Post Activity Feed configuration

Overview

This endpoint creates a data feed to stream EDR events to an external system. Specify an event topic and a configType (S3, Syslog, or Webhook) with the required destination details. A successful call registers the feed and returns its configuration. Use this API as the final step to activate a continuous data stream to your chosen platform. This is the primary method for forwarding all threat events to your data lake (S3), sending alerts to your SIEM (Syslog), or pushing notifications to a custom automation tool (Webhook). This API automates the centralization of your Trellix EDR data, ensuring your other security platforms have the complete, real-time visibility needed for effective correlation and analysis.

Authentication

Authentication type: Bearer Token, API Key.

You can create a token using client credentials obtained through the developer portal. The API Key (x-api-key) is provided in your onboarding email or on the API Access Management page.

Path (or URL)

<HTTPS Method>
POST https://{Trellix EDR_gateway_URL}/edr/v2/activity-feed/configurations

{Trellix EDR_gateway_URL}: This is the base URL for your instance, which you can find in your Trellix onboarding email. For example, https://api.manage.trellix.com.

Request

Request headers

Authorization: Bearer <your_bearer_token>
Content-Type: application/vnd.api+json
x-api-key: <your_api_key>

Authorization: This header is used to authenticate your request. You need to replace <your_bearer_token> with the actual token you generate.
Content-Type: This header tells the server that the request body format is json:api. Even though this specific call has no request body, the API requires this header.
x-api-key: This is a custom header required by the Trellix API for authentication. You'll need to replace <your_api_key> with the key from your onboarding email or the API Access Management page.

Request parameters

No request parameters.

Request example

For this endpoint, you will specify the type of event (topic) to send and the destination details (S3, Syslog, or Webhook).

Before you customize a request for an event type, make sure you have the following information.

A topic can only be registered with one sink.
Make sure you have set up the AWS account with the right configurations.
For details, see Set up your AWS account. If no S3 prefix is provided, the threat events or case-management events folder will be created within the root folder of the S3 bucket.
Make sure you have set up the Syslog account with right configurations. For details, see Set up your Syslog account.
For the Syslog request body, the entire certificate details (including --BEGIN-- and --END-- for both single and multi-chain) need to be provided in a base64 encoded format.
'server-cert.pem' generated during the Syslog setup is the certificate data to be base 64 encoded and provided in the request body.
Make sure you have set up your Webhook. For more details, see Set up your Webhook.
For a webhook, the self-signed certificate is blocked and only CA-signed is allowed.

