Create Activity Feed Configuration - BlinkOps Documentation

Create an activity feed configuration that streams the EDR events of a topic to an external destination. Note: A topic can only be registered with one destination.

External DocumentationTo learn more, visit the Trellix EDR documentation.

Parameters

Parameter	Description
AWS Region	The AWS region of the S3 bucket.
Certificate Data	The base64-encoded contents of the `server-cert.pem` certificate generated during the Syslog setup. Note: Provide the entire certificate details, including `--BEGIN--` and `--END--`, for both single and multi-chain certificates.
Client Email ID	The client email address to associate with the activity feed configuration.
Configuration Type	The type of the destination to stream the events to.
Custom Headers	A JSON object of the custom headers to send with the webhook requests. For example: `{ “key”: “value” }`
Enable Compressed Output	Select to compress the streamed output.
Role ARN	The ARN of the cross-account IAM role that grants access to the S3 bucket.
S3 Bucket Name	The name of the S3 bucket to stream the events to.
S3 Prefix	The prefix path to write the events under. When omitted, the events folder is created in the root folder of the bucket.
Syslog Server IP	The IP address of the Syslog server to stream the events to.
Syslog Server Port	The port of the Syslog server.
Syslog Test Message	A test message for the Syslog destination.
Topic	The type of the events to stream.
Type	The type of the resource in the request body.
Webhook Test Message	A test message for the webhook destination.
Webhook URL	The URL of the webhook to stream the events to. Must present a CA-signed certificate, self-signed certificates are blocked.

Example Output

{
	"jsonapi": {
		"version": "1.0"
	},
	"meta": {
		"totalResourceCount": 1
	},
	"data": {
		"id": "ce5cdfff-7818-455a-bc60-841be3513f4a",
		"type": "activityFeed",
		"attributes": {
			"topic": "threatEvents",
			"clientEmailId": "example@gmail.com",
			"configType": "s3Config",
			"enableCompressedOutput": "true",
			"s3Config": {
				"s3Prefix": "/prefix",
				"roleARN": "arn:aws:iam::91574147XXX:role/EAF_S3CrossAccountAccess",
				"s3BucketName": "example-bucket",
				"awsRegion": "us-west-2"
			}
		}
	}
}

Workflow Library Example

Create Activity Feed Configuration with Trellix Edr and Send Results Via Email

Preview this Workflow on desktop