Trellix HX Endpoint Security

The Trellix HX Endpoint Security connector enables automated interactions with the Trellix HX platform for enhanced endpoint protection and incident response.

Trellix HX Endpoint Security is a robust platform designed for advanced threat detection and response. By integrating with Swimlane Turbine, users can automate critical security operations tasks such as host containment, detailed searches, file acquisition, and alert management. This connector empowers security teams to swiftly isolate threats, conduct comprehensive investigations, and manage alerts efficiently, thereby reducing response times and bolstering overall security posture.

The Trellix HX Endpoint Security Connector is capable of interacting with the Trellix HX Endpoint Security REST API to run various triage, acquisition, alert, and contain tasks.

Prerequisites

Before you can utilize the Trellix HX Endpoint Security connector for Turbine, ensure you have the following:

HTTP Basic Authentication with these parameters:

URL: The endpoint URL for the Trellix HX API.

Username: Your Trellix HX account username.

Password: Your Trellix HX account password.

Capabilities

This Trellix HX Endpoint Security connector provides the following capabilities:

Contain Host

Containment Cancellation

Create Search

Download File Acqusition

Get Alert by ID

Get Alert groups

Get Alerted Hosts

Get Containment State by Agent ID

Get Containment Status

Get Hosts

Get List of Triages

Get Quarantine by ID

Get Search Results

Get Triage Acquisition by ID

Get Triage Collection by ID ... and so on

Asset Setup

Trellix HX Endpoint Security must be configured to allow access to the API. After logging into Trellix HX Endpoint Security as an Administrator, navigate to Admin > Appliance Settings > User Accounts. Select the api_admin account, change the drop-down from Local Login Disabled to Password Set, type in your new password, and click Update User. Swimlane will expect the username api_admin, the password you just set, and the host with the port included (https://myhost:3000). You may also use the api_analyst user or any other user for Swimlane by following the same process and ensuring the user roll is one of api_analyst or api_admin. There are permissions differences between the two different API roles. api_admin is less restrictive and allows actions like containing hosts and maintaining custom policy channels.

Notes

Trellix Doc Portal

Trellix HX Endpoint Security API Specs

Configurations

Trellix HX HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	Password	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Contain Host

Initiates containment of a specified host using its agent_id to prevent access to other systems on the network.

Endpoint

URL: /hosts/{{agent_id}}/containment

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.agent_id	string	Required	The agent running on the host. The agent_id is listed on the Host Details tab for the host endpoint. The agent ID is automatically generated when the agent first signs on to the primary HX Series appliance.

Input Example

{"path_parameters":{"agent_id":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
details	array	Output field: details
route	string	Output field: route
message	string	Response message

Output Example

{"status_code":202,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"details":[],"route":"/hx/api/v3/hosts/agent_id/containment","message":"Accepted"}}

Containment Cancellation

Release a specific host from containment in Trellix HX Endpoint Security using the agent's ID.

Endpoint

URL: /hosts/{{agent_id}}/containment

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.agent_id	string	Required	The agent running on the host. The agent_id is listed on the Host Details tab for the host endpoint. The agent ID is automatically generated when the agent first signs on to the primary HX Series appliance.

Input Example

{"path_parameters":{"agent_id":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"status_code":204,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"No Content","response_text":""}

Create Search

Initiates an enterprise search in Trellix HX Endpoint Security, with options for quick or exhaustive searches.

Endpoint

URL: /searches

Method: POST

Input

Argument Name	Type	Required	Description
host_set	object	Optional	Parameter for Create Search
host_set._id	number	Optional	Unique identifier
hosts	array	Optional	Parameter for Create Search
hosts._id	string	Optional	Unique identifier
indicator	string	Optional	Parameter for Create Search
exhaustive	object	Optional	Parameter for Create Search
exhaustive.override	array	Optional	Unique identifier
exhaustive.override.item_type	string	Optional	Unique identifier
exhaustive.override.name	string	Optional	Unique identifier
exhaustive.override.value	boolean	Optional	Unique identifier
query	array	Optional	Parameter for Create Search
query.field	string	Optional	Parameter for Create Search
query.operator	string	Optional	Parameter for Create Search
query.value	string	Optional	Value for the parameter

