Trellix Ax

The Trellix AX connector allows for automated malware analysis and threat intelligence gathering by interfacing with the Trellix AX platform.

Trellix AX is a cutting-edge malware analysis solution that provides comprehensive insights into security threats. This connector enables Swimlane Turbine users to automate the submission and retrieval of malware analysis, enhancing incident response capabilities. By integrating with Trellix AX, users can efficiently manage submission queues, analyze malware with detailed reports, and track submission statuses, all within the Swimlane ecosystem. This streamlines security operations by providing actionable intelligence and reducing manual intervention.

Prerequisites

To effectively utilize the Trellix AX connector with Swimlane Turbine, ensure you have the following prerequisites:

HTTP Basic Authentication with the following parameters:

URL: The endpoint URL for the Trellix AX API.

Username: Your Trellix AX account username.

Password: Your Trellix AX account password.

Capabilities

This connector provides the following capabilities:

Submission Queue Size Request

Submission Results by UUID Request

Submission Results Request

Submission Results Request By Virtual Execution

Submission Status by SHA List

Submission Status by Time Range

Submission Status by UUID

Submission Status by UUID Result

Submission Status Request

Submission Status Request By Virtual Execution

Submit File Request

Submit File Request By Virtual Execution

Submit Malware Object Request

Submit Malware Object Request By Virtual Execution

Submit URL Request

Notes

Trellix AX API Documentation

Configurations

Trellix AX HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	Password	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Submission Queue Size Request

Retrieve the total count of running and queued submissions in Trellix AX.

Endpoint

URL: /wsapis/v2.0.0/submissions/queueSize

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
queueSize	number	Output field: queueSize

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"queueSize":1138}}

Submission Results by UUID Request

Retrieves the submission results for a specific alert by UUID in Trellix AX, requiring the unique identifier as a path parameter.

Endpoint

URL: /wsapis/v2.0.0/submissions/v2/result/{{uuid}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.uuid	string	Required	Parameters for the Submission Results by UUID Request action

Input Example

{"path_parameters":{"uuid":"5e9e81e4-c48a-481e- b4ec-02c3f917f9a5"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
appliance_id	string	Unique identifier
anomaly_types	array	Type of the resource
sha256	string	Output field: sha256
submitted_time	string	Time value
type	string	Type of the resource
uuid	string	Unique identifier
mitre-mapping	array	Output field: mitre-mapping

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"appliance_id":"AC1F6B6E6E60","anomaly_types":[{}],"sha256":"140417ba2238dde6de6b541ad75dae6a96fec5d7482054dc154242a1992c9b2f","submitted_time":"2022-01-14T05:46:34.861637","type":"docx","uuid":"5e9e81e4-c48a-481e-b4ec-02c3f917f9a5","mitre-mapping":[{}]}}

Submission Results Request

Retrieve a detailed XML malware analysis report from Trellix AX using the provided Submission Key.

Endpoint

URL: /wsapis/v2.0.0/submissions/results/{{Submission_Key}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.Submission_Key	string	Required	Parameters for the Submission Results Request action

Input Example

{"path_parameters":{"Submission_Key":"3831_5"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

Submission Results Request By Virtual Execution

Retrieve a detailed XML report of a malware file analysis from Trellix AX using the provided Submission Key.

Endpoint

URL: /wsapis/mvx/v2.0.0/submissions/results/{{Submission_Key}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.Submission_Key	string	Required	Parameters for the Submission Results Request By Virtual Execution action
parameters.info_level	string	Optional	Parameters for the Submission Results Request By Virtual Execution action

Input Example

{"parameters":{"info_level":"extended"},"path_parameters":{"Submission_Key":"3831_5"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

Submission Status by SHA List

Retrieves the status of submissions for a list of SHA-256 values in Trellix AX, requiring the 'sha256' parameter.

