Integrating with Trellix ePolicy Orchestrator

Note
The integration capability is available only to users with an Enterprise or Core license.

Trellix ePolicy Orchestrator - On-premises is a scalable platform for centralized policy management and enforcement of your system security products, such as anti-virus, desktop firewall, and anti-spyware applications. You can integrate Network Detection and Response NDR System with Trellix ePO - On-prem. The integration enables you to query Network Detection and Response ePO - On-prem server from the Network Detection and Response NDR for viewing details of a network host.

The integration bridges the gap between network-centric and endpoint-centric security data, providing more context for analysis.

Log into the NDR CLI using a terminal window or SSH client:
1. Using the SSH protocol, log into the appliance with management interface's IP address or hostname.
```
$ ssh npadmin@<NDR IP address>
```
2. Enter the password when prompted. The hostname > prompt is displayed after you have logged in.
Enter privileged mode on the NDR CLI.
```
npadmin@hostname> enable
```
Enter configuration mode.
```
npadmin@hostname# configure system
```
The prompt changes to npadmin@hostname(config)# on the terminal indicating that configuration mode is enabled.
Type epo configure at the terminal and press Enter.
The ePO Configuration options are displayed.
1. Type 3 and press Enter to enable integration.
2. Type 1and press Enter to specify a unique identifier for this integration.
3. Type 2and press Enter to specify the details about the purpose of this integration.
4. Type 4and press Enter to define the network address of the ePO server to connect to.
5. Type 5and press Enter to specify the communication port used to interact with the ePO server.
6. Type 6and press Enter to add a account name used for authentication with the ePO server.
7. Type 7and press Enter to add the secret key used to authenticate the connection to the ePO server.
8. Type 8and press Enter to check whether data from this integration will be used to enhance alerts.
9. Type 9and press Enter to set the frequency at which Network Detection and Response retrieves data from ePO.
10. Type 10and press Enter to check if Network Detection and Response is actively sending tasks or commands to ePO.
11. Type 11and press Enter to allow assigning a label to this integration for easier organization and filtering.
Type D and press Enter to delete ePO configuration.
Type T and press Enter to test connection to NDR.
Type Q and press Enter exit the configuration page.
Type S and press Enter to save and exit to the main menu.