Module overview

The Trellix Endpoint Security IOC Streaming module forwards activity events from the Endpoint Security Server to Trellix Helix. The endpoint selects the events to be forwarded based on the rules received from the Endpoint Security Server. The module is pre-configured with a set of rules that covers a large set of weak-signal events. These rules are automatically kept up to date through information received from your DTI subscription. Rules may be created, adjusted, or removed based on changes in the security landscape and feedback received from the customers. The module is included with an API to manage the pre-configured rules and create additional rules according to your needs.