Endpoint

URL: /wsapis/mvx/v2.0.0/submissions/cluster/done

Method: GET

Input

Argument Name	Type	Required	Description
parameters.sha256	string	Required	One or more comma-separated sha256 values.

Input Example

{"parameters":{"sha256":"e03 ef03fd007a8f44cc9d9f7535450cd4a9c3ce7ac56e62f7a848ab919a75397,1f6de691fe5ce64 874c373ab1685e6c13d89a2abbe445fcc78ac94f474102dee"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":[{"sha256":"1f6de691fe5ce64874c373ab1685e6c13d89a2abbe445fcc78ac94f474102dee","verdict":"non-malicious","uuid":"fb346aef-de0b-414e-9830- 8f5237bd4e3e","done_time":"2021-03-23T20:09:46+0000"}]}

Submission Status by Time Range

Retrieve the status of Trellix AX submissions within a specified time range, using start and end times as parameters.

Endpoint

URL: /wsapis/mvx/v2.0.0/submissions/cluster/done

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Required	Parameters for the Submission Status by Time Range action
parameters.end_time	string	Required	Parameters for the Submission Status by Time Range action

Input Example

{"parameters":{"start_time":"2021-03- 23T19:51:00.000-00:00","end_time":"2021-03- 23T20:51:00.000-00:00"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":[{"verdict":"non-malicious","uuid":"59b503a9-f626-4ae1-bff3- 5056d013577c","done_time":"2021-03-23T19:53:17+0000"}]}

Submission Status by UUID

Retrieve the status of a submission in Trellix AX using the specified UUID.

Endpoint

URL: /wsapis/mvx/v2.0.0/submissions/status

Method: GET

Input

Argument Name	Type	Required	Description
parameters.uuid	string	Required	One or more comma-separated UUID values.

Input Example

{"parameters":{"uuid":"8d319361-f482-446d-a371- 0edd1f565988"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":[{"verdict":"non-malicious","uuid":"90f0f5b1-2981-4942-ab92- a15f7c316481","done_time":"2021-03-23T20:09:19+0000"}]}

Submission Status by UUID Result

Retrieve the analysis result for a specific submission by UUID in Trellix AX, requiring the submission's unique identifier.

Endpoint

URL: /wsapis/v2.0.0/submissions/cluster/done/{{uuid}}/result

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.uuid	string	Required	Parameters for the Submission Status by UUID Result action

Input Example

{"path_parameters":{"uuid":"8d319361-f482-446d-a371- 0edd1f565988"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
verdict	string	Output field: verdict
uuid	string	Unique identifier
done_time	string	Time value

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"verdict":"non-malicious","uuid":"90f0f5b1-2981-4942-ab92- a15f7c316481","done_time":"2021-03-23T20:09:19+0000"}}

Submission Status Request

Checks the status of a submission in Trellix AX using the provided Submission Key.

Endpoint

URL: /wsapis/v2.0.0/submissions/status/{{Submission_Key}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.Submission_Key	string	Required	Parameters for the Submission Status Request action

Input Example

{"path_parameters":{"Submission_Key":"3831_5"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
submissionStatus	string	Status value

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"submissionStatus":"In Progress"}}

Submission Status Request By Virtual Execution

Checks the status of a specific submission in Trellix AX using the provided Submission_uuid.

Endpoint

URL: /wsapis/mvx/v2.0.0/submissions/status/{{Submission_uuid}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.Submission_uuid	string	Required	Parameters for the Submission Status Request By Virtual Execution action

Input Example

{"path_parameters":{"Submission_uuid":"7709"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
submissionStatus	string	Status value

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":{"submissionStatus":"Done"}}

Submit File Request

Submit a file to Trellix AX for detailed analysis, specifying type, priority, profiles, and timeout options.

