

  • type: The shape of the value for the configuration property

  • value: The current value of the configuration property

  • default_value: The default value of the configuration property

The following is a list of configuration properties for the IOC Streaming module:

Purpose

Name

Type {Values}

Logging level

/config/ioc-streaming/logging/level

String {'debug' | 'info' | 'warning' | 'notice' | 'error' | 'critical' | 'alert' | 'emergency'}

Data Aging monitor

/config/iocstreaming/aging/database

Int32 (number of seconds) Default = 1 Day

Range: 5 mins to 7 days.  Avoid adjusting this value unless directed by support.

Statistics offset hours

/config/ioc-streaming/statistics_collection

Int32 (number of hours) Default = 0 Hours

Range: 0 to 23

Statistics offset minutes

/config/ioc-streaming/statistics_collection

Int32 (number of hours) Default = 0 Minutes

Range: 0 to 59

Base URL for Helix ingest  

/config/ioc-streaming/helix/override/base_url

String, default is empty.  Used when the destination environment stack for Helix is not production.  For example, when targeting a QA stack, use the value '.qa.ingest.apps.fireeye.com'.

Data Aging period

/config/ioc-streaming/aging/database/period

Int32: (number of seconds) Default = 30 Days

Interval of when an indicator or condition marked for deletion will be removed from the database. By default, an indicator will be removed 30 days after it was marked for deletion.

ConfAPI_1.png
ConfAPI_2.png