Trellix EDR APIs

Gateway URL — get the gateway URL from the Trellix on-boarding email. For example, https://api.manage.trellix.com.

Authorization key — generate a token using the Trellix Developer portal or from Client Credentials option in Trellix IAM. For more information on generating Client Credentials and Token from Trellix IAM, see Managing your client credentials in IAM.

Note

If you encounter API SKU or Developer Hub SKU errors while accessing any information in the Trellix Developers portal or Trellix Market place, use the following links:

• Trellix Developers Portal

• Trellix Marketplace

The client credentials are available in your Trellix on-boarding email. However, you can follow these steps to generate credentials again

Managing your client credentials in IAM

To generate Client Credentials and Access Token from Trellix IAM, follow the below steps.

x-api-key — get the x-api-key from your on-boarding email. Also, you can navigate to the API Access Information page to fetch the API key.

soc.hts.c — create historical search query

soc.hts.r — read historical search query status and results

soc.rts.c — create real-time search query

soc.rts.r — read real-time search query status and results

mi.user.investigate — read and write investigation cases

soc.act.tg and mi.user.config — read and write remediation requests

soc.act.tg — get threats and alerts

soc.edrfd.w and soc.edrfd.r — read and write activity feed configurations

API sample for Real-time Search

API sample for Historical Search

API sample for Investigation

API sample for Remediation

API sample for Threats and Alerts

API sample for Activity feed