Input Example

{"json_body":{"host_set":{"_id":0},"hosts":[{"_id":"string"}],"indicator":"string","exhaustive":{"override":[{"item_type":"CookieHistoryItem","name":"string","value":true}]},"query":[{"field":"Application Name","operator":"equals","value":"string"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data._id	number	Response data
data.state	string	Response data
data.scripts	array	Response data
data.scripts._id	number	Response data
data.scripts.url	string	Response data
data.scripts.download	string	Response data
data.scripts.platform	string	Response data
data.update_time	string	Response data
data.create_time	string	Response data
data.update_actor	object	Response data
data.update_actor._id	number	Response data
data.update_actor.username	string	Response data
data.create_actor	object	Response data
data.create_actor._id	number	Response data
data.create_actor.username	string	Response data
data.error	array	Response data
data._revision	string	Response data
data.input_type	string	Input data for the action
data.url	string	Response data
data.host_set	object	Response data
data.host_set._id	number	Response data
data.host_set.url	string	Response data

Output Example

{"status_code":201,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"_id":0,"state":"string","scripts":[],"update_time":"2024-06-12T10:17:31.972Z","create_time":"2024-06-12T10:17:31.972Z","update_actor":{},"create_actor":{},"error":[],"_revision":"string","input_type":"string","url":"string","host_set":{},"stats":{},"settings":{}},"message":"string","details":[{}],"route":"string"}}

Download File Acqusition

Initiates the download of a specified file from an endpoint using Trellix HX, requiring agent ID, path, and filename.

Endpoint

URL: /hosts/{{agent_id}}/files

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.agent_id	string	Required	Parameters for the Download File Acqusition action
req_path	string	Optional	Path of the file that you want to acquire.
req_filename	string	Optional	Name of the file that you want to acquire.
comment	string	Optional	General comment.
req_use_api	boolean	Optional	Whether to use the API or RAW.
external_id	string	Optional	External correlation ID from a SIEM solution.

Input Example

{"json_body":{"req_path":"C:\\$Extend\\$RmMetadata\\$TxfLog\\","req_filename":"$TxfLog.blf","comment":"this is a comment","req_use_api":true,"external_id":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
file	object	Attachments
file.file	string	Output field: file.file
file.file_name	string	Name of the resource

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 5 Jun 2024 20:37:23 GMT"},"reason":"OK","file":[]}

Get Alert by ID

Retrieves a specific alert from Trellix HX Endpoint Security using the provided alert ID.

Endpoint

URL: /alerts/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Unique alert ID.

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data._id	number	Response data
data.agent	object	Response data
data.appliance	object	Response data
data.appliance._id	string	Response data
data.condition	object	Response data
data.condition._id	string	Response data
data.condition.url	string	Response data
data.condition.enabled	boolean	Response data
data.condition.uuid	string	Response data
data.condition.tests	string	Response data
data.condition.event_type	string	Response data
data.indicator	object	Response data
data.indicator._id	string	Response data
data.indicator.url	string	Response data
data.indicator.name	string	Response data
data.indicator.uri_name	string	Response data
data.indicator.display_name	string	Response data
data.indicator.signature	string	Response data
data.indicator.category	number	Response data
data.event_id	string	Response data
data.event_type	string	Response data
data.event_values	object	Response data

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"_id":0,"agent":{},"appliance":{},"condition":{},"indicator":{},"event_id":"string","event_type":"string","event_values":{},"event_at":"2024-06-10T10:14:47.547Z","matched_at":"2024-06-10T10:14:47.547Z","reported_at":"2024-06-10T10:14:47.547Z","source":"string","subtype":"string","matched_source_alerts":[],"has_share_mode":"unre...

Get Alert groups

Retrieve a list of all alert groups from Trellix HX Endpoint Security to streamline incident analysis and response.

