The Trellix Network Detection and Response (NDR) platform offers a RESTful API with role-based access control (RBAC). Security teams and administrators use this API to interact programmatically with the NDR Console.
Core capabilities of the Trellix NDR APIs include:
Asset discovery
Retrieve information about devices and systems monitored by Trellix NDR programmatically.
Get Asset Details: Retrieve specific information about tracked assets.
Asset Categorization: Get the total number of assets across all categorized groups.
Network flow and Layer-7 metadata
Extract rich network telemetry for threat investigation.
Layer-7 Metadata: Retrieve application-layer details using GET requests.
Flow Summaries: Extract summary data for network flows across a single host or an entire cluster using GET and POST methods.
Queries and search management
Automate threat hunting and data extraction by managing queries directly through the API.
Elasticsearch Queries: Send direct queries to the underlying Elasticsearch database to retrieve cluster or node information.
Saved Queries & Term Lists: Create, run, retrieve, or delete saved searches and term lists for specific users.
Scheduled Searches: Manage scheduled searches and pull resulting search reports.
Authentication and certificate management
Manage user and system authentication with the platform.
Session Management: Handle login, logout, and Two-Factor Authentication (2FA) states.
Certificate Operations: Generate Certificate Signing Requests (CSR), upload custom server/CA certificates, and manage Client CA configurations.
Protocol Configuration: Update and manage LDAP authentication, Online Certificate Status Protocol (OCSP), and Certificate Revocation List (CRL) files.
System and cluster statistics
Monitor the health and performance of your Trellix NDR deployment programmatically.
Retrieve cluster names, node status, and open Elasticsearch indices.
Pull system statistics for individual hosts.
Check pipeline statistics and packet capture (PX) host telemetry.
Administration and maintenance
User Management: List existing users, create new accounts, update user details, or remove users.
System Dumps: Trigger the creation of system dumps for troubleshooting, list available dumps, download dumps, or delete dumps.