Trellix XDR Integration

Create API Credentials

Create API credentials in Trellix with event ingestion permissions.

                # Create API Credentials in Trellix:
# 1. Log in to Trellix ePO Console
# 2. Navigate to Configuration → API Credentials
# 3. Click "Create New Credentials"
# 4. Configure the following:
#    - Name: DBaudit Integration
#    - Type: API Key with OAuth
#    - Permissions: Event Ingestion, Threat Intelligence
# 5. Copy the API Key and Client ID

# Trellix API endpoints by region:
# - US: https://api.manage.trellix.com
# - EU: https://api.manage.trellix.eu
# - APAC: https://api.manage.trellix.com.au

# Required permissions:
# - siem.events.write - Event ingestion
# - threats.read - Threat intelligence lookup
# - investigations.write - Create investigations
              

Test API Connection

Verify the credentials can authenticate and send events.

                # Test Trellix API connection
# First, get OAuth token
curl -X POST "https://api.manage.trellix.com/oauth/token" \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d "grant_type=client_credentials" \
    -d "client_id=YOUR_CLIENT_ID" \
    -d "client_secret=YOUR_API_KEY" \
    -d "scope=siem.events.write"

# Use token to test event ingestion
curl -X POST "https://api.manage.trellix.com/v1/events" \
    -H "Authorization: Bearer ACCESS_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{
      "events": [{
        "dataSource": "DBaudit",
        "eventType": "test",
        "timestamp": "2024-01-15T10:30:45Z",
        "event": {"message": "Test event from DB Audit"}
      }]
    }'

# Expected response:
{
  "status": "success",
  "eventsReceived": 1
}
              

Configure in DB Audit

Add the Trellix XDR integration in the DB Audit dashboard.

1. Navigate to Integrations → SIEM in DB Audit
2. Click Add SIEM Integration
3. Select Trellix XDR as the provider
4. Enter your API URL, API key, and client ID
5. Enter your tenant ID
6. Select event types to forward
7. Test the connection and save

Create Detection Rules (Optional)

Create detection rules to alert on suspicious database activity.

                // Trellix XDR Detection Rule
// Detection → Rules → Create Rule

Rule Name: Suspicious Database Data Exfiltration
Description: Detects queries returning large amounts of sensitive data

// Query
dataSource = "DBaudit"
AND event.action.type = "SELECT"
AND event.action.rowsAffected > 10000
AND event.classification.containsPii = true

// Rule Configuration
Severity: High
Priority: 2

// MITRE ATT&CK Mapping
Tactic: Collection (TA0009)
Technique: Data from Information Repositories (T1213)

// Alert Actions
- Create Investigation
- Notify SOC Team
- Enrich with Threat Intelligence
- Correlate with EDR events

// Investigation Playbook
1. Identify source workstation from IP
2. Check for file downloads on endpoint
3. Review network connections
4. Assess data sensitivity