Endpoint

URL: /alert_groups

Method: GET

Input

Argument Name	Type	Required	Description
parameters.offset	number	Optional	Specifies which record to start with in the response. The default is 0.
parameters.limit	number	Optional	Specifies how many records are returned. The default is 50.
parameters.sort	array	Optional	Sorts the results by the specified field in ascending or descending order. The default is sorting by _id in descending order. Sort fields may be followed by ":asc" or ":desc" to indicate ascending or descending order. Multiple sort fields may be specified.
parameters._id	string	Optional	Unique alert group ID.
parameters.host._id	string	Optional	Unique Host ID.
parameters.host.hostname	string	Optional	Name of the host.
parameters.host.primary_ip_address	string	Optional	Primary IP address of the host.
parameters.assessment	string	Optional	Brief assessment of the potential threat.
parameters.file_full_path	string	Optional	Full path of the suspect file.
parameters.acknowledgement.acknowledged	boolean	Optional	The alert has been acknowledged.
parameters.acknowledgement.acknowledged_by	string	Optional	User who has been acknowledged the alert.
parameters.acknowledgement.acknowledged_time	string	Optional	Time alert was acknowledged.
parameters.source	string	Optional	Source of alert. Valid values include "IOC" (indicator of compromise), "EXD" (exploit detection), and "MAL" (malware alert), etc.
parameters.has_fp_disposition	boolean	Optional	Identifies which alert groups have an associated FP filter.
parameters.last_alert.resolution	string	Optional	Resolution of the most recent alert.
parameters.grouped_by.md5sum	string	Optional	MD5 hash from the alert group filter.
parameters.filterQuery	string	Optional	The filterQuery parameter allows for very specific filtering of search results. This must be an URL encoded JSON object.

Input Example

{"parameters":{"offset":0,"limit":50,"sort":["_id:desc"],"_id":"","host._id":"","host.hostname":"","host.primary_ip_address":"","assessment":"","file_full_path":"","acknowledgement.acknowledged":true,"acknowledgement.acknowledged_by":"","acknowledgement.acknowledged_time":"","source":"","has_fp_disposition":true,"last_alert.resolution":"","grouped_by.md5sum":"","filterQuery":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.total	number	Response data
data.query	object	Response data
data.sort	object	Response data
data.offset	number	Response data
data.limit	number	Response data
data.entries	array	Response data
data.entries._id	string	Response data
data.entries.url	string	Response data
data.entries.host	object	Response data
data.entries.host._id	string	Response data
data.entries.host.url	string	Response data
data.entries.host.hostname	string	Response data
data.entries.host.primary_ip_address	string	Response data
data.entries.assessment	string	Response data
data.entries.file_full_path	string	Response data
data.entries.acknowledgement	object	Response data
data.entries.acknowledgement.acknowledged	boolean	Response data
data.entries.acknowledgement.acknowledged_by	string	Response data
data.entries.acknowledgement.acknowledged_time	string	Response data
data.entries.stats	object	Response data
data.entries.stats.events	number	Response data
data.entries.first_event_at	string	Response data

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"total":0,"query":{},"sort":{},"offset":0,"limit":0,"entries":[]},"message":"string","details":[{}],"route":"string"}}

Get Alerted Hosts

Retrieves a list of hosts with alert conditions linked to a specific source alert ID in Trellix HX Endpoint Security.

