The Trellix Endpoint Security IOC Streaming module allows users to forward interesting events from endpoints to Trellix Helix for further investigation. The module is pre-configured with a set of rules that covers a large set of weak-signal events. The endpoint selects the events to be forwarded based on the rules. These rules are automatically kept up to date through information received from your DTI subscription. Rules may be created, adjusted, or removed based on changes in the security landscape and feedback received from the customers. The module is included with an API to manage the pre-configured rules and create additional rules according to your needs. IOC Streaming centralizes important information for you enabling new workflows such as event correlation and analytics and will open the possibility to store data for a longer period of time.
For a web interface-based experience of working with rules HXTool can be used (FireEye Market).