The Trellix EDR Detections app provides the ability to pull latest threat detections from the Trellix EDR Monitoring Dashboard on a scheduled basis. This data includes details about the threat, MITRE techniques and system detections. This App will help fetching Traces from Trellix EDR backend into Splunk.
a. Name: Any name as per your requirement [Input Name must start with a letter and followed by alphabetic letters, digits or underscores.]
b. Interval: This value will define after how much interval you want to run the script to pull the new threats. Mention details in Seconds.
c. Index: Select your index
d. Trellix EDR Tenant Region: Depending on which region your Tenant belongs to, please select the region
e. Trellix EDR Client ID and Trellix EDR Client Secret : You should have it already by following previous steps mentioned.
f. Initial Pull in Days : This will define, for the first time run, how many days data you want to pull. The max limit is “30” days and minimum is “3” days.
g. After the configuration the task will run immediately and you now will be able to see the threats under “Trellix EDR Detection” tab.
Logs are located at the below path:
Change the Log level under the "Configuration" tab to Debug for enhanced logging.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.