Using the Helix Enterprise API

You can use the Helix Enterprise API to perform various Helix Enterprise functions. For complete information, from the main menu select your avatar () and then select API Documentation.

To use the API, you need to obtain an API key and determine your Helix Enterprise instance ID.

Important
There are two versions of IAM. If the URL you use to access the IAM UI ends with fireeye.com, this document pertains to you. If the URL you use to access the IAM UI ends with trellix.com, see the Trellix IAM Guide for information regarding IAM.

Obtaining the API key

You can create API keys for Helix Enterprise, Cloud Endpoint Security (HX), Cloud Central Management, Identity Access Management (IAM), and other Trellix products.

To obtain an API key:

From the main menu, select your avatar and then select Identity Access Management. The login screen for IAM appears.
Log into IAM. Then follow the instructions provided in "Trellix Cloud IAM API Keys" in the Trellix System Security Guide.

Determining the Helix Enterprise instance ID

To determine your Helix Enterprise instance ID:

Select the Organization Settings tab on the IAM page.
The instance ID is displayed in the upper left corner of the screen. The ID uniquely identifies your Helix Enterprise instance.

Using the Helix Enterprise API with cURL

Now you have the two pieces of information needed to retrieve alerts, lists, and so on.

Note
If using a command line tool such as curl, you must URL encode the arguments as in the examples below. URL encoding can be done with a number of tools both online and offline. Since only the arguments need to be encoded, it can be done online.

Online:

http://www.albionresearch.com/misc/urlencode.php

Python:

alias urlencode='python -c "import sys, urllib as ul; print ul.quote_plus(sys.argv[1])"'

urlencode 'q werty=/;'

Examples

This example performs an TQL search via the API using cURL:

curl -v -H  "Content-Type: application/json" -H ">" -H "x-fireeye-api-key:<API-key>" -d '{"query":"<MQL-query>","transforms":<transforms-value>,"stream":<stream-value>,"options":{<option-pairs>}}' https://apps.fireeye.com/helix/id/<Helix-instance-ID>/api/v1/search

This example returns all alerts:

curl -v -H ">" -H "x-fireeye-api-key:<API-key>" https://apps.fireeye.com/helix/id/<Helix-instance-ID>/api/v3/alerts

This example returns alerts from a certain date forward (October 19, 2014):

curl -v -H ">" -H "x-fireeye-api-key:<API-key>" "https://apps.fireeye.com/helix/id/<Helix-instance-ID>/api/v3/alerts?query=%7b%22createDate%22%3a%7b%22%24gt%22%3a%222022-06-19%22%7d%7d

The data is returned in JSON format and can then be used as needed by the application.