Integrating NDR Console with Trellix Hyperautomation

NDR integrates with Hyperautomation to streamline incident response and automate manual security tasks. This integration speeds up incident resolution, reduces manual effort, and strengthens network security.

Integration prerequisites

Before integrating Trellix NDRC with Hyperautomation, ensure the following prerequisites are met:

Hyperautomation Subscription Add-On
Your NDR subscription must include the Hyperautomation add-on. This enables access to the automation features required for integration.
Note
Hyperautomation is supported only on Core and Enterprise licences.
Hyperautomation deployment on Ubuntu VM
Set up an Ubuntu VM that meets the system requirements for Trellix Hyperautomation. Refer to the Trellix Hyperautomation product guide for complete setup instructions.
Retrieve Hyperautomation configuration parameters
Run the following commands from /opt/trellix/hyperautomation/bin directory below to retrieve the required parameters needed for integration:
```
sudo ./setupctl show config | grep -E
```
The command retrieves the following parameters: tenantId, serviceExternalAuthTokenURL, userManagementClientID, tokenIssuer, tokenExchangeURL
```
sudo ./setupctl show secrets
```
The command retrieves the following parameters: userManagementClientSecret. Use the retrieved parameters to complete the integration within the Trellix NDR UI.

Enable Hyperautomation response features in NDR Console

To enable Hyperautomation response features in NDR, you must configure the integration parameters using the CLI.

Securely connect to your Trellix NDR appliance as npadmin.
Use the management interface's IP address or FQDN to replace <ndr-ip-or-fqdn> in your connection.
Enter privileged mode on the CLI.
npadmin@hostname> enable
Enter the npadmin password when prompted.
Enter configuration mode.
npadmin@hostname# configure system
Type hyperautomation and press Enter.
The Hyperautomation Integration interface is displayed.
Follow the instructions and options provided on the interface to configure Hyperautomation integration settings.

Note
The Last SAML Session parameter is a read-only setting that displays the timestamp of the last successful Single Sign-On (SSO) request.

Important
For more information on how to enable end-to-end automated response by linking alert categories to Trellix Hyperautomation workflows for seamless automatic and manual threat remediation, see the Hyperautomation section.