Patch Activity feed configuration with ID

Overview

This endpoint updates an existing activity feed configuration. Target a configuration by its configuration-id and provide only the attributes you want to change in the request body. The API applies the modifications and returns the complete, updated configuration object. Use this API to modify the settings of an active data stream. This is the required method for updating destination details when your infrastructure changes, such as pointing to a new S3 bucket, updating a Syslog server's IP, or changing a webhook URL.

Authentication

Authentication type: Bearer Token, API Key.

You can create a token using client credentials obtained through the developer portal. The API Key (x-api-key) is provided in your onboarding email or on the API Access Management page.

Path (or URL)

<HTTPS Method>
PATCH https://{Trellix EDR_gateway_URL}/edr/v2/activity-feed/configurations/{configuration-id}

Request

Request headers

Authorization: Bearer <your_bearer_token>
Content-Type: application/vnd.api+json
x-api-key: <your_api_key>

Authorization: This header is used to authenticate your request. You need to replace <your_bearer_token> with the actual token you generate.
Content-Type: This header tells the server that the request body format is json:api. Even though this specific call has no request body, the API requires this header.
x-api-key: This is a custom header required by the Trellix API for authentication. You'll need to replace <your_api_key> with the key from your onboarding email or the API Access Management page.

Request parameters

Parameters	Data type/Values	Description
configurationId	string	This is a path parameter. A unique identifier for the configuration.

Request example

The request body must include the resource type and ID. In the attributes object, specify only the fields you want to update. Fields that are not included remain unchanged.

Field	Data type	Description
data.type	String	Must be activityFeed.
data.id	String	The ID of the configuration to update.
data.attributes	Object	An object containing the fields to modify.
Common Attributes
attributes.clientEmailId	String	The email address for notifications.
attributes.enableCompressedOutput	Boolean	Set to true to receive compressed data.
S3 Configuration Attributes (s3Config)
s3Config.s3Prefix	String	The folder path within the S3 bucket.
s3Config.roleARN	String	The Amazon Resource Name (ARN) of the IAM role.
s3Config.s3BucketName	String	The name of the Amazon S3 bucket.
s3Config.awsRegion	String	The AWS region where the bucket is located.
Syslog Configuration Attributes (syslogConfig)
syslogConfig.syslogServerIP	String	The IP address of the syslog server.
syslogConfig.syslogServerPort	String	The port number for the syslog server.
syslogConfig.certificateData	String	The public certificate data for a secure TLS connection.
syslogConfig.testIgnoreMessage	String	A message used to test the connection, which the server will ignore.
Webhook Configuration Attributes (webhookConfig)
webhookConfig.webhookUrl	String	The destination URL for the webhook. Note You must verify the new webhook URL before updating it.
webhookConfig.customHeaders	Object	Key-value pairs of custom headers to send with the webhook.
webhookConfig.testIgnoreMessage	String	A message used to test the webhook connection.

{
  "data": {
    "id": "998f8e3f-d8ca-4acd-a3bd-d15542bf0e02",
    "type": "activityFeed",
    "attributes": {
      "topic": "threatEvents",
      "configType": "s3Config",
      "clientEmailId": "example@gmail.com",
      "enableCompressedOutput": "true",
      "s3Config": {
        "s3Prefix": "/prefix",
        "roleARN": "arn:aws:iam::91574147XXXX:role/EAF_S3CrossAccountAccess",
        "s3BucketName": "test-bucket",
        "awsRegion": "us-west-2"
      }
    }
  }
}

Response

Response example

{
  "jsonapi": {
    "version": "1.0"
  },
  "meta": {
    "totalResourceCount": 1
  },
  "data": {
    "id": "ce5cdfff-7818-455a-bc60-841be3513f4a",
    "type": "activityFeed",
    "attributes": {
      "topic": "threatEvents",
      "clientEmailId": "example@gmail.com",
      "configType": "s3Config",
      "enableCompressedOutput": "true",
      "s3Config": {
        "s3Prefix": "/prefix",
        "roleARN": "arn:aws:iam::91574147XXX:role/EAF_S3CrossAccountAccess",
        "s3BucketName": "example-bucket",
        "awsRegion": "us-west-2"
      }
    }
  }
}

Response codes

Status	Response	Description
200	OK	Your request was processed successfully. The server has returned the requested data.
400	Bad request	The server couldn't understand your request, likely due to a syntax error or an invalid parameter.
401	Access denied request	Your request was rejected because it lacks valid authentication credentials. Check your API key and token.
403	Forbidden	You are not authorized to access this resource. While your credentials may be valid, you don't have the necessary permissions.
404	Not Found	The specific resource or endpoint you requested does not exist.
415	Unsupported Media Type	The server rejected your request because the data format `(Content-Type)` is not supported.
429	Too Many Requests	You've exceeded the rate limit by sending too many requests in a short period. The `Retry-After` header in the response will tell you how long to wait before trying again.
500	Internal Server Error	Something went wrong on the server's end. This is not an issue with your request.