Overview
This endpoint retrieves the configuration details of a specific reaction using its unique identifier. The response includes execution details, supported platforms, and required arguments. Use this endpoint to review a reaction before deploying it.
Authentication
Authentication type: Bearer Token, API Key.
You can create a token using client credentials obtained through the developer portal. The API Key (x-api-key) is provided in your onboarding email or on the API Access Management page.
Path (or URL)
<HTTPS Method>
Get https://{Trellix EDR_gateway_URL}/edr/v2/reactions/{reaction-id}
Request
Request headers
Authorization: Bearer <your_bearer_token> Content-Type: application/vnd.api+json x-api-key: <your_api_key>
Authorization: This header is used to authenticate your request. You need to replace
<your_bearer_token>with the actual token you generate.Content-Type: This header tells the server that the request body format is
json:api. Even though this specific call has no request body, the API requires this header.x-api-key: This is a custom header required by the Trellix API for authentication. You'll need to replace
<your_api_key>with the key from your onboarding email or the API Access Management page.
Request parameters
No request parameters.
Response
Response example
{
"data": {
"id": "388",
"type": "customReactions",
"attributes": {
"catalogVersion": 0,
"metadata": {},
"hidden": false,
"dbVersion": 0,
"description": "test Desc",
"timeout": 60,
"internalArguments": {},
"internalName": "_Test_Reaction",
"remediation": false,
"task": "REACTION",
"contents": [
{
"id": "10352",
"platform": {
"catalogVersion": 1100,
"dbVersion": 0,
"id": "1",
"name": "windows",
"topic": "/mcafee/mar/agent/query/windows",
"enabled": true
},
"capability": {
"catalogVersion": 1100,
"dbVersion": 0,
"id": "27",
"name": "Execute PowerShell Script",
"description": "Runs Windows PowerShell Scripts",
"module": "SystemRuntime",
"function": "executePS",
"contentEnabled": true,
"outputs": [],
"formatArgs": {
"hasHeaders": false,
"delimiter": ","
},
"format": "CSV",
"platforms": [
{
"catalogVersion": 1100,
"dbVersion": 0,
"id": "1",
"name": "windows",
"topic": "/mcafee/mar/agent/query/windows",
"enabled": true
}
],
"platformSettings": [
{
"id": "5142",
"platform": {
"catalogVersion": 1100,
"dbVersion": 0,
"id": "1",
"name": "windows",
"topic": "/mcafee/mar/agent/query/windows",
"enabled": true
},
"utf8Sensitive": false
}
],
"itemType": "CUSTOM",
"catalogItems": [
"COLLECTOR",
"REACTION"
]
},
"content": "test\r\n",
"arguments": [],
"utf8Sensitive": false
}
],
"availableForTrigger": true,
"name": "_Test_Reaction",
"arguments": [
{
"id": "2369",
"name": "test",
"type": "STRING",
"collectorMappings": [],
"optional": false
}
],
"availableOffline": false,
"chainedReactions": []
}
},
"jsonapi": {
"version": "1.0"
}
}
Response codes
Status | Response | Description |
|---|---|---|
200 | OK | Your request was processed successfully. The server has returned the requested data. |
400 | Bad request | The server couldn't understand your request, likely due to a syntax error or an invalid parameter. |