Set up your Webhook

Prev Next
  1. Register an endpoint with the public key using the initial endpoint details provided within the controller or by directly invoking the webhook verification endpoint.

    https://api.manage.trellix.com/edr/v2/activity-feed/webhook-verification

    • Register using the initial endpoint details provided within the controller.

      curl --location 'http://localhost:<port>/<webhook_url>/initiate' --header 'Authorization: <tenant_token>' --header 'server_url: https://api.manage.trellix.com/edr/v2/activity-feed/webhook-verification' --header 'client_url: https://<webhook_domain>/<webhook_url>' --header 'Content-Type: application/vnd.api+json' --verbose

    • Register by directly invoking the webhook verification endpoint.

      {
          "data": {
              "type": "activityFeed",
              "attributes": {
                  "publicKey": "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJ******************ertKn+6rqJ2/CCljR5bjyzNfesg1AkcCT553MLUCAwEAAQ==",
                  "webhookUrl": "https://<webhook_domain>/<webhook_url>"       
      
           }
          }
      }
  2. Configure a webhook using the following payload.

    https://api.manage.trellix.com/edr/v2/activity-feed/configurations

    {
        "data": {
            "type": "activityFeed",
            "attributes": {
                "topic": "case-mgmt-events", // topic: case-mgmt-events or threatEvents
                "clientEmailId": "tenant@yopmail.com",
                "configType": "webhookConfig", // config type: syslogConfig  or s3Config or webhookConfig
                "enableCompressedOutput": false, // enable/disable compression of data in sinks: true or false
                "webhookConfig": {
                    "webhookUrl": "https://<webhook_domain>/<webhook_url>",
                    "testIgnoreMessage": "successful"
                }
            }
        }
    }
  3. Set up a client controller.

    1. Check out a client controller code from the repository.

    2. Build a jar file once the changes for the client controller file are done (For example, webhook url, custom headers etc.)

      ./gradlew clean build

    3. Get the jar file from build/libs/.

      cd build/libs/ &gt; trellix-edr-activity-feed-0.0.1-SNAPSHOT.jar

    4. Copy the jar file to the server hosting webhook.

    5. Run the client controller.

      java -Dserver.port=&amp;lt;port_num&amp;gt; -jar trellix-edr-activity-feed-0.0.1-SNAPSHOT.jar

    6. Trigger EAF APIs to configure a webhook.