Trellix EDR Detections
Overview
Details
The Trellix EDR Detections app provides the ability to pull latest threat detections from the Trellix EDR Monitoring Dashboard on a scheduled basis. This data includes details about the threat, MITRE techniques and system detections. This App will help fetching Traces from Trellix EDR backend into Splunk.
Installation
- Open the Splunk Console and go to “Manage App” tab. Click on Install App from File tab.
- Upload .spl file.
- Under Apps you will now see Trellix EDR Detections App.
- Go to the Configuration tab and add your Proxy connfiguration if required.
- Go to the “Logging” tab. Our default and recommend Logging level is “info” . If there are any issues you are facing where Trellix engineering needs further debugging, then only the logging needs to be changed to “Debug” and issue should be reproduced.
- Go to the "Inputs" tab and add a new Input.
A ClientID and ClientSecret will be required during the Input configuration. To generate the credentials follow the steps mentioned in our Github Repository (https://github.com/mohlcyber/McAfee-MVISION-EDR-Integrations/blob/master/README.md)
a. Name: Any name as per your requirement [Input Name must start with a letter and followed by alphabetic letters, digits or underscores.]
b. Interval: This value will define after how much interval you want to run the script to pull the new threats. Mention details in Seconds.
c. Index: Select your index
d. Trellix EDR Tenant Region: Depending on which region your Tenant belongs to, please select the region
e. Trellix EDR Client ID and Trellix EDR Client Secret : You should have it already by following previous steps mentioned.
f. Initial Pull in Days : This will define, for the first time run, how many days data you want to pull. The max limit is “30” days and minimum is “3” days.
g. After the configuration the task will run immediately and you now will be able to see the threats under “Trellix EDR Detection” tab.
Troubleshooting
Logs are located at the below path:
<SPLUNK_HOME>\var\log\splunk\ta_trellix_edr_detections_trellix_edr_input.log
Change the Log level under the "Configuration" tab to Debug for enhanced logging.