Endpoint

URL: /source_alerts/{{id}}/alerted_hosts

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Unique alert ID.
parameters.offset	number	Optional	Specifies which record to start with in the response. The default is 0.
parameters.limit	number	Optional	Specifies how many records are returned. The default is 50.
parameters.sort	array	Optional	Sorts the results by the specified field in ascending or descending order. The default is sorting by _id in descending order. Sort fields may be followed by ":asc" or ":desc" to indicate ascending or descending order. Multiple sort fields may be specified.
parameters._id	string	Optional	Unique agent ID.
parameters.agent_version	string	Optional	Agent version.
parameters.containment_queued	boolean	Optional	Containment requested.
parameters.containment_state	string	Optional	Containment state.
parameters.last_audit_timestamp	string	Optional	Time when the most recent system information audit was performed.
parameters.last_alert_timestamp	string	Optional	The time stamp of the most recent alert for the host.
parameters.hostname	string	Optional	Name of the host.
parameters.domain	string	Optional	Network domain.
parameters.gmt_offset_seconds	number	Optional	How many seconds the offset is from Greenwich Mean Time (GMT).
parameters.timezone	string	Optional	Timezone name.
parameters.os.product_name	string	Optional	Operating system name.
parameters.os.patch_level	string	Optional	Operating system patch.
parameters.os.bitness	string	Optional	Operating system word size.
parameters.os.platform	string	Optional	Family of operating systems..
parameters.reported_clone	boolean	Optional	Indicates more than one host has this same agent ID.
parameters.stats.alerting_conditions	number	Optional	Number of alerting conditions.
parameters.stats.acqs	number	Optional	Number of file acquisition requests.
parameters.stats.alerts	number	Optional	Total number of alerts, including exploit-detection alerts.
parameters.stats.exploit_alerts	number	Optional	Number of exploit alerts, partially blocked exploits, and blocked exploits.
parameters.stats.malware_alerts	number	Optional	The number of malware alerts on the host.
parameters.stats.generic_alerts	number	Optional	The number of generic alerts on the host.

Input Example

{"parameters":{"offset":0,"limit":50,"sort":["_id:desc"],"_id":"","agent_version":"","containment_queued":true,"containment_state":"normal","last_audit_timestamp":"","last_alert_timestamp":"","hostname":"","domain":"","gmt_offset_seconds":1,"timezone":"","os.product_name":"","os.patch_level":"","os.bitness":"64-bit","os.platform":"win","reported_clone":true,"stats.alerting_conditions":1,"stats.acqs":3,"stats.alerts":2,"stats.exploit_alerts":4,"stats.malware_alerts":5,"stats.generic_alerts":6,"stats.malware_cleaned_count":2,"stats.malware_quarantined_count":2,"last_poll_timestamp":"","host_sets._id":"","host_sets.query":"","has_alerts":true,"has_exploit_alerts":false,"has_exploit_blocks":true,"has_malware_alerts":false,"has_generic_alerts":false,"has_active_threats":false,"has_malware_quarantined":false,"has_malware_cleaned":false,"has_presence_alerts":false,"has_execution_alerts":false,"search_row":"","has_share_mode":"","filterQuery":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.total	number	Response data
data.query	object	Response data
data.query.host_sets.query	object	Response data
data.query.host_sets.query.operator	string	Response data
data.query.host_sets.query.operands	array	Response data
data.query.host_sets.query.operands.setId	number	Response data
data.query.host_sets.query.operands.operator	string	Response data
data.query.host_sets.query.operands.operands	array	Response data
data.sort	object	Response data
data.offset	number	Response data
data.limit	number	Response data
data.entries	array	Response data
data.entries._id	string	Response data
data.entries.agent_version	string	Response data
data.entries.excluded_from_containment	boolean	Response data
data.entries.containment_missing_software	boolean	Response data
data.entries.containment_queued	boolean	Response data
data.entries.containment_state	string	Response data
data.entries.stats	object	Response data
data.entries.stats.acqs	number	Response data
data.entries.stats.malware_cleaned_count	number	Response data
data.entries.stats.malware_quarantined_count	number	Response data

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"total":1,"query":{},"sort":{},"offset":0,"limit":50,"entries":[]},"message":"OK","details":[{}],"route":"/hx/api/v3/host_policies/channels/id/hosts"}}

Get Containment State by Agent ID

Fetches the containment state of a specific agent in Trellix HX Endpoint Security using the agent ID.

Endpoint

URL: /hosts/{{agent_id}}/containment

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.agent_id	string	Required	The agent running on the host. The agent_id is listed on the Host Details tab for the host endpoint. The agent ID is automatically generated when the agent first signs on to the primary HX Series appliance.

