External DocumentationTo learn more, visit the Trellix EDR documentation.
Parameters
| Parameter | Description |
|---|---|
| Arguments | A JSON array of the arguments the reaction accepts. For example: |
| Contents | A JSON array of the content to run per platform and capability. For example: |
| Description | The description of the reaction. |
| Name | The name of the reaction. Custom reactions are prefixed with an underscore. |
| Timeout | The maximum number of seconds to let the reaction run for. |
| Type | The type of the resource in the request body. |
Example Output
{
"data": {
"id": "587",
"type": "customReactions",
"attributes": {
"catalogVersion": 0,
"metadata": {},
"hidden": false,
"dbVersion": 0,
"description": "Creating a new reaction",
"timeout": 60,
"internalArguments": {},
"internalName": "_Check_New_reaction",
"remediation": false,
"task": "REACTION",
"contents": [
{
"id": "11976",
"platform": {
"catalogVersion": 1307,
"dbVersion": 0,
"id": "1",
"name": "windows",
"topic": "/mcafee/mar/agent/query/windows",
"enabled": true
},
"capability": {
"catalogVersion": 1307,
"dbVersion": 0,
"id": "27",
"name": "Execute PowerShell Script",
"description": "Runs Windows PowerShell Scripts",
"module": "SystemRuntime",
"function": "executePS",
"contentEnabled": true,
"outputs": [],
"formatArgs": {
"hasHeaders": false,
"delimiter": ","
},
"format": "CSV",
"platforms": [
{
"catalogVersion": 1307,
"dbVersion": 0,
"id": "1",
"name": "windows",
"topic": "/mcafee/mar/agent/query/windows",
"enabled": true
}
],
"platformSettings": [
{
"id": "5346",
"platform": {
"catalogVersion": 1307,
"dbVersion": 0,
"id": "1",
"name": "windows",
"topic": "/mcafee/mar/agent/query/windows",
"enabled": true
},
"utf8Sensitive": false
}
],
"itemType": "CUSTOM",
"catalogItems": [
"REACTION",
"COLLECTOR"
]
},
"content": "ls\r\n",
"arguments": [],
"utf8Sensitive": false
}
],
"availableForTrigger": true,
"name": "_Check_New_reaction",
"arguments": [
{
"id": "2946",
"name": "abc",
"type": "NUMBER",
"optional": false
}
],
"availableOffline": false
}
},
"links": {
"self": "/edr/v2/reactions/587"
}
}
Workflow Library Example
Create Reaction with Trellix Edr and Send Results Via Email