Trellix Helix

Overview

This integration allows AiStrike to:◼︎

• Ingest alerts from Trellix Helix into AiStrike.

• Perform remediation actions such as adding entities to blocklists.

Prerequisites

• Access to the Trellix Helix console.

• Admin rights to generate and manage API keys.

• AiStrike tenant configured to accept external alert ingestion.

Product Permissions

The integration requires an API token with the following permissions:

Please grant Read-only permission