Input Example

{"path_parameters":{"agent_id":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
details	array	Output field: details
route	string	Output field: route
data	object	Response data
data._id	string	Response data
data.last_sysinfo	string	Response data
data.requested_by_actor	object	Response data
data.requested_on	object	Response data
data.contained_by_actor	object	Response data
data.contained_on	object	Response data
data.queued	boolean	Response data
data.excluded	boolean	Response data
data.missing_software	boolean	Response data
data.reported_clone	boolean	Response data
data.state	string	Response data
data.state_update_time	string	Response data
data.url	string	Response data
message	string	Response message

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"details":[{}],"route":"/hx/api/v3/hosts/agent_id/containment","data":{"_id":"S8Y5cr4oBbkbZmUYrgMicr","last_sysinfo":"2020-05-28T08:15:05.898Z","requested_by_actor":null,"requested_on":null,"contained_by_actor":null,"contained_on":null,"queued":false,"excluded":false,"missing_software":false,"reported_clone":false,"state":"normal","sta...

Get Containment Status

Fetches the containment state for all known hosts within Trellix HX Endpoint Security.

Endpoint

URL: /containment_states

Method: GET

Input

Argument Name	Type	Required	Description
parameters.state_update_time	string	Optional	Retrieves only hosts that have state_update_time greater than the value specified.
parameters.offset	number	Optional	Specifies which record to start with in the response. The default is 0.
parameters.limit	number	Optional	Specifies how many records are returned. The default is 50.

Input Example

{"parameters":{"state_update_time":"","offset":0,"limit":50}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.total	number	Response data
data.query	object	Response data
data.sort	object	Response data
data.offset	number	Response data
data.limit	number	Response data
data.entries	array	Response data
data.entries._id	string	Response data
data.entries.last_sysinfo	string	Response data
data.entries.requested_by_actor	object	Response data
data.entries.requested_by_actor._id	number	Response data
data.entries.requested_by_actor.username	string	Response data
data.entries.requested_on	string	Response data
data.entries.contained_by_actor	object	Response data
data.entries.contained_on	object	Response data
data.entries.queued	boolean	Response data
data.entries.excluded	boolean	Response data
data.entries.missing_software	boolean	Response data
data.entries.reported_clone	boolean	Response data
data.entries.state	string	Response data
data.entries.state_update_time	string	Response data
data.entries.url	string	Response data
message	string	Response message

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"total":1,"query":{},"sort":{},"offset":0,"limit":50,"entries":[]},"message":"OK","details":[{}],"route":"/hx/api/v3/containment_states"}}

Get Hosts

Obtain a list of hosts from the Trellix HX Endpoint Security server for monitoring and management purposes.

Endpoint

URL: /hosts

Method: GET

Input

Argument Name	Type	Required	Description
parameters.offset	number	Optional	Specifies which record to start with in the response. The default is 0.
parameters.limit	number	Optional	Specifies how many records are returned. The default is 50.
parameters.sort	array	Optional	Sorts the results by the specified field in ascending or descending order. The default is sorting by _id in descending order. Sort fields may be followed by ":asc" or ":desc" to indicate ascending or descending order. Multiple sort fields may be specified.
parameters._id	string	Optional	Unique agent ID.
parameters.agent_version	string	Optional	Agent version.
parameters.containment_queued	boolean	Optional	Containment requested.
parameters.containment_state	string	Optional	Containment state.
parameters.last_audit_timestamp	string	Optional	Time when the most recent system information audit was performed.
parameters.last_alert_timestamp	string	Optional	The time stamp of the most recent alert for the host.
parameters.hostname	string	Optional	Name of the host.
parameters.domain	string	Optional	Network domain.
parameters.gmt_offset_seconds	number	Optional	How many seconds the offset is from Greenwich Mean Time (GMT).
parameters.timezone	string	Optional	Timezone name.
parameters.os.product_name	string	Optional	Operating system name.
parameters.os.patch_level	string	Optional	Operating system patch.
parameters.os.bitness	string	Optional	Operating system word size.
parameters.os.platform	string	Optional	Family of operating systems..
parameters.reported_clone	boolean	Optional	Indicates more than one host has this same agent ID.
parameters.stats.alerting_conditions	number	Optional	Number of alerting conditions.
parameters.stats.acqs	number	Optional	Number of file acquisition requests.
parameters.stats.alerts	number	Optional	Total number of alerts, including exploit-detection alerts.
parameters.stats.exploit_alerts	number	Optional	Number of exploit alerts, partially blocked exploits, and blocked exploits.
parameters.stats.malware_alerts	number	Optional	The number of malware alerts on the host.
parameters.stats.generic_alerts	number	Optional	The number of generic alerts on the host.
parameters.stats.malware_cleaned_count	number	Optional	The number of cleaned malware on the host.

