Remediate Threat - BlinkOps Documentation

Run a remediation action against a threat on the endpoints it affected. Creates an asynchronous job, and returns its ID.

External DocumentationTo learn more, visit the Trellix EDR documentation.

Basic Parameters

Parameter	Description
Action	The remediation action to run against the threat. For example: `StopAndRemove`.
Affected Host IDs	A comma-separated list of the IDs of the affected hosts to run the action on.
Process Name	The name of the process to run the action on.
Threat ID	The ID of the threat to remediate. Can be obtained using the `List Threats` action.
Type	The type of the resource in the request body.

Advanced Parameters

Parameter	Description
MVEDR Source	The region or source of the event data. For Example: `xdrsoar:us-west`.
Trace ID	A tracking header, in the format: `workflow-id:task/step-id`.

Example Output

{
	"data": {
		"type": "threatRemediation",
		"id": "tr-5432",
		"attributes": {
			"success": [
				{
					"status": "200",
					"message": "in-progress",
					"affectedHostIds": [
						"99848"
					]
				}
			],
			"failed": [
				{
					"status": "404",
					"message": "Not Found",
					"affectedHostIds": [
						"99849"
					]
				}
			]
		},
		"links": {
			"self": "/edr/v2/remediation/queue-jobs/tr-5432"
		}
	}
}

Workflow Library Example

Remediate Threat with Trellix Edr and Send Results Via Email

Preview this Workflow on desktop