Log specifications for Trellix Helix

Trellix Helix data source inputs are most useful when structured with consistent formatting to allow the most efficient normalization and parsing. This allows integration with all Trellix Helix features and provides you with continuous reporting through a common taxonomy.

Trellix Helix uses the Communication Broker (Comm Broker) Sender to accept machine-generated messages and logs from hardware devices, operating systems, applications, security appliances, network devices, and databases through a variety of methods.

The Comm Broker looks for events formatted as the following (in descending order of preference):

Important

If a backslash (\) is used in events formatted as JSON, CEF, or LEEF, it must be escaped with another backslash. For example, C:\\Windows\\explorer.exe.

The following character encoding is supported:

For streaming inputs (TCP, named pipe), the Comm Broker Sender expects line feed-separated messages or records.

Trellix Helix accepts and processes events sent through syslog UDP/TCP streams and the cloud integrations available on the Cloud Connect page of the Trellix Helix Web UI.