> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Activity Feed Configuration

Create an activity feed configuration that streams the EDR events of a topic to an external destination.

**Note:** A topic can only be registered with one destination.

<Note>
  External Documentation

  To learn more, visit the [Trellix EDR documentation](https://docs.trellix.com/bundle/mvision-endpoint-detection-and-response-product-guide/page/UUID-067dfc82-46b8-e2b5-5a37-ed9e86c032d3.html).
</Note>

## Parameters

<div className="integrations-table">
  | Parameter                | Description                                                                                                                                                                                                                                         |
  | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | AWS Region               | The AWS region of the S3 bucket.                                                                                                                                                                                                                    |
  | Certificate Data         | The base64-encoded contents of the `server-cert.pem` certificate generated during the Syslog setup.<br /><br />**Note:** Provide the entire certificate details, including `--BEGIN--` and `--END--`, for both single and multi-chain certificates. |
  | Client Email ID          | The client email address to associate with the activity feed configuration.                                                                                                                                                                         |
  | Configuration Type       | The type of the destination to stream the events to.                                                                                                                                                                                                |
  | Custom Headers           | A JSON object of the custom headers to send with the webhook requests.<br /><br />**For example:**<br /><pre><code>\{<br />  "key": "value"<br />}</code></pre>                                                                                     |
  | Enable Compressed Output | Select to compress the streamed output.                                                                                                                                                                                                             |
  | Role ARN                 | The ARN of the cross-account IAM role that grants access to the S3 bucket.                                                                                                                                                                          |
  | S3 Bucket Name           | The name of the S3 bucket to stream the events to.                                                                                                                                                                                                  |
  | S3 Prefix                | The prefix path to write the events under. When omitted, the events folder is created in the root folder of the bucket.                                                                                                                             |
  | Syslog Server IP         | The IP address of the Syslog server to stream the events to.                                                                                                                                                                                        |
  | Syslog Server Port       | The port of the Syslog server.                                                                                                                                                                                                                      |
  | Syslog Test Message      | A test message for the Syslog destination.                                                                                                                                                                                                          |
  | Topic                    | The type of the events to stream.                                                                                                                                                                                                                   |
  | Type                     | The type of the resource in the request body.                                                                                                                                                                                                       |
  | Webhook Test Message     | A test message for the webhook destination.                                                                                                                                                                                                         |
  | Webhook URL              | The URL of the webhook to stream the events to. Must present a CA-signed certificate, self-signed certificates are blocked.                                                                                                                         |
</div>

## Example Output

```json theme={"dark"}
{
	"jsonapi": {
		"version": "1.0"
	},
	"meta": {
		"totalResourceCount": 1
	},
	"data": {
		"id": "ce5cdfff-7818-455a-bc60-841be3513f4a",
		"type": "activityFeed",
		"attributes": {
			"topic": "threatEvents",
			"clientEmailId": "example@gmail.com",
			"configType": "s3Config",
			"enableCompressedOutput": "true",
			"s3Config": {
				"s3Prefix": "/prefix",
				"roleARN": "arn:aws:iam::91574147XXX:role/EAF_S3CrossAccountAccess",
				"s3BucketName": "example-bucket",
				"awsRegion": "us-west-2"
			}
		}
	}
}
```

## Workflow Library Example

[Create Activity Feed Configuration with Trellix Edr and Send Results Via Email](https://library.blinkops.com/workflows/create-activity-feed-configuration-with-trellix-edr-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/create-activity-feed-configuration-with-trellix-edr-and-send-results-via-email/canvas" />
</div>