POST - Host Remediation

Overview

This endpoint executes a specific command, like quarantining or killing a process, on one or more endpoints. Provide the action, target hostIds, and any required actionInputs. The API creates an asynchronous job and returns an ID for tracking the outcome. Use this API for urgent, manual interventions, like an analyst quarantining a compromised endpoint, or for playbooks that perform specific system tasks outside of a formal threat response. This API provides granular, command-level control, offering a flexible response capability that is not limited to pre-defined threat detections.

Authentication

Authentication type: Bearer Token, API Key.

You can create a token using client credentials obtained through the developer portal. The API Key (x-api-key) is provided in your onboarding email or on the API Access Management page.

Path (or URL)

POST https://{Trellix EDR_gateway_URL}/edr/v2/remediation/host

You can get the gateway URL from the Trellix on-boarding email. For example, https://api.manage.trellix.com.

Request

Request headers

Authorization: Bearer <your_bearer_token>
Content-Type: application/vnd.api+json
x-api-key: <your_api_key>
X-MVEDR-Source: <source_region>
X-Trace-Id: <trace_id_value>

Request body

Example 1:

{
  "data": {
    "type": "hostRemediation",
    "attributes": {
      "action": "quarantineHost",
      "hostIds": [
        "C6C4B1D2-1EDD-11ED-178D-005056AC6A75",
        "C6C4B1D2-1EDD-11ED-178D-005056AC6A76"
      ]
    }
  }
}

Example 2:

{
  "data": {
    "type": "hostRemediation",
    "attributes": {
      "action": "killProcessByName",
      "hostIds": [
        "E4F47D88-BB73-11EF-0ABE-005056A48646"
      ],
      "actionInputs": [
        {
          "name": "name",
          "value": "explorer.exe"
        }
      ]
    }
  }
}

Note

Name and value pair combination is unique for the provided action. Any incorrect combination results in the API showing an error.

Example 3:

{
  "data": {
    "type": "hostRemediation",
    "attributes": {
      "action": "_create_file_win",
      "actionInputs": [
        {
          "name": "full_path",
          "value": "C:/Users/cdaauto/AppData/Local/Temp/MVAPITest_HR.txt"
        }
      ],
      "hostIds": [
        "51C07FCA-08AD-11F1-04E0-005056AC90E3"
      ]
    }
  }
}

Note

Custom reactions are prefixed with _.

Request parameters

There are no request parameters.

Response

Response example

{
  "data": {
    "type": "hostRemediation",
    "id": "hr-5432",
    "attributes": {
      "success": [
        {
          "status": "200",
          "message": "in-progress",
          "hostIds": [
            "902F4237-B838-ED11-87C6-005056A4B536",
            "902F4237-B838-ED11-87C6-005056A4B537"
          ]
        }
      ],
      "failed": [
        {
          "status": "409",
          "message": "conflict, Either Some operation is going on Agent guid or its already inQuarantineHoststate",
          "hostIds": [
            "902F4237-B838-ED11-87C6-005056A4B534",
            "902F4237-B838-ED11-87C6-005056A4B535"
          ]
        }
      ]
    },
    "links": {
      "self": "/edr/v2/remediation/queue-jobs/rem-5432"
    }
  }
}

Response codes