--- title: Trellix HX Endpoint Security slug: connectors/trellix-hx-endpoint-security docTags: createdAt: 2026-06-09T16:30:07.917Z --- The Trellix HX Endpoint Security connector enables automated interactions with the Trellix HX platform for enhanced endpoint protection and incident response. Trellix HX Endpoint Security is a robust platform designed for advanced threat detection and response. By integrating with Swimlane Turbine, users can automate critical security operations tasks such as host containment, detailed searches, file acquisition, and alert management. This connector empowers security teams to swiftly isolate threats, conduct comprehensive investigations, and manage alerts efficiently, thereby reducing response times and bolstering overall security posture. The Trellix HX Endpoint Security Connector is capable of interacting with the Trellix HX Endpoint Security REST API to run various triage, acquisition, alert, and contain tasks. ## Prerequisites Before you can utilize the Trellix HX Endpoint Security connector for Turbine, ensure you have the following: - HTTP Basic Authentication with these parameters: - URL: The endpoint URL for the Trellix HX API. - Username: Your Trellix HX account username. - Password: Your Trellix HX account password. ## Capabilities This Trellix HX Endpoint Security connector provides the following capabilities: - Contain Host - Containment Cancellation - Create Search - Download File Acqusition - Get Alert by ID - Get Alert groups - Get Alerted Hosts - Get Containment State by Agent ID - Get Containment Status - Get Hosts - Get List of Triages - Get Quarantine by ID - Get Search Results - Get Triage Acquisition by ID - Get Triage Collection by ID *... and so on* ## Asset Setup Trellix HX Endpoint Security must be configured to allow access to the API. After logging into Trellix HX Endpoint Security as an Administrator, navigate to **Admin > Appliance Settings > User Accounts**. Select the **api\_admin account**, change the drop-down from **Local Login Disabled** to **Password Set**, type in your new password, and click **Update User**. Swimlane will expect the username **api\_admin**, the password you just set, and the host with the port included ([https://myhost:3000](https://myhost:3000)**)**. You may also use the **api\_analyst** user or any other user for Swimlane by following the same process and ensuring the user roll is one of **api\_analyst** or **api\_admin**. There are permissions differences between the two different API roles. **api\_admin** is less restrictive and allows actions like containing hosts and maintaining custom policy channels. ## Notes - [Trellix Doc Portal](https://docs.trellix.com/bundle/hx_api_2020-2/page/UUID-e2c37f22-ed87-8470-e318-90c52ddaafdb.html) - [Trellix HX Endpoint Security API Specs](https://fireeye.dev/apis/lighthouse/) # Configurations ## Trellix HX HTTP Basic Authentication Authenticates using username and password. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | username | Username | string | Required | | password | Password | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Contain Host Initiates containment of a specified host using its agent\_id to prevent access to other systems on the network. ### Endpoint - **URL:** `/hosts/{{agent_id}}/containment` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.agent_id` | string | Required | The agent running on the host. The agent\_id is listed on the Host Details tab for the host endpoint. The agent ID is automatically generated when the agent first signs on to the primary HX Series appliance. | ### Input Example `{"path_parameters":{"agent_id":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `details` | array | Output field: details | | `route` | string | Output field: route | | `message` | string | Response message | ### Output Example `{"status_code":202,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"details":[],"route":"/hx/api/v3/hosts/agent_id/containment","message":"Accepted"}}` ## Containment Cancellation Release a specific host from containment in Trellix HX Endpoint Security using the agent's ID. ### Endpoint - **URL:** `/hosts/{{agent_id}}/containment` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.agent_id` | string | Required | The agent running on the host. The agent\_id is listed on the Host Details tab for the host endpoint. The agent ID is automatically generated when the agent first signs on to the primary HX Series appliance. | ### Input Example `{"path_parameters":{"agent_id":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"status_code":204,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"No Content","response_text":""}` ## Create Search Initiates an enterprise search in Trellix HX Endpoint Security, with options for quick or exhaustive searches. ### Endpoint - **URL:** `/searches` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | --------------------------- | | `host_set` | object | Optional | Parameter for Create Search | | `host_set._id` | number | Optional | Unique identifier | | `hosts` | array | Optional | Parameter for Create Search | | `hosts._id` | string | Optional | Unique identifier | | `indicator` | string | Optional | Parameter for Create Search | | `exhaustive` | object | Optional | Parameter for Create Search | | `exhaustive.override` | array | Optional | Unique identifier | | `exhaustive.override.item_type` | string | Optional | Unique identifier | | `exhaustive.override.name` | string | Optional | Unique identifier | | `exhaustive.override.value` | boolean | Optional | Unique identifier | | `query` | array | Optional | Parameter for Create Search | | `query.field` | string | Optional | Parameter for Create Search | | `query.operator` | string | Optional | Parameter for Create Search | | `query.value` | string | Optional | Value for the parameter | ### Input Example `{"json_body":{"host_set":{"_id":0},"hosts":[{"_id":"string"}],"indicator":"string","exhaustive":{"override":[{"item_type":"CookieHistoryItem","name":"string","value":true}]},"query":[{"field":"Application Name","operator":"equals","value":"string"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data._id` | number | Response data | | `data.state` | string | Response data | | `data.scripts` | array | Response data | | `data.scripts._id` | number | Response data | | `data.scripts.url` | string | Response data | | `data.scripts.download` | string | Response data | | `data.scripts.platform` | string | Response data | | `data.update_time` | string | Response data | | `data.create_time` | string | Response data | | `data.update_actor` | object | Response data | | `data.update_actor._id` | number | Response data | | `data.update_actor.username` | string | Response data | | `data.create_actor` | object | Response data | | `data.create_actor._id` | number | Response data | | `data.create_actor.username` | string | Response data | | `data.error` | array | Response data | | `data._revision` | string | Response data | | `data.input_type` | string | Input data for the action | | `data.url` | string | Response data | | `data.host_set` | object | Response data | | `data.host_set._id` | number | Response data | | `data.host_set.url` | string | Response data | ### Output Example `{"status_code":201,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"_id":0,"state":"string","scripts":[],"update_time":"2024-06-12T10:17:31.972Z","create_time":"2024-06-12T10:17:31.972Z","update_actor":{},"create_actor":{},"error":[],"_revision":"string","input_type":"string","url":"string","host_set":{},"stats":{},"settings":{}},"message":"string","details":[{}],"route":"string"}}` ## Download File Acqusition Initiates the download of a specified file from an endpoint using Trellix HX, requiring agent ID, path, and filename. ### Endpoint - **URL:** `/hosts/{{agent_id}}/files` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | -------------------------------------------------- | | `path_parameters.agent_id` | string | Required | Parameters for the Download File Acqusition action | | `req_path` | string | Optional | Path of the file that you want to acquire. | | `req_filename` | string | Optional | Name of the file that you want to acquire. | | `comment` | string | Optional | General comment. | | `req_use_api` | boolean | Optional | Whether to use the API or RAW. | | `external_id` | string | Optional | External correlation ID from a SIEM solution. | ### Input Example `{"json_body":{"req_path":"C:\\$Extend\\$RmMetadata\\$TxfLog\\","req_filename":"$TxfLog.blf","comment":"this is a comment","req_use_api":true,"external_id":""}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file` | object | Attachments | | `file.file` | string | Output field: file.file | | `file.file_name` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 5 Jun 2024 20:37:23 GMT"},"reason":"OK","file":[]}` ## Get Alert by ID Retrieves a specific alert from Trellix HX Endpoint Security using the provided alert ID. ### Endpoint - **URL:** `/alerts/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ---------------- | | `path_parameters.id` | string | Required | Unique alert ID. | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data._id` | number | Response data | | `data.agent` | object | Response data | | `data.appliance` | object | Response data | | `data.appliance._id` | string | Response data | | `data.condition` | object | Response data | | `data.condition._id` | string | Response data | | `data.condition.url` | string | Response data | | `data.condition.enabled` | boolean | Response data | | `data.condition.uuid` | string | Response data | | `data.condition.tests` | string | Response data | | `data.condition.event_type` | string | Response data | | `data.indicator` | object | Response data | | `data.indicator._id` | string | Response data | | `data.indicator.url` | string | Response data | | `data.indicator.name` | string | Response data | | `data.indicator.uri_name` | string | Response data | | `data.indicator.display_name` | string | Response data | | `data.indicator.signature` | string | Response data | | `data.indicator.category` | number | Response data | | `data.event_id` | string | Response data | | `data.event_type` | string | Response data | | `data.event_values` | object | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"_id":0,"agent":{},"appliance":{},"condition":{},"indicator":{},"event_id":"string","event_type":"string","event_values":{},"event_at":"2024-06-10T10:14:47.547Z","matched_at":"2024-06-10T10:14:47.547Z","reported_at":"2024-06-10T10:14:47.547Z","source":"string","subtype":"string","matched_source_alerts":[],"has_share_mode":"unre...