To create an investigation, make sure you use the appropriate URL parameters.
Parameter name | Optional / Mandatory | Description | Example |
|---|---|---|---|
eventSrc | Optional | Provides the SOC analyst with a visual indicator that distinguishes between ESM-initiated and ePO-initiated investigations. The value of this parameter appears in the Trellix EDR Investigating dashboard under the By column. |
|
caseType | Mandatory | Defines the type of alert. Recognized values are malware and network and any other value is treated as others. |
|
caseName | Optional | Gives the investigation a meaningful name. If the name is missing, a default case name is assigned. The value of this parameter appears in the Trellix EDR Investigating dashboard under the Investigation column. |
|
caseHint | Optional (highly recommended) | Automatically links related investigations to avoid creating multiple cases from alerts related to the same incident. Although this parameter is optional, it is highly recommended. |
|
caseSummary | Optional | Used for the description of an investigation. |
|
casePriority | Optional | Assigns a priority to an investigation. |
|
caseOwner | Optional | Assigns an investigation to a specific user. |
|
evidenceType | Mandatory | Identifies the type of the evidence attributes being provided to Trellix EDR. |
|
<attribute name> | Mandatory / Optional | Depending on the evidenceType, and its corresponding schema, different attributes might need a value. |
|
evidenceType | Attributes | Description |
|---|---|---|
Device |
| To investigate an endpoint based on its host name. If an endpoint with Microsoft Windows is managed by ePO - On-prem or ePO - SaaS, Trellix EDR takes a snapshot of the endpoint using the Endpoint Snapshot tool. |
Identifier |
| To investigate an endpoint based on its Trellix Agent GUID. If an endpoint with Microsoft Windows is managed by ePO - On-premor ePO - SaaS, Trellix EDR takes a snapshot of the endpoint using the Endpoint Snapshot tool. |
IP |
| To investigate an external IP address. |
FQDN |
| To investigate a fully qualified domain name. |
URL examples for US-West data center
If your tenant is hosted in the Western United States data center, use the following examples:
To investigate an IP address:
https://api.soc.trellix.com/wh/v1/webhook/<webhook_id>/AddEvidence?evidenceType=IP&caseName=IPInvestigation&eventSrc=McAfeeESM&caseType=malware&address=42.231.162.212&name=42.231.162.212&rawData=To Investigate a device managed by ePO - On-prem or ePO - SaaS:
https://api.soc.trellix.com/wh/v1/webhook/<webhook_id>/AddEvidence?evidenceType=Device&caseName=3BYW10RS3X86&eventSrc=ESM&caseType=malware&hostName=3BYW10RS3X86&name=3BYW10RS3X86&__clue=&rawData=&name=3BYW10RS3X86
URL examples for US-East data center
If your tenant is hosted in the Eastern United States data center, use the following examples:
To investigate an IP address:
https://api.soc.us-east-1.trellix.com/wh/v1/webhook/<webhook_id>/AddEvidence?evidenceType=IP&caseName=IPInvestigation&eventSrc=McAfeeESM&caseType=malware&address=42.231.162.212&name=42.231.162.212&rawData=To Investigate a device managed by ePO - On-prem or ePO - SaaS:
https://api.soc.us-east-1.trellix.com/wh/v1/webhook/<webhook_id>/AddEvidence?evidenceType=Device&caseName=3BYW10RS3X86&eventSrc=ESM&caseType=malware&hostName=3BYW10RS3X86&name=3BYW10RS3X86&__clue=&rawData=&name=3BYW10RS3X86
URL examples for Frankfurt data center
If your tenant is hosted in a Frankfurt data center, use the following examples:
To investigate an IP address:
https://api.soc.eu-central-1.trellix.com/wh/v1/webhook/<webhook_id>/AddEvidence?evidenceType=IP&caseName=IPInvestigation&eventSrc=McAfeeESM&caseType=malware&address=42.231.162.212&name=42.231.162.212&rawData=To Investigate a device managed by ePO - On-prem or ePO - SaaS:
https://api.soc.eu-central-1.trellix.com/wh/v1/webhook/<webhook_id>/AddEvidence?evidenceType=Device&caseName=3BYW10RS3X86&eventSrc=ESM&caseType=malware&hostName=3BYW10RS3X86&name=3BYW10RS3X86&__clue=&rawData= &name=3BYW10RS3X86
URL examples for Canada data center
If your tenant is hosted in a Canada data center, use the following examples:
To investigate an IP address:
https://api.soc.ca-central-1.trellix.com/wh/v1/webhook/<webhook_id>/AddEvidence?evidenceType=IP&caseName=IPInvestigation&eventSrc=McAfeeESM&caseType=malware&address=42.231.162.212&name=42.231.162.212&rawData=To Investigate a device managed by ePO - On-prem or ePO - SaaS:
https://api.soc.ca-central-1.trellix.com/wh/v1/webhook/<webhook_id>/AddEvidence?evidenceType=Device&caseName=3BYW10RS3X86&eventSrc=ESM&caseType=malware&hostName=3BYW10RS3X86&name=3BYW10RS3X86&__clue=&rawData= &name=3BYW10RS3X86
URL examples for Asia Pacific South data center
If your tenant is hosted in a Asia Pacific South data center, use the following examples:
To investigate an IP address:
https://api.soc.ap-south-1.trellix.com/wh/v1/webhook/<webhook_id>/AddEvidence?evidenceType=IP&caseName=IPInvestigation&eventSrc=McAfeeESM&caseType=malware&address=42.231.162.212&name=42.231.162.212&rawData=To Investigate a device managed by ePO - On-prem or ePO - SaaS:
https://api.soc.ap-south-1.trellix.com/wh/v1/webhook/<webhook_id>/AddEvidence?evidenceType=Device&caseName=3BYW10RS3X86&eventSrc=ESM&caseType=malware&hostName=3BYW10RS3X86&name=3BYW10RS3X86&__clue=&rawData= &name=3BYW10RS3X86