Input Example

{"parameters":{"offset":0,"limit":50,"sort":["_id:desc"],"_id":"","agent_version":"","containment_queued":true,"containment_state":"normal","last_audit_timestamp":"","last_alert_timestamp":"","hostname":"","domain":"","gmt_offset_seconds":1,"timezone":"","os.product_name":"","os.patch_level":"","os.bitness":"64-bit","os.platform":"win","reported_clone":true,"stats.alerting_conditions":1,"stats.acqs":3,"stats.alerts":2,"stats.exploit_alerts":4,"stats.malware_alerts":5,"stats.generic_alerts":6,"stats.malware_cleaned_count":2,"stats.malware_quarantined_count":2,"last_poll_timestamp":"","source_alert._id":4,"host_sets._id":"","host_sets.query":"","has_alerts":true,"has_exploit_alerts":false,"has_exploit_blocks":true,"has_malware_alerts":false,"has_generic_alerts":false,"has_active_threats":false,"has_malware_quarantined":false,"has_malware_cleaned":false,"has_presence_alerts":false,"has_execution_alerts":false,"search_row":"","has_share_mode":"","filterQuery":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.total	number	Response data
data.query	object	Response data
data.query.host_sets.query	object	Response data
data.query.host_sets.query.operator	string	Response data
data.query.host_sets.query.operands	array	Response data
data.query.host_sets.query.operands.setId	number	Response data
data.query.host_sets.query.operands.operator	string	Response data
data.query.host_sets.query.operands.operands	array	Response data
data.sort	object	Response data
data.offset	number	Response data
data.limit	number	Response data
data.entries	array	Response data
data.entries._id	string	Response data
data.entries.agent_version	string	Response data
data.entries.excluded_from_containment	boolean	Response data
data.entries.containment_missing_software	boolean	Response data
data.entries.containment_queued	boolean	Response data
data.entries.containment_state	string	Response data
data.entries.stats	object	Response data
data.entries.stats.acqs	number	Response data
data.entries.stats.malware_cleaned_count	number	Response data
data.entries.stats.malware_quarantined_count	number	Response data

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"total":1,"query":{},"sort":{},"offset":0,"limit":50,"entries":[]},"message":"OK","details":[{}],"route":"/hx/api/v3/host_policies/channels/id/hosts"}}

Get List of Triages

Retrieve a list of triage entries from Trellix HX Endpoint Security, detailing known system issues.

Endpoint

URL: /acqs/triages

Method: GET

Input

Argument Name	Type	Required	Description
parameters.offset	number	Optional	Specifies which record to start with in the response. The default is 0.
parameters.limit	number	Optional	Specifies how many records are returned. The default is 50.
parameters.sort	array	Optional	Sorts the results by the specified field in ascending or descending order. The default is sorting by _id in descending order. Sort fields may be followed by ":asc" or ":desc" to indicate ascending or descending order. Multiple sort fields may be specified.
parameters.search	string	Optional	Global search value.
parameters.external_id	string	Optional	Filter triage acquisitions by external correlation ID from a SIEM solution.
parameters.host._id	string	Optional	Filter triage acquisitions by Host ID.