` ## Get Alert groups Retrieve a list of all alert groups from Trellix HX Endpoint Security to streamline incident analysis and response. ### Endpoint - **URL:** `/alert_groups` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.offset` | number | Optional | Specifies which record to start with in the response. The default is 0. | | `parameters.limit` | number | Optional | Specifies how many records are returned. The default is 50. | | `parameters.sort` | array | Optional | Sorts the results by the specified field in ascending or descending order. The default is sorting by \_id in descending order. Sort fields may be followed by "\:asc" or "\:desc" to indicate ascending or descending order. Multiple sort fields may be specified. | | `parameters._id` | string | Optional | Unique alert group ID. | | `parameters.host._id` | string | Optional | Unique Host ID. | | `parameters.host.hostname` | string | Optional | Name of the host. | | `parameters.host.primary_ip_address` | string | Optional | Primary IP address of the host. | | `parameters.assessment` | string | Optional | Brief assessment of the potential threat. | | `parameters.file_full_path` | string | Optional | Full path of the suspect file. | | `parameters.acknowledgement.acknowledged` | boolean | Optional | The alert has been acknowledged. | | `parameters.acknowledgement.acknowledged_by` | string | Optional | User who has been acknowledged the alert. | | `parameters.acknowledgement.acknowledged_time` | string | Optional | Time alert was acknowledged. | | `parameters.source` | string | Optional | Source of alert. Valid values include "IOC" (indicator of compromise), "EXD" (exploit detection), and "MAL" (malware alert), etc. | | `parameters.has_fp_disposition` | boolean | Optional | Identifies which alert groups have an associated FP filter. | | `parameters.last_alert.resolution` | string | Optional | Resolution of the most recent alert. | | `parameters.grouped_by.md5sum` | string | Optional | MD5 hash from the alert group filter. | | `parameters.filterQuery` | string | Optional | The filterQuery parameter allows for very specific filtering of search results. This must be an URL encoded JSON object. | ### Input Example `{"parameters":{"offset":0,"limit":50,"sort":["_id:desc"],"_id":"","host._id":"","host.hostname":"","host.primary_ip_address":"","assessment":"","file_full_path":"","acknowledgement.acknowledged":true,"acknowledgement.acknowledged_by":"","acknowledgement.acknowledged_time":"","source":"","has_fp_disposition":true,"last_alert.resolution":"","grouped_by.md5sum":"","filterQuery":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.total` | number | Response data | | `data.query` | object | Response data | | `data.sort` | object | Response data | | `data.offset` | number | Response data | | `data.limit` | number | Response data | | `data.entries` | array | Response data | | `data.entries._id` | string | Response data | | `data.entries.url` | string | Response data | | `data.entries.host` | object | Response data | | `data.entries.host._id` | string | Response data | | `data.entries.host.url` | string | Response data | | `data.entries.host.hostname` | string | Response data | | `data.entries.host.primary_ip_address` | string | Response data | | `data.entries.assessment` | string | Response data | | `data.entries.file_full_path` | string | Response data | | `data.entries.acknowledgement` | object | Response data | | `data.entries.acknowledgement.acknowledged` | boolean | Response data | | `data.entries.acknowledgement.acknowledged_by` | string | Response data | | `data.entries.acknowledgement.acknowledged_time` | string | Response data | | `data.entries.stats` | object | Response data | | `data.entries.stats.events` | number | Response data | | `data.entries.first_event_at` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"total":0,"query":{},"sort":{},"offset":0,"limit":0,"entries":[]},"message":"string","details":[{}],"route":"string"}}` ## Get Alerted Hosts Retrieves a list of hosts with alert conditions linked to a specific source alert ID in Trellix HX Endpoint Security. ### Endpoint - **URL:** `/source_alerts/{{id}}/alerted_hosts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.id` | string | Required | Unique alert ID. | | `parameters.offset` | number | Optional | Specifies which record to start with in the response. The default is 0. | | `parameters.limit` | number | Optional | Specifies how many records are returned. The default is 50. | | `parameters.sort` | array | Optional | Sorts the results by the specified field in ascending or descending order. The default is sorting by \_id in descending order. Sort fields may be followed by "\:asc" or "\:desc" to indicate ascending or descending order. Multiple sort fields may be specified. | | `parameters._id` | string | Optional | Unique agent