POST - Threat Remediation

Overview

This endpoint initiates a remediation action against a specified threat on one or more endpoints. By defining an action, threatId, and a list of affectedHostIds, you can trigger a response like stopping and removing a malicious process. The API creates an asynchronous job and returns an ID for tracking its progress and final status. Use this API as the action component in a SOAR playbook to automatically contain threats upon detection, or to apply a remediation action across many endpoints for a scaled response. This API closes the loop from detection to response, enabling automated containment at scale to dramatically reduce threat impact.

Authentication

Authentication type: Bearer Token, API Key.

You can create a token using client credentials obtained through the developer portal. The API Key (x-api-key) is provided in your onboarding email or on the API Access Management page.

Path (or URL)

POST https://{Trellix EDR_gateway_URL}/edr/v2/remediation/threat

Request

Request headers

Authorization: Bearer <your_bearer_token>
Content-Type: application/vnd.api+json
x-api-key: <your_api_key>
X-MVEDR-Source: <source_region>
X-Trace-Id: <trace_id_value>

Request body

Example:

{
  "data": {
    "type": "threatRemediation",
    "attributes": {
      "action": "StopAndRemove",
      "threatId": "3500",
      "processName": "Keep-Running.exe",
      "affectedHostIds": [
        "99848",
        "99849"
      ]
    }
  }
}

Request parameters

There are no request parameters.

Response

Response example

{
  "data": {
    "type": "threatRemediation",
    "id": "tr-5432",
    "attributes": {
      "success": [
        {
          "status": "200",
          "message": "in-progress",
          "affectedHostIds": [
            "99848"
          ]
        }
      ],
      "failed": [
        {
          "status": "404",
          "message": "Not Found",
          "affectedHostIds": [
            "99849"
          ]
        }
      ]
    },
    "links": {
      "self": "/edr/v2/remediation/queue-jobs/tr-5432"
    }
  }
}

Response codes