You can pair your Endpoint Security (HX) server to your NDR Console appliance through KLISH or the API. The NDR Console appliance uses metadata from the server to enrich the incoming data with hostname and identify the username using an internal IP address.
The following integration endpoints are available:
Configure Endpoint Security integration: Request
POST https://<IA_IP_address>:<port_number>/config/v1/deviceEndpoint Security integration configuration: Request
GET https://<IA_IP_address>:<port_number>/config/v1/deviceEndpoint Security integration configuration for a device: Request
GET https://<IA_IP_address>:<port_number>/config/v1/device/<device_IP>Update Endpoint Security configuration: Request
PUT https://<IA_IP_address>:<port_number>/config/v1/deviceDelete Endpoint Security configuration: Request
DELETE https://<IA_IP_address>:<port_number>/config/v1/device/<device_IP>PUT https://<IA_IP_address>:<port_number>/config/v1/device/<device_IP>/hostpoll/interval/<poll_interval>Set alert poll interval: Request
PUT https://<IA_IP_address>:<port_number>/config/v1/device/<device_IP>/alertpoll/interval/<poll_interval>Enable SSL verification: Request
PUT https://<IA_IP_address>:<port_number>/config/v1/device/<device_IP>/sslverify/enabled/{true|false}PUT https://<IA_IP_address>:<port_number>/config/v1/device/<device_IP>/hostpoll/enabled/{true|false}PUT https://<IA_IP_address>:<port_number>/config/v1/device/<device_IP>/alertpoll/enabled/{true|false}