Steps for gaining access to consume threat events

To get API Key, client ID and Client Secret details, refer Developer portal.

Important

The access token is valid for 24 hours. After the token expires, a new token must be retrieved before submitting the Threat Events API again.

1. Sign up for an ePO - SaaS account: https://auth.ui.trellix.com.

2. Trellix sends a user activation email and a welcome email containing the ePO - SaaS URL. Activate your account before logging on to ePO - SaaS.

3. Log on to ePO - SaaS and deploy Trellix ENS to client systems.

4. Configure Trellix Enterprise Security Manager - Event Receiver to use Threat Events API.

   1. Retrieve an access token:

      curl --location 'https://iam.us.trellix-gov.com/iam/v1.1/token' \--header 'Content-Type: application/x-www-form-urlencoded' \--user '<CLIENT_ID:CLIENT_SECRET>'--data-urlencode 'grant_type=client_credentials' \--data-urlencode 'scope=epo.evt.r epo.admin'

      Note

      Multi-factor authentication enabled accounts can't retrieve access tokens.

   2. The response contains an access token which is used to retrieve threat events.

      Region-based Threat Event API call

      Region	API Gateway	New URL (Trellix)
      United States	https://api.manage.trellix.com	https://arevents.manage.trellix.com
      Singapore		https://areventssgp.manage.trellix.com
      Frankfurt		https://areventsfrk.manage.trellix.com
      Sydney		https://areventssyd.manage.trellix.com
      India		https://areventsind.manage.trellix.com

      
      
      

      Here's a sample Threat Event API call for United States.

      curl --location --request GET 'https://api.manage.trellix.com/epo/v2/events?page%5Blimit%5D=1000' \--header 'Content-Type: application/vnd.api+json' \--header 'x-api-key: <TRELLIX_API_KEY>' \--header 'Authorization: Bearer ZZZZZ' \

      Note

      Replace ZZZZZ with the bearer token and run the script through Postman to view the events.