{
  "data": {
    "type": "activityFeed",
    "attributes": {
      "topic": "threatEvents | case-mgmt-events",
      "configType": "s3Config | syslogConfig | webhookConfig",
      "clientEmailId": "client@gmail.com",
      "enableCompressedOutput": "true",
      "s3Config": {
        "s3Prefix": "/prefix-path",
        "roleARN": "arn:aws:iam::91574147XXXX:role/customer_eaf_s3_cross_account_role",
        "s3BucketName": "customer-eaf-bucket",
        "awsRegion": "us-west-2"
      },
      "syslogConfig": {
        "syslogServerIP": "10.10.10.10",
        "syslogServerPort": "615",
        "certificateData": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tDU1JSUN3RENDQWFnQ0FRRXdEUVlKS29aSWh2Y05BUUVMQlFBd0pERWlNQ0FHQTFVRUF3d1pjMlZzWm5OcFoyNWwNWkMxallTMWpaWEowYVdacFkyRjBaVEFlRncweU5EQTBNVGt4TURVd016QmFGdzB6TkRBeU1qWXhNRFV3TXpCYQ1NQ2d4SmpBa0JnTlZCQU1NSFhObGJHWnphV2R1WldRdGMyVnlkbVZ5TFdObGNuUnBabWxqWVhSbE1JSUJJakFODUJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXMxdTQ5blVNblMxQ1NuRzMvaks2eWhuRjQ1eUQNdy9GbnkxVmYzQ2hkd0FKSXlnbnN1SUl4VERmS2VZVjdrK09iVHZKeUlwMmRhRHZPdkI2eEUwQ3hMa2JNVnhWbQ1INnpCeVdYOW5Ha2hxUHY3Sk05aGJjMXFzMFZMTlp0K2tXR0tidCtRUFpIV0ozRlV6cDBuZGNRS1J1RTdlaDVyDVA2WGpVV2FrUmF5TDdJN3YrTUhuaDBmalpnUTZDa2lzK2pHRmpjVlU2cHZ5SEVRNWo0Z2dDMU1uYTZFTjR1Mm8NNm05cVIrQko2OUwwZnlaZkpNMk9zSlZwQTZMZS9BUkJXVGhXdlgyaHVvSVJwbHg5dnppK3JmeEpqUnUwSk8xRg1uaElFWkg2OHRESVFvU04rakIzcDBYTUxKT3o0NXdFQ0JCTGFsWmJmNWlETkZIZDExUnBIRFlZdXlRSURBUUFCDU1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQnc1L1NoQVExbFNtOTRxZG1wTzJibWE1RlM4TytMRzYzTjhqRksNUjlkT0RRRVBsdllzRVozVGNMT01ENm5GZjEyTE5waVcvMUY1ZmJFSlBWY0NRcW1xNTM1Z1NMb05tZUxtZTlhNQ11ZWJrOVJ3cHBmd0J2UVFwdkY1ODF2Q05NOGdEWC92TWZraEVwUEZzZE9MdHlMRW9OSDVwVE1obkZmVjhMa1Y0DWw0cHFadkxZZEpQMGNTRWwxUGExRzlRK3J6RkZoT0JZWVVRdGZJL2lXbjRHdk1NZ1NpNURLTlViQzUyQ29YSnUNckRpeFJkcFQvdmpSR0VZTWJJYVZ3MWRpUnd3clVxL2FJRzRHSTFGWVFGSHFZQlNHQUJ2bW1IVXE3Yy9uakN2Mw1MVDQ4ak1ZdGhxb1ZZR25naXlWQ28wTndweVN1MjlEMzR2WUZnSE1JQkJpdHlpWTQNLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ",
        "testIgnoreMessage": "TEST-MESSAGE"
      },
      "webhookConfig": {
        "webhookUrl": "https://www.abc.com/webhook",
        "testIgnoreMessage": "TEST-MESSAGE",
        "customHeaders": {
          "key": "value"
        }
      }
    }
  }
}

Response

Response example

{
  "jsonapi": {
    "version": "1.0"
  },
  "meta": {
    "totalResourceCount": 1
  },
  "data": {
    "id": "ce5cdfff-7818-455a-bc60-841be3513f4a",
    "type": "activityFeed",
    "attributes": {
      "topic": "threatEvents",
      "clientEmailId": "example@gmail.com",
      "configType": "s3Config",
      "enableCompressedOutput": "true",
      "s3Config": {
        "s3Prefix": "/prefix",
        "roleARN": "arn:aws:iam::91574147XXX:role/EAF_S3CrossAccountAccess",
        "s3BucketName": "example-bucket",
        "awsRegion": "us-west-2"
      }
    }
  }
}

Response codes

Status	Response	Description
201	Created	Your request was successful, and a new resource was created as a result. The URL to the new resource can be found in the Location header.
400	Bad request	The server couldn't understand your request, likely due to a syntax error or an invalid parameter.
401	Access denied request	Your request was rejected because it lacks valid authentication credentials. Check your API key and token.
403	Forbidden	You are not authorized to access this resource. While your credentials may be valid, you don't have the necessary permissions.
404	Not Found	The specific resource or endpoint you requested does not exist.
415	Unsupported Media Type	The server rejected your request because the data format `(Content-Type)` is not supported.
429	Too Many Requests	You've exceeded the rate limit by sending too many requests in a short period. The `Retry-After` header in the response will tell you how long to wait before trying again.
500	Internal Server Error	Something went wrong on the server's end. This is not an issue with your request.