Input Example

{"parameters":{"offset":0,"limit":1,"sort":["_id:desc"],"search":"","external_id":"","host._id":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.total	number	Response data
data.query	object	Response data
data.sort	object	Response data
data.offset	number	Response data
data.limit	number	Response data
data.entries	array	Response data
data.entries._id	number	Response data
data.entries._revision	string	Response data
data.entries.error_message	object	Response data
data.entries.state	string	Response data
data.entries.md5	object	Response data
data.entries.request_time	string	Response data
data.entries.request_actor	object	Response data
data.entries.request_actor._id	number	Response data
data.entries.request_actor.username	string	Response data
data.entries.req_timestamp	object	Response data
data.entries.comment	string	Response data
data.entries.external_id	object	Response data
data.entries.finish_time	object	Response data
data.entries.indicator	object	Response data
data.entries.disable_cef	boolean	Response data
data.entries.url	string	Response data

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"total":4,"query":{},"sort":{},"offset":0,"limit":1,"entries":[]},"message":"OK","details":[{}],"route":"/hx/api/v3/acqs/triages"}}

Get Quarantine by ID

Retrieves details of a specific quarantine entry from Trellix HX Endpoint Security using the provided ID.

Endpoint

URL: /quarantines/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	number	Required	Unique quarantine ID.

Input Example

{"path_parameters":{"id":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
details	array	Output field: details
details.file_name	string	Name of the resource
details.file	string	Output field: details.file
route	string	Output field: route
data	object	Response data
data._id	number	Response data
data.agent_quarantine_id	string	Response data
data.hit_correlation_id	string	Response data
data.file_path	string	Response data
data.file_md5	string	Response data
data.file_sha1	string	Response data
data.reported_at	string	Response data
data.quarantined_at	string	Response data
data.alert_file_creation_time	string	Response data
data.alert_infection_name	string	Response data
data.state	string	Response data
data.update_time	string	Response data
data.url	string	Response data
data.host	object	Response data
data.host._id	string	Response data
data.host.url	string	Response data
data.alert	object	Response data
data.alert._id	number	Response data

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"details":[],"route":"/hx/api/v3/quarantines/id","data":{"_id":106,"agent_quarantine_id":"23775c33-b95c-438d-94f5-48209332f35a","hit_correlation_id":"c4689c40-d7b5-4e2e-9ade-7c49e9718330","file_path":"D:\\documents\\Samples\\grrr.exe","file_md5":"0b141adba998fef7e7c99b9d97de3041","file_sha1":"a94fce81574fe524002ea69f61bbe7e10838e925","...

Get Search Results

Retrieve a list of all enterprise searches conducted within Trellix HX Endpoint Security.

Endpoint

URL: /searches

Method: GET

Input

Argument Name	Type	Required	Description
parameters.offset	number	Optional	Specifies which record to start with in the response. The default is 0.
parameters.limit	number	Optional	Specifies how many records are returned. The default is 50.
parameters.sort	array	Optional	Sorts the results by the specified field in ascending or descending order. The default is sorting by _id in descending order. Sort fields may be followed by ":asc" or ":desc" to indicate ascending or descending order. Multiple sort fields may be specified.
parameters.state	string	Optional	Filter by search state.
parameters.host_set._id	number	Optional	Filter searches by host set ID.
parameters.update_actor._id	number	Optional	Filter searches by user ID that last updated searches.
parameters.update_actor.username	string	Optional	Filter searches by username that last updated searches.
parameters.create_actor._id	number	Optional	Filter searches by user ID that created searches.
parameters.create_actor.username	string	Optional	Filter searches by username that created searches.
parameters.settings.mode	string	Optional	Filter searches based on the search mode, the value can be HOST or GRID.
parameters.input_type	string	Optional	Filter searches based on how the search started , the value can be ui or api.

Input Example

{"parameters":{"offset":0,"limit":50,"sort":["_id:desc"],"state":"","host_set._id":1,"update_actor._id":2,"update_actor.username":"","create_actor._id":2,"create_actor.username":"","settings.mode":"","input_type":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.total	number	Response data
data.query	object	Response data
data.sort	object	Response data
data.offset	number	Response data
data.limit	number	Response data
data.entries	array	Response data
data.entries._id	number	Response data
data.entries._url	string	Response data
data.entries.state	string	Response data
data.entries.scripts	array	Response data
data.entries.scripts._id	number	Response data
data.entries.scripts.url	string	Response data
data.entries.scripts.download	string	Response data
data.entries.scripts.platform	string	Response data
data.entries.host_set	object	Response data
data.entries.host_set._id	number	Response data
data.entries.host_set.url	string	Response data
data.entries.host_set.name	string	Response data
data.entries.update_time	string	Response data
data.entries.create_time	string	Response data
data.entries.update_actor	object	Response data
data.entries.update_actor._id	number	Response data

