Trellix Endpoint Security

Receive logs in CEF format and support detection rules

• Malware Hit Found
• IOC Hit Found
• FireEye Acquisition Started
• FireEye Acquisition Queued
• FireEye Acquisition Completed
• FireEye Quarantine Request
• FireEye Quarantine Failed
• FireEye Quarantine Completed
• FireEye Security Content Updated
• Tamper Protection TP hit found

Verified on Trellix Endpoint Security 5.3.1

First release

• JSON Normal log parser
• Logger model
• Process, File, HTTP event dashboards