Integrating Central Management System appliances and Endpoint Security (HX) servers

Trellix recommends that you use a Central Management System appliance to manage your Endpoint Security (HX) server to ensure that your server receives the highest-fidelity indicators available. Central Management System of an Endpoint Security (HX) server can be set up using the Central Management System Web UI. See the appendix "Configuring a Managed Appliance" in the Trellix System Security Guide.

Note

Errors result if you attempt to use the Central Management System CLI to set up management of an Endpoint Security (HX) server. Use the Web UI only.

If your Endpoint Security (HX) server and other Trellix appliances are managed by a Central Management System appliance, the Endpoint Security (HX) server automatically receives indicators from the other Trellix appliances. The Central Management System appliance streamlines management of multiple appliances and enhances detection by correlating indicators. See How appliance alerts become Endpoint Security alerts and CM badges.

The Central Management System platform can be used to upgrade and manage an Endpoint Security (HX) DMZ server, with the following caveats.

Indicator updates from the Central Management System appliance or from the DTI (Dynamic Threat Intelligence) Cloud to the DMZ server must be configured separately. See Configuring a CM-managed HXD appliance to get updates from DTI. If these steps are not performed, indicator updates are acquired from the Central Management System appliance and the DTI by the Endpoint Security (HX) server and transferred to the DMZ server.
If you have problems connecting your Central Management System appliance to your DMZ server, consider the firewalls your organization has in place. In some circumstances, the DMZ server is not accessible to the Central Management System appliance because a firewall is blocking the connection.

Central Management System releases earlier than Release 7.6 do not support integration with Endpoint Security (HX) servers. Endpoint Security (HX) releases earlier than Release 2.6 do not support integration with Central Management System appliances. If you are running a Central Management System release earlier than Release 7.6, see Integrating other appliances and HX Series appliances.

Important

Do not attempt to integrate your Endpoint Security (HX) server with a Central Management System appliance if you have already integrated with other Trellix appliances as described in Integrating other appliances and HX series appliances. Using both types of integration will cause errors in the Central Management System integration.

The configuration of your Endpoint Security (HX) server with the Central Management System appliance happens automatically after they are both installed. Use the instructions in this section to ensure the settings on each appliance are correct.

Caution

When you remove a managed appliance from the Central Management System platform, all data (including alert information) associated with the appliance is removed. If you add the appliance again later, the data is restored, but all alerts generated by the appliance are assigned new IDs. Because the alerts have new IDs, Endpoint Security (HX) links for alerts will break if the alerts were generated by the appliance before it was removed from the Central Management System platform.

To configure Central Management System 7.6 or later and Endpoint Security (HX) server integration:

On your Central Management System appliance, enable CLI configuration mode.
```
hostname > enablehostname # configure terminal
```

Determine the latest alert ID on the Central Management System appliance.

hostname (config) # show log matching "alert id"

The output from this command lists log file entries that include the CM Series alert ID.

Mar 16 18:02:51 FireEye_CM notifyd[9696]: tid 5175: [notifyd.INFO]: [inform_fireeye_hx] processing alert id=5762 infection-id=2291 infection-type=malware-object began at:2017-03-17 01:02:51, finish at:2017-03-17 01:02:51 time cost:0 micro-seconds sequence-id=140655883976776

Review the log file and choose a CM Series alert ID. The Endpoint Security (HX) server will start collecting CM Series IOC data for this alert ID after the server attaches to the Central Management System appliance.
In Endpoint Security (HX), the CM Series alert ID is called a bookmark.
On your Endpoint Security (HX) server, enable CLI configuration mode.
```
hostname > enablehostname # configure terminal
```
Set the starting CM Series alert ID for the integration.
```
hostname (config) # hx server detection inbound bookmark <CM-alert ID>
```
where <CM-alert ID> is the starting CM Series alert ID you chose earlier in these steps. The default is 0 (zero), which downloads all of the CM Series alerts to the Endpoint Security (HX) server after the products are integrated.
Caution
FireEye does not recommend selecting a CM Series alert ID of 0 because of the performance impact this may have on your Endpoint Security (HX) server after the initial integration with the Central Management System appliance.
If you accidentally set the CM Series alert ID to 0 and you want to delete all or many of the IOCs downloaded from the Central Management System appliance, temporarily change the Endpoint Security (HX) indicator and alert aging threshold in the Web UI to just a few days. The Endpoint Security (HX) server will automatically delete IOCs that exceed this threshold. See "Managing Real-Time Indicator Detection" in the Endpoint Security Agent (HX) Administration Guide. Alternatively, you can manually remove the IOCs from the Endpoint Security (HX) server using the Indicators page in the Endpoint Security (HX) Web UI.

View detection-related settings for the Endpoint Security (HX) server:

hostname (config) # show hx server detection

Sample output from this command is shown below:

HX Server Detection Configuration:

Generated Indicator Aging: enabled
Generated Indicator Aging Period: 14 days
Alert Aging Period: 30 days
False Positive Alert Aging Period: 1 day

Intel Matching: enabled

                  Legacy notification listener active: no
Malicious.URL Indicator Generation (legacy): yes
Suspicious (noisy) Indicator Generation (legacy): no

Inbound alert poll interval: 5 minutes
Inbound alert minimum severity: majr
No ignored alert types.

Last bookmark ID: 5762

If the Legacy notification listener active field is set to no, Central Management System integration with the Endpoint Security (HX) server is operational and no further steps are necessary. This is the default configuration for Endpoint Security (HX) 2.6 and later appliances.

If the Legacy notification listener active setting is not set to no, proceed with the remaining steps in this procedure.

Disable Trellix legacy appliance support:
```
hostname (config) # no hx server detection legacy enable
```
Important
Do not attempt to integrate your Endpoint Security (HX) server with a Central Management System appliance if you have already integrated with other Trellix appliances as described in Integrating other appliances and Endpoint Security appliances. Using both types of integration will cause errors in the Central Management System integration.
Save your changes:
```
hostname (config # write mem
```
Log in to the Central Management System Web UI and select CMS Settings.
Select Notifications in the left navigation pane.
Click the http table heading to access HTTP notification configuration fields. These fields allow you to access the HTTP connection definitions set up for your FireEye appliance.
If an Endpoint Security (HX) server HTTP connection has been defined, disable HTTP notifications to the Endpoint Security (HX) appliance by clearing the checkbox in the Enabled column of the Endpoint Security (HX) connection definition.

For more information about Central Management System requirements for integration with the Endpoint Security (HX) server, see the Central Management System Administration Guide.

Configuring a Central Management-managed DMZ server to get updates from DTI

You can configure a Central Management-managed DMZ server to obtain updates from DTI rather than from the Central Management.

To configure a Central Management-managed DMZ server to get update from DTI:

On the DMZ server, go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Override the downloads from the Central Management:

hostname (config) # fenet dti source override enable

Apply a custom DTI source:

hostname (config) # fenet dti source default CDN

Verify the configuration:

hostname (config) # show fenet dti configuration

When the configuration is correct, save your changes:

hostname (config) # write memory