Endpoint

URL: /wsapis/v2.0.0/submissions/file

Method: POST

Input

Argument Name	Type	Required	Description
enable_vnc	string	Optional	Specifies whether to enable VNC to the VM during the analysis. false—Disables VNC. true—Enables VNC.
application	string	Optional	Specifies the ID of the application to be used for the analysis. To determine the available applications for a specific profile, use the Malware Analysis configuration request.
timeout	string	Optional	Sets the analysis timeout (in seconds).
priority	string	Optional	Sets the analysis priority. 0—Normal adds analysis to the bottom of queue. 1—Urgent places the analysis at the top of the queue. (default Normal).
profiles	array	Optional	Selects the Malware Analysis profile to use for analysis. To determine the available profiles, use the Malware Analysis configuration request.
analysistype	string	Optional	Specifies the analysis mode. 1—Live analyze suspected files live within the Malware Analysis Multi-Vector Virtual Execution (IVX) analysis engine. 2—Sandbox analyze suspected files in a closed, protected environment.
force	string	Optional	Specifies whether to perform an analysis on the file even if the file exactly matches an analysis that has already been performed. In most cases, it is not necessary to reanalyze malware. false—Do not analyze duplicate files. true—Force analysis. (default false).
prefetch	string	Optional	Specifies whether to determine the file target based on an internal determination rather than browsing to the target location. 0—No. 1—Yes.
note	string	Optional	Text description about the malware analysis submission. Notes are shared with the Dynamic Threat Intelligence (DTI) Cloud.
params	string	Optional	File type of malware that is analyzed by the appliance. The Malware Analysis appliance analyzes DLLs or other file types that might be a malware dropper. DLL file types are the default. Prefetch must be enabled when submitting DLLs or other files with parameters for analysis. You can specify a function name (such as an entry point) and the file to be opened as part of the DLL parameter definition. For example, you can enter mshtml.dll, OpenAs_RunDLL htmlfile.html.
files	object	Required	File to be uploaded
files.file	string	Optional	Parameter for Submit File Request
files.file_name	string	Optional	Name of the resource

Input Example

{"enable_vnc":"true","application":"2","timeout":"500","priority":"0","profiles":["win7-sp1"],"analysistype":"1","force":"true","prefetch":"0","note":"note","params":"mshtml.dll"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
ID	string	Unique identifier
submission_details	object	Output field: submission_details
submission_details.vnc_port	array	Output field: submission_details.vnc_port
submission_details.job_ids	array	Unique identifier
submission_details.id	number	Unique identifier
submission_details.uuid	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 3 Dec 2024 20:37:23 GMT"},"reason":"OK","json_body":{"ID":"32826","submission_details":{"vnc_port":[],"job_ids":[],"id":32826,"uuid":"fc1f55bb-aee3-44c7-a164-6f2b01c88d4c"}}}

Submit File Request By Virtual Execution

Submits a file for analysis to Trellix AX with options like analysis type, priority, profiles, and timeout settings.

Endpoint

URL: /wsapis/mvx/v2.0.0/submissions/file

Method: POST

Input

Argument Name	Type	Required	Description
attachments	object	Required	File to be uploaded
attachments.file	string	Required	Parameter for Submit File Request By Virtual Execution
attachments.file_name	string	Required	Name of the resource
analysistype	string	Optional	Type of the resource
priority	string	Optional	Parameter for Submit File Request By Virtual Execution
profiles	array	Optional	Parameter for Submit File Request By Virtual Execution
force	string	Optional	Parameter for Submit File Request By Virtual Execution
application	string	Optional	Parameter for Submit File Request By Virtual Execution
prefetch	string	Optional	Parameter for Submit File Request By Virtual Execution
timeout	string	Optional	Parameter for Submit File Request By Virtual Execution

Input Example

{"json_body":{"analysistype":"1","priority":"0","profiles":["win7-sp1"],"force":"true","application":"69","prefetch":"0","timeout":"500"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":[{"ID":"7709"}]}

Submit Malware Object Request

Uploads a file to Trellix AX for detailed malware analysis, allowing specification of type, priority, profiles, and additional scan options.