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"total":0,"query":{},"sort":{},"offset":0,"limit":0,"entries":[]},"message":"string","details":[{}],"route":"string"}}

Get Triage Acquisition by ID

Fetches details of a specific triage acquisition from Trellix HX Endpoint Security using the provided ID.

Endpoint

URL: /acqs/triages/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Unique acquisition ID.

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
details	array	Output field: details
route	string	Output field: route
data	object	Response data
data._id	number	Response data
data._revision	string	Response data
data.error_message	string	Response data
data.state	string	Response data
data.md5	object	Response data
data.request_time	string	Response data
data.request_actor	object	Response data
data.request_actor._id	number	Response data
data.request_actor.username	string	Response data
data.req_timestamp	object	Response data
data.comment	string	Response data
data.external_id	object	Response data
data.finish_time	string	Response data
data.indicator	object	Response data
data.disable_cef	boolean	Response data
data.url	string	Response data
data.host	object	Response data
data.host._id	string	Response data
data.host.url	string	Response data
data.alert	object	Response data

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"details":[{}],"route":"/hx/api/v3/acqs/triages/id","data":{"_id":10,"_revision":"20200716133632656552107126","error_message":"The triage completed with issues.","state":"COMPLETE","md5":null,"request_time":"2020-07-16T13:28:43.887Z","request_actor":{},"req_timestamp":null,"comment":"","external_id":null,"finish_time":"2020-07-16T13:36...

Get Triage Collection by ID

Retrieves a specific triage collection (MANS file) from Trellix HX Endpoint Security using the provided ID.

Endpoint

URL: /acqs/triages/{{id}}.mans

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Unique acquisition ID.

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{}}

New Triage Acquisition

Initiates a new triage acquisition for a specified agent in Trellix HX Endpoint Security using the agent_id.

Endpoint

URL: /hosts/{{agent_id}}/triages

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.agent_id	string	Required	Unique agent ID.
req_timestamp	string	Optional	The triage collection for this time.
external_id	string	Optional	External correlation ID from a SIEM solution.
disable_cef	boolean	Optional	When "disable_cef" is set to false, and when CEF logging is enabled, Endpoint Security will log each triage or bulk acquisition task creation, pickup, and completion. When "disable_cef" is true, this logging is skipped.

Input Example

{"json_body":{"req_timestamp":"2030-10-10T17:40:13.413Z","external_id":"some.id","disable_cef":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
details	array	Output field: details
route	string	Output field: route
data	object	Response data
data._id	number	Response data
data._revision	string	Response data
data.error_message	string	Response data
data.state	string	Response data
data.md5	object	Response data
data.request_time	string	Response data
data.request_actor	object	Response data
data.request_actor._id	number	Response data
data.request_actor.username	string	Response data
data.req_timestamp	object	Response data
data.comment	string	Response data
data.external_id	object	Response data
data.finish_time	string	Response data
data.indicator	object	Response data
data.disable_cef	boolean	Response data
data.url	string	Response data
data.host	object	Response data
data.host._id	string	Response data
data.host.url	string	Response data
data.alert	object	Response data

Output Example

{"status_code":201,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"details":[{}],"route":"/hx/api/v3/acqs/triages/id","data":{"_id":10,"_revision":"20200716133632656552107126","error_message":"The triage completed with issues.","state":"COMPLETE","md5":null,"request_time":"2020-07-16T13:28:43.887Z","request_actor":{},"req_timestamp":null,"comment":"","external_id":null,"finish_time":"2020-07-16T13:36...

Response Headers

Header	Description	Example
content-length	The length of the response body in bytes	140
content-type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Mon, 10 Jun 2024 20:37:23 GMT