External DocumentationTo learn more, visit the Trellix EDR documentation.
Parameters
| Parameter | Description |
|---|---|
| Reaction ID | The ID of the reaction. Can be obtained using the List Reactions action. |
Example Output
{
"data": {
"id": "388",
"type": "customReactions",
"attributes": {
"catalogVersion": 0,
"metadata": {},
"hidden": false,
"dbVersion": 0,
"description": "test Desc",
"timeout": 60,
"internalArguments": {},
"internalName": "_Test_Reaction",
"remediation": false,
"task": "REACTION",
"contents": [
{
"id": "10352",
"platform": {
"catalogVersion": 1100,
"dbVersion": 0,
"id": "1",
"name": "windows",
"topic": "/mcafee/mar/agent/query/windows",
"enabled": true
},
"capability": {
"catalogVersion": 1100,
"dbVersion": 0,
"id": "27",
"name": "Execute PowerShell Script",
"description": "Runs Windows PowerShell Scripts",
"module": "SystemRuntime",
"function": "executePS",
"contentEnabled": true,
"outputs": [],
"formatArgs": {
"hasHeaders": false,
"delimiter": ","
},
"format": "CSV",
"platforms": [
{
"catalogVersion": 1100,
"dbVersion": 0,
"id": "1",
"name": "windows",
"topic": "/mcafee/mar/agent/query/windows",
"enabled": true
}
],
"platformSettings": [
{
"id": "5142",
"platform": {
"catalogVersion": 1100,
"dbVersion": 0,
"id": "1",
"name": "windows",
"topic": "/mcafee/mar/agent/query/windows",
"enabled": true
},
"utf8Sensitive": false
}
],
"itemType": "CUSTOM",
"catalogItems": [
"COLLECTOR",
"REACTION"
]
},
"content": "test\r\n",
"arguments": [],
"utf8Sensitive": false
}
],
"availableForTrigger": true,
"name": "_Test_Reaction",
"arguments": [
{
"id": "2369",
"name": "test",
"type": "STRING",
"collectorMappings": [],
"optional": false
}
],
"availableOffline": false,
"chainedReactions": []
}
},
"jsonapi": {
"version": "1.0"
}
}
Workflow Library Example
Get Reaction with Trellix Edr and Send Results Via Email