Setting Up HTTP Servers

To set up HTTP servers, perform the following subtasks:

Add the HTTP servers
Configure the HTTP server listing

To add an HTTP server:

Enable the CLI configuration mode:
hostname > enable
hostname # configure terminal
Enable HTTP notifications:
hostname (config) # fenotify http enable
Specify the name of the HTTP server (for example, AX5400) to receive the notification. URLs and email addresses are not allowed.
hostname (config) # fenotify http service service-name
Specify which servers will post HTTP notifications (one server per command):
hostname (config) # fenotify http service service_name enable
Specify the URL for each HTTP server to receive the notification:
hostname (config) # fenotify http service service_name server-url url
Save the configuration:
hostname (config) # write memory

To configure the HTTP server listing:

Enable the CLI configuration mode:
hostname > enable
hostname # configure terminal
Enable HTTP notifications:
hostname (config) # fenotify http enable
(Optional) If authentication is required for the server, enable authentication and then specify the user name and password for HTTP authentication:
hostname (config) # fenotify http service service_name auth enable
hostname (config) # fenotify http service service_name auth username user_name
hostname (config) # fenotify http service service_name auth password password
Specify the delivery schedule for HTTP notifications:
Note
Trellix recommends using per-event notifications.
- To send a daily notification of all malware objects detected the past 24 hours in the selected format and level of details (default is Concise), enter:
  hostname (config) # fenotify http service service_name prefer message delivery daily-digest
- To send a notification each time a malware object is detected, enter:
  hostname (config) # fenotify http service service_name prefer message delivery per-event
(Optional) If you want to use SSL for notifications:
hostname (config) # fenotify http service service_name ssl enable
hostname (config) # fenotify http service service_name ssl verify
Specify the service provider. The default service provider is generic.
Note
Trellix recommends using the generic service provider.
- To select the currently active service provider, enter:
  hostname (config) # fenotify http service service_name provider default
- To select the generic provider, enter:
  hostname (config) # fenotify http service service_name provider generic
- To select Aruba as the provider, enter:
  hostname (config) # fenotify http service service_name provider aruba
Select one of the XML, JavaScript Object Notation (JSON), or Text options for the format of the HTTP notifications:
Note
The json_legacy-concise, json_legacy-extended, and json_legacy-normal formats are deprecated.
- To post notifications in XML Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
  hostname (config) # fenotify http service service_name provider generic message format xml-concise
- To post notifications in XML Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (XML Extended provides all details about files and objects modified during analysis.), enter:
  hostname (config) # fenotify http service service_name provider generic message format xml-extended
- To post notifications in XML Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
  hostname (config) # fenotify http service service_name provider generic message format xml-normal
- To post notifications in JSON Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
  hostname (config) # fenotify http service service_name provider generic message format json-concise
- To post notifications in JSON Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (JSON Extended provides all details about files and objects modified during analysis.), enter:
  hostname (config) # fenotify http service service_name provider generic message format json-extended
- To post notifications in JSON Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
  hostname (config) # fenotify http service service_name provider generic message format json-normal
- To post notifications in Text Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
  hostname (config) # fenotify http service service_name provider generic message format text-concise
- To post notifications in Text Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (Text Extended provides all details about files and objects modified during analysis.), enter:
  hostname (config) # fenotify http service service_name provider generic message format text-extended
- To post notifications in Text Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
  hostname (config) # fenotify http service service_name provider generic message format text-normal
Save the configuration:
hostname (config) # write memory