You can integrate your Trellix environment with Trellix EDR (Endpoint Detection and Response) by creating a new configuration that uses the Client Credentials flow for OAuth authentication.
Assign a Name for the configuration.
In the HTTP tab, set the Authentication settings:
URL: Enter the API endpoint: https://api.manage.trellix.com.
Grant Type: Select Client Credentials.
Client ID: Enter the Client ID.
Client Secret: Enter the Client Secret.
Token URL: Enter the identity management endpoint: https://iam.mcafee-cloud.com/iam/v1.1/token.
(Optional) Audience: Enter the target audience (e.g., Trellix).
Scopes: Enter the required scopes, separated by a comma (no spaces): epo.evt.r,epo.device.r,mi.user.investigate,soc.rts.c,soc.rts.r,soc.hts.r.
Auth Style: Select In Header.
Click Next.
In the Edge tab, select the required Edge (e.g., trellix-default).
To find available Edges, click the Auto Detect button.
Click Save.
You can add another configuration for the app by repeating these steps.