ID. | | `parameters.agent_version` | string | Optional | Agent version. | | `parameters.containment_queued` | boolean | Optional | Containment requested. | | `parameters.containment_state` | string | Optional | Containment state. | | `parameters.last_audit_timestamp` | string | Optional | Time when the most recent system information audit was performed. | | `parameters.last_alert_timestamp` | string | Optional | The time stamp of the most recent alert for the host. | | `parameters.hostname` | string | Optional | Name of the host. | | `parameters.domain` | string | Optional | Network domain. | | `parameters.gmt_offset_seconds` | number | Optional | How many seconds the offset is from Greenwich Mean Time (GMT). | | `parameters.timezone` | string | Optional | Timezone name. | | `parameters.os.product_name` | string | Optional | Operating system name. | | `parameters.os.patch_level` | string | Optional | Operating system patch. | | `parameters.os.bitness` | string | Optional | Operating system word size. | | `parameters.os.platform` | string | Optional | Family of operating systems.. | | `parameters.reported_clone` | boolean | Optional | Indicates more than one host has this same agent ID. | | `parameters.stats.alerting_conditions` | number | Optional | Number of alerting conditions. | | `parameters.stats.acqs` | number | Optional | Number of file acquisition requests. | | `parameters.stats.alerts` | number | Optional | Total number of alerts, including exploit-detection alerts. | | `parameters.stats.exploit_alerts` | number | Optional | Number of exploit alerts, partially blocked exploits, and blocked exploits. | | `parameters.stats.malware_alerts` | number | Optional | The number of malware alerts on the host. | | `parameters.stats.generic_alerts` | number | Optional | The number of generic alerts on the host. | ### Input Example `{"parameters":{"offset":0,"limit":50,"sort":["_id:desc"],"_id":"","agent_version":"","containment_queued":true,"containment_state":"normal","last_audit_timestamp":"","last_alert_timestamp":"","hostname":"","domain":"","gmt_offset_seconds":1,"timezone":"","os.product_name":"","os.patch_level":"","os.bitness":"64-bit","os.platform":"win","reported_clone":true,"stats.alerting_conditions":1,"stats.acqs":3,"stats.alerts":2,"stats.exploit_alerts":4,"stats.malware_alerts":5,"stats.generic_alerts":6,"stats.malware_cleaned_count":2,"stats.malware_quarantined_count":2,"last_poll_timestamp":"","host_sets._id":"","host_sets.query":"","has_alerts":true,"has_exploit_alerts":false,"has_exploit_blocks":true,"has_malware_alerts":false,"has_generic_alerts":false,"has_active_threats":false,"has_malware_quarantined":false,"has_malware_cleaned":false,"has_presence_alerts":false,"has_execution_alerts":false,"search_row":"","has_share_mode":"","filterQuery":""}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.total` | number | Response data | | `data.query` | object | Response data | | `data.query.host_sets.query` | object | Response data | | `data.query.host_sets.query.operator` | string | Response data | | `data.query.host_sets.query.operands` | array | Response data | | `data.query.host_sets.query.operands.setId` | number | Response data | | `data.query.host_sets.query.operands.operator` | string | Response data | | `data.query.host_sets.query.operands.operands` | array | Response data | | `data.sort` | object | Response data | | `data.offset` | number | Response data | | `data.limit` | number | Response data | | `data.entries` | array | Response data | | `data.entries._id` | string | Response data | | `data.entries.agent_version` | string | Response data | | `data.entries.excluded_from_containment` | boolean | Response data | | `data.entries.containment_missing_software` | boolean | Response data | | `data.entries.containment_queued` | boolean | Response data | | `data.entries.containment_state` | string | Response data | | `data.entries.stats` | object | Response data | | `data.entries.stats.acqs` | number | Response data | | `data.entries.stats.malware_cleaned_count` | number | Response data | | `data.entries.stats.malware_quarantined_count` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"total":1,"query":{},"sort":{},"offset":0,"limit":50,"entries":[]},"message":"OK","details":[{}],"route":"/hx/api/v3/host_policies/channels/id/hosts"}}` ## Get Containment State by Agent ID Fetches the containment state of a specific agent in Trellix HX Endpoint Security using the agent ID. ### Endpoint - **URL:** `/hosts/{{agent_id}}/containment` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.agent_id` | string | Required | The agent running on the host. The agent\_id is listed on the Host Details tab for the host endpoint. The agent ID is automatically generated when the agent first signs on to the primary HX Series appliance. | ### Input Example `{"path_parameters":{"agent_id":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `details` | array | Output field: details | | `route` | string | Output field: route | | `data` | object | Response data | | `data._id` | string | Response data | | `data.last_sysinfo` | string | Response data | | `data.requested_by_actor` | object | Response data | | `data.requested_on` | object | Response data | | `data.contained_by_actor` | object | Response data | | `data.contained_on` | object | Response data | | `data.queued` | boolean | Response data | | `data.excluded` | boolean | Response data | | `data.missing_software` | boolean | Response data | | `data.reported_clone` | boolean | Response data | | `data.state` | string | Response data | | `data.state_update_time` | string | Response data | | `data.url` | string | Response data | | `message` | string | Response message | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"details":[{}],"route":"/hx/api/v3/hosts/agent_id/containment","data":{"_id":"S8Y5cr4oBbkbZmUYrgMicr","last_sysinfo":"2020-05-28T08:15:05.898Z","requested_by_actor":null,"requested_on":null,"contained_by_actor":null,"contained_on":null,"queued":false,"excluded":false,"missing_software":false,"reported_clone":false,"state":"normal","sta...` ## Get Containment Status Fetches the containment state for all known hosts within Trellix HX Endpoint Security. ### Endpoint - **URL:** `/containment_states` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | ------------------------------------------------------------------------------------ | | `parameters.state_update_time` | string | Optional | Retrieves only hosts that have state\_update\_time greater than the value specified. | | `parameters.offset` | number | Optional | Specifies which record to start with in the response. The default is 0. | | `parameters.limit` | number | Optional | Specifies how many records are returned. The default is 50. | ### Input Example `{"parameters":{"state_update_time":"","offset":0,"limit":50}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.total` | number | Response data | | `data.query` | object | Response data | | `data.sort` | object | Response data | | `data.offset` | number | Response data | | `data.limit` | number | Response data | | `data.entries` | array | Response data | | `data.entries._id` | string | Response data | | `data.entries.last_sysinfo` | string | Response data | | `data.entries.requested_by_actor` | object | Response data | | `data.entries.requested_by_actor._id` | number | Response data | | `data.entries.requested_by_actor.username` | string | Response data | | `data.entries.requested_on` | string | Response data | | `data.entries.contained_by_actor` | object | Response data | | `data.entries.contained_on` | object | Response data | | `data.entries.queued` | boolean | Response data | | `data.entries.excluded` | boolean | Response data | | `data.entries.missing_software` | boolean | Response data | | `data.entries.reported_clone` | boolean | Response data | | `data.entries.state` | string | Response data | | `data.entries.state_update_time` | string | Response data | | `data.entries.url` | string | Response data | | `message` | string | Response message | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"total":1,"query":{},"sort":{},"offset":0,"limit":50,"entries":[]},"message":"OK","details":[{}],"route":"/hx/api/v3/containment_states"}}` ## Get Hosts Obtain a list of hosts from the Trellix HX Endpoint Security server for monitoring and management purposes. ### Endpoint - **URL:** `/hosts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.offset` | number | Optional | Specifies which record to start with in the response. The default is 0. | | `parameters.limit` | number | Optional | Specifies how many records are returned. The default is 50. | | `parameters.sort` | array | Optional | Sorts the results by the specified field in ascending or descending order. The default is sorting by \_id in descending order. Sort fields may be followed by "\:asc" or "\:desc" to indicate ascending or descending order. Multiple sort fields may be specified. | | `parameters._id` | string | Optional | Unique agent ID. | | `parameters.agent_version` | string | Optional | Agent version. | | `parameters.containment_queued` | boolean | Optional | Containment requested. | | `parameters.containment_state` | string | Optional | Containment state. | | `parameters.last_audit_timestamp` | string | Optional | Time when the most recent system information audit was performed. | | `parameters.last_alert_timestamp` | string | Optional | The time stamp of the most recent alert for the host. | | `parameters.hostname` | string | Optional | Name of the host. | | `parameters.domain` | string | Optional | Network domain. | | `parameters.gmt_offset_seconds` | number | Optional | How many seconds the offset is from Greenwich Mean Time (GMT). | | `parameters.timezone` | string | Optional | Timezone name. | | `parameters.os.product_name` | string | Optional | Operating system name. | | `parameters.os.patch_level` | string | Optional | Operating system patch. | | `parameters.os.bitness` | string | Optional | Operating system word size. | | `parameters.os.platform` | string | Optional | Family of operating systems.. | | `parameters.reported_clone` | boolean | Optional | Indicates more than one host has this same agent ID. | | `parameters.stats.alerting_conditions` | number | Optional | Number of alerting conditions. | | `parameters.stats.acqs` | number | Optional | Number of file acquisition requests. | | `parameters.stats.alerts` | number | Optional | Total number of alerts, including exploit-detection alerts. | | `parameters.stats.exploit_alerts` | number | Optional | Number of exploit alerts, partially blocked exploits, and blocked exploits. | | `parameters.stats.malware_alerts` | number | Optional | The number of malware alerts on the host. | | `parameters.stats.generic_alerts` | number | Optional | The number of generic alerts on the host. | | `parameters.stats.malware_cleaned_count` | number | Optional | The number of cleaned malware on the host. | ### Input Example `{"parameters":{"offset":0,"limit":50,"sort":["_id:desc"],"_id":"","agent_version":"","containment_queued":true,"containment_state":"normal","last_audit_timestamp":"","last_alert_timestamp":"","hostname":"","domain":"","gmt_offset_seconds":1,"timezone":"","os.product_name":"","os.patch_level":"","os.bitness":"64-bit","os.platform":"win","reported_clone":true,"stats.alerting_conditions":1,"stats.acqs":3,"stats.alerts":2,"stats.exploit_alerts":4,"stats.malware_alerts":5,"stats.generic_alerts":6,"stats.malware_cleaned_count":2,"stats.malware_quarantined_count":2,"last_poll_timestamp":"","source_alert._id":4,"host_sets._id":"","host_sets.query":"","has_alerts":true,"has_exploit_alerts":false,"has_exploit_blocks":true,"has_malware_alerts":false,"has_generic_alerts":false,"has_active_threats":false,"has_malware_quarantined":false,"has_malware_cleaned":false,"has_presence_alerts":false,"has_execution_alerts":false,"search_row":"","has_share_mode":"","filterQuery":""}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.total` | number | Response data | | `data.query` | object | Response data | | `data.query.host_sets.query` | object | Response data | | `data.query.host_sets.query.operator` | string | Response data | | `data.query.host_sets.query.operands` | array | Response data | | `data.query.host_sets.query.operands.setId` | number | Response data | | `data.query.host_sets.query.operands.operator` | string | Response data | | `data.query.host_sets.query.operands.operands` | array | Response data | | `data.sort` | object | Response data | | `data.offset` | number | Response data | | `data.limit` | number | Response data | | `data.entries` | array | Response data | | `data.entries._id` | string | Response data | | `data.entries.agent_version` | string | Response data | | `data.entries.excluded_from_containment` | boolean | Response data | | `data.entries.containment_missing_software` | boolean | Response data | | `data.entries.containment_queued` | boolean | Response data | | `data.entries.containment_state` | string | Response data | | `data.entries.stats` | object | Response data | | `data.entries.stats.acqs` | number | Response data | | `data.entries.stats.malware_cleaned_count` | number | Response data | | `data.entries.stats.malware_quarantined_count` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"total":1,"query":{},"sort":{},"offset":0,"limit":50,"entries":[]},"message":"OK","details":[{}],"route":"/hx/api/v3/host_policies/channels/id/hosts"}}` ## Get List of Triages Retrieve a list of triage entries from Trellix HX Endpoint Security, detailing known system issues. ### Endpoint - **URL:** `/acqs/triages` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.offset` | number | Optional | Specifies which record to start with in the response. The default is 0. | | `parameters.limit` | number | Optional | Specifies how many records are returned. The default is 50. | | `parameters.sort` | array | Optional | Sorts the results by the specified field in ascending or descending order. The default is sorting by \_id in descending order. Sort fields may be followed by "\:asc" or "\:desc" to indicate ascending or descending order. Multiple sort fields may be specified. | | `parameters.search` | string | Optional | Global search value. | | `parameters.external_id` | string | Optional | Filter triage acquisitions by external correlation ID from a SIEM solution. | | `parameters.host._id` | string | Optional | Filter triage acquisitions by Host ID. | ### Input Example `{"parameters":{"offset":0,"limit":1,"sort":["_id:desc"],"search":"","external_id":"","host._id":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.total` | number | Response data | | `data.query` | object | Response data | | `data.sort` | object | Response data | | `data.offset` | number | Response data | | `data.limit` | number | Response data | | `data.entries` | array | Response data | | `data.entries._id` | number | Response data | | `data.entries._revision` | string | Response data | | `data.entries.error_message` | object | Response data | | `data.entries.state` | string | Response data | | `data.entries.md5` | object | Response data | | `data.entries.request_time` | string | Response data | | `data.entries.request_actor` | object | Response data | | `data.entries.request_actor._id` | number | Response data | | `data.entries.request_actor.username` | string | Response data | | `data.entries.req_timestamp` | object | Response data | | `data.entries.comment` | string | Response data | | `data.entries.external_id` | object | Response data | | `data.entries.finish_time` | object | Response data | | `data.entries.indicator` | object | Response data | | `data.entries.disable_cef` | boolean | Response data | | `data.entries.url` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"total":4,"query":{},"sort":{},"offset":0,"limit":1,"entries":[]},"message":"OK","details":[{}],"route":"/hx/api/v3/acqs/triages"}}` ## Get Quarantine by ID Retrieves details of a specific quarantine entry from Trellix HX Endpoint Security using the provided ID. ### Endpoint - **URL:** `/quarantines/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------- | | `path_parameters.id` | number | Required | Unique quarantine ID. | ### Input Example `{"path_parameters":{"id":1}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `details` | array | Output field: details | | `details.file_name` | string | Name of the resource | | `details.file` | string | Output field: details.file | | `route` | string | Output field: route | | `data` | object | Response data | | `data._id` | number | Response data | | `data.agent_quarantine_id` | string | Response data | | `data.hit_correlation_id` | string | Response data | | `data.file_path` | string | Response data | | `data.file_md5` | string | Response data | | `data.file_sha1` | string | Response data | | `data.reported_at` | string | Response data | | `data.quarantined_at` | string | Response data | | `data.alert_file_creation_time` | string | Response data | | `data.alert_infection_name` | string | Response data | | `data.state` | string | Response data | | `data.update_time` | string | Response data | | `data.url` | string | Response data | | `data.host` | object | Response data | | `data.host._id` | string | Response data | | `data.host.url` | string | Response data | | `data.alert` | object | Response data | | `data.alert._id` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"details":[],"route":"/hx/api/v3/quarantines/id","data":{"_id":106,"agent_quarantine_id":"23775c33-b95c-438d-94f5-48209332f35a","hit_correlation_id":"c4689c40-d7b5-4e2e-9ade-7c49e9718330","file_path":"D:\\documents\\Samples\\grrr.exe","file_md5":"0b141adba998fef7e7c99b9d97de3041","file_sha1":"a94fce81574fe524002ea69f61bbe7e10838e925","...` ## Get Search Results Retrieve a list of all enterprise searches conducted within Trellix HX Endpoint Security. ### Endpoint - **URL:** `/searches` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.offset` | number | Optional | Specifies which record to start with in the response. The default is 0. | | `parameters.limit` | number | Optional | Specifies how many records are returned. The default is 50. | | `parameters.sort` | array | Optional | Sorts the results by the specified field in ascending or descending order. The default is sorting by \_id in descending order. Sort fields may be followed by "\:asc" or "\:desc" to indicate ascending or descending order. Multiple sort fields may be specified. | | `parameters.state` | string | Optional | Filter by search state. | | `parameters.host_set._id` | number | Optional | Filter searches by host set ID. | | `parameters.update_actor._id` | number | Optional | Filter searches by user ID that last updated searches. | | `parameters.update_actor.username` | string | Optional | Filter searches by username that last updated searches. | | `parameters.create_actor._id` | number | Optional | Filter searches by user ID that created searches. | | `parameters.create_actor.username` | string | Optional | Filter searches by username that created searches. | | `parameters.settings.mode` | string | Optional | Filter searches based on the search mode, the value can be HOST or GRID. | | `parameters.input_type` | string | Optional | Filter searches based on how the search started , the value can be ui or api. | ### Input Example `{"parameters":{"offset":0,"limit":50,"sort":["_id:desc"],"state":"","host_set._id":1,"update_actor._id":2,"update_actor.username":"","create_actor._id":2,"create_actor.username":"","settings.mode":"","input_type":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.total` | number | Response data | | `data.query` | object | Response data | | `data.sort` | object | Response data | | `data.offset` | number | Response data | | `data.limit` | number | Response data | | `data.entries` | array | Response data | | `data.entries._id` | number | Response data | | `data.entries._url` | string | Response data | | `data.entries.state` | string | Response data | | `data.entries.scripts` | array | Response data | | `data.entries.scripts._id` | number | Response data | | `data.entries.scripts.url` | string | Response data | | `data.entries.scripts.download` | string | Response data | | `data.entries.scripts.platform` | string | Response data | | `data.entries.host_set` | object | Response data | | `data.entries.host_set._id` | number | Response data | | `data.entries.host_set.url` | string | Response data | | `data.entries.host_set.name` | string | Response data | | `data.entries.update_time` | string | Response data | | `data.entries.create_time` | string | Response data | | `data.entries.update_actor` | object | Response data | | `data.entries.update_actor._id` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"total":0,"query":{},"sort":{},"offset":0,"limit":0,"entries":[]},"message":"string","details":[{}],"route":"string"}}` ## Get Triage Acquisition by ID Fetches details of a specific triage acquisition from Trellix HX Endpoint Security using the provided ID. ### Endpoint - **URL:** `/acqs/triages/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ---------------------- | | `path_parameters.id` | string | Required | Unique acquisition ID. | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `details` | array | Output field: details | | `route` | string | Output field: route | | `data` | object | Response data | | `data._id` | number | Response data | | `data._revision` | string | Response data | | `data.error_message` | string | Response data | | `data.state` | string | Response data | | `data.md5` | object | Response data | | `data.request_time` | string | Response data | | `data.request_actor` | object | Response data | | `data.request_actor._id` | number | Response data | | `data.request_actor.username` | string | Response data | | `data.req_timestamp` | object | Response data | | `data.comment` | string | Response data | | `data.external_id` | object | Response data | | `data.finish_time` | string | Response data | | `data.indicator` | object | Response data | | `data.disable_cef` | boolean | Response data | | `data.url` | string | Response data | | `data.host` | object | Response data | | `data.host._id` | string | Response data | | `data.host.url` | string | Response data | | `data.alert` | object | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"details":[{}],"route":"/hx/api/v3/acqs/triages/id","data":{"_id":10,"_revision":"20200716133632656552107126","error_message":"The triage completed with issues.","state":"COMPLETE","md5":null,"request_time":"2020-07-16T13:28:43.887Z","request_actor":{},"req_timestamp":null,"comment":"","external_id":null,"finish_time":"2020-07-16T13:36...` ## Get Triage Collection by ID Retrieves a specific triage collection (MANS file) from Trellix HX Endpoint Security using the provided ID. ### Endpoint - **URL:** `/acqs/triages/{{id}}.mans` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ---------------------- | | `path_parameters.id` | string | Required | Unique acquisition ID. | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{}}` ## New Triage Acquisition Initiates a new triage acquisition for a specified agent in Trellix HX Endpoint Security using the agent\_id. ### Endpoint - **URL:** `/hosts/{{agent_id}}/triages` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.agent_id` | string | Required | Unique agent ID. | | `req_timestamp` | string | Optional | The triage collection for this time. | | `external_id` | string | Optional | External correlation ID from a SIEM solution. | | `disable_cef` | boolean | Optional | When "disable\_cef" is set to false, and when CEF logging is enabled, Endpoint Security will log each triage or bulk acquisition task creation, pickup, and completion. When "disable\_cef" is true, this logging is skipped. | ### Input Example `{"json_body":{"req_timestamp":"2030-10-10T17:40:13.413Z","external_id":"some.id","disable_cef":true}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `details` | array | Output field: details | | `route` | string | Output field: route | | `data` | object | Response data | | `data._id` | number | Response data | | `data._revision` | string | Response data | | `data.error_message` | string | Response data | | `data.state` | string | Response data | | `data.md5` | object | Response data | | `data.request_time` | string | Response data | | `data.request_actor` | object | Response data | | `data.request_actor._id` | number | Response data | | `data.request_actor.username` | string | Response data | | `data.req_timestamp` | object | Response data | | `data.comment` | string | Response data | | `data.external_id` | object | Response data | | `data.finish_time` | string | Response data | | `data.indicator` | object | Response data | | `data.disable_cef` | boolean | Response data | | `data.url` | string | Response data | | `data.host` | object | Response data | | `data.host._id` | string | Response data | | `data.host.url` | string | Response data | | `data.alert` | object | Response data | ### Output Example `{"status_code":201,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 10 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"details":[{}],"route":"/hx/api/v3/acqs/triages/id","data":{"_id":10,"_revision":"20200716133632656552107126","error_message":"The triage completed with issues.","state":"COMPLETE","md5":null,"request_time":"2020-07-16T13:28:43.887Z","request_actor":{},"req_timestamp":null,"comment":"","external_id":null,"finish_time":"2020-07-16T13:36...` # Response Headers | **Header** | **Description** | **Example** | | -------------- | ----------------------------------------------------- | ----------------------------- | | content-length | The length of the response body in bytes | 140 | | content-type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Mon, 10 Jun 2024 20:37:23 GMT |