This step creates the communication link at the policy level by assigning the registered Endpoint Security (HX) server instance to the applicable endpoint policy. Endpoints governed by that policy then direct all forensic data communications to the specified server.
Automatic mode
Log in to ePO - On-prem.
Navigate to Menu → ePO Server Settings.
Select the HX Instance Management and click Edit in the bottom right corner.
Click Actions in the bottom left corner and select Add HX Instance.
Enter the HX Server Name and HX Server URL.
For the HX Server URL, use the Fully Qualified Domain Name (FQDN), such as
https://servername:port/.
Click Show Cert.
If ePO uses a proxy server, bypass it temporarily to prevent connection errors.
In ePO, navigate to Menu → Configuration → Server Settings.
In Setting Categories, select Proxy Settings, and then select Edit.
In the Type section, select Do not use a proxy, or add the Trellix Endpoint Security (HX) URL to the Exclusions.
(Optional) Revert these settings after you add the Trellix Endpoint Security (HX) server in ePO.
Validate that the certificate fingerprint in ePO matches the HX server's certificate fingerprint.
Select the Confirm the HX certificate is valid checkbox.
Enter the HX server administrator credentials.
Note
Use the Endpoint Security (HX) server administrator username and password, not your IAM credentials.
Click Get HX Config.
The HX server configuration file downloads to your endpoint.
Click OK and then click Save.
After adding the server instance using automatic or manual mode, you must enable communication in the Policy Catalog to complete the integration. For more details, see Enable server communication.
Note
If you are using Trellix EDR with Forensics in FIPS mode, Automatic mode configures the FIPS-related settings by default.
Manual mode
Log in to ePO - On-prem.
From the Actions menu, select Add HX Instance.
Enter the HX Server Name and HX Server URL.
Enable the Manually add HX instance toggle.
If you are using Trellix EDR with Forensics in FIPS mode, select the Enable the FIPS mode on your endpoints checkbox.
To obtain the JSON server configuration file, run the following curl command in the Command Prompt (Windows) or Terminal (Linux and macOS).
curl --proxy <proxy server> -s -k GET "https://HOST:PORT/hx/api/v3/server_info" -H "accept: application/json" -i --user username:password For example: curl --proxy proxy.internal.corp:8080 -s -k GET "https://[2001:db8:a0b:12f0::1]:3000/hx/api/v3/server_info" -H "accept: application/json" -i --user api_user:P@ssw0rd3xampl3!
Note
If you use a cloud HX server, run the command without the port number.
From the command output, copy the JSON snippet from
{"servers"to just before ,"message" : "OK"}.
Paste the snippet and the user credentials into the server configuration field.
Click Save.
After adding the server instance using automatic or manual mode, you must enable communication in the Policy Catalog to complete the integration. For more details, see Enable server communication.
Enable server communication
After adding the HX server instance, you must select the added HX server in the Policy Catalog.
Go to Menu → Policy → Policy Catalog.
From the Product list, select Trellix EDR with Forensics.
Expand the General policy and click Edit for the applicable policy.
Click Show Advanced and go to Forensics (HX) Server.
From the Registered Forensics (HX) servers list, select the configured HX instance.
Click Save.
Note
You can add multiple Endpoint Security (HX) server instances. Before deleting an instance, ensure it is not selected in any General policy.