Endpoint

URL: /wsapis/v2.0.0/submissions

Method: POST

Input

Argument Name	Type	Required	Description
attachments	object	Required	File to be uploaded
attachments.file	string	Required	Parameter for Submit Malware Object Request
attachments.file_name	string	Required	Name of the resource
analysistype	string	Optional	Type of the resource
priority	string	Optional	Parameter for Submit Malware Object Request
profiles	array	Optional	Parameter for Submit Malware Object Request
force	string	Optional	Parameter for Submit Malware Object Request
application	string	Optional	Parameter for Submit Malware Object Request
prefetch	string	Optional	Parameter for Submit Malware Object Request
timeout	string	Optional	Parameter for Submit Malware Object Request
enable_vnc	string	Optional	Parameter for Submit Malware Object Request

Input Example

{"json_body":{"analysistype":"1","priority":"0","profiles":["win7-sp1"],"force":"true","application":"69","prefetch":"0","timeout":"500","enable_vnc":"true"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":[{"ID":"3831_5"}]}

Submit Malware Object Request By Virtual Execution

Uploads a file to Trellix AX for virtual execution scanning, with options for analysis type, priority, profiles, force, application, prefetch, and timeout.

Endpoint

URL: /wsapis/mvx/v2.0.0/submissions

Method: POST

Input

Argument Name	Type	Required	Description
attachments	object	Required	File to be uploaded
attachments.file	string	Required	Parameter for Submit Malware Object Request By Virtual Execution
attachments.file_name	string	Required	Name of the resource
analysistype	string	Optional	Type of the resource
priority	string	Optional	Parameter for Submit Malware Object Request By Virtual Execution
profiles	array	Optional	Parameter for Submit Malware Object Request By Virtual Execution
force	string	Optional	Parameter for Submit Malware Object Request By Virtual Execution
application	string	Optional	Parameter for Submit Malware Object Request By Virtual Execution
prefetch	string	Optional	Parameter for Submit Malware Object Request By Virtual Execution
timeout	string	Optional	Parameter for Submit Malware Object Request By Virtual Execution
enable_vnc	string	Optional	Parameter for Submit Malware Object Request By Virtual Execution

Input Example

{"json_body":{"analysistype":"1","priority":"0","profiles":["win7-sp1"],"force":"true","application":"69","prefetch":"0","timeout":"500","enable_vnc":"true"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
uuid	string	Unique identifier
brokerId	string	Unique identifier

Output Example

Submit URL Request

Submits a URL to Trellix AX for analysis with options such as type, priority, profiles, and timeout settings.

Endpoint

URL: /wsapis/v2.0.0/submissions/url

Method: POST

Input

Argument Name	Type	Required	Description
timeout	number	Optional	Parameter for Submit URL Request
priority	number	Optional	Parameter for Submit URL Request
profiles	array	Optional	Parameter for Submit URL Request
application	number	Optional	Parameter for Submit URL Request
force	boolean	Optional	Parameter for Submit URL Request
analysistype	number	Optional	Type of the resource
prefetch	number	Optional	Parameter for Submit URL Request
urls	array	Optional	URL endpoint for the request

Input Example

{"json_body":{"timeout":200,"priority":1,"profiles":["win7-sp1","winxp-sp3"],"application":2,"force":true,"analysistype":2,"prefetch":1,"urls":["http://172.16.225.87/malsust/File_share/treasury65malware/ 1134220120630 letter.pdf.xdp","http://172.16.225.87/malsust/File_share/ treasury65malware/ContagioEncryptedXLS_ D116C745FE94C202934EF49F59D19950.xls"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 23 Aug 2023 20:37:23 GMT"},"reason":"OK","json_body":[{"id":"L135_5"}]}

Response Headers

Header	Description	Example
content-length	The length of the response body in bytes	140
content-type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Tue, 3 Dec 2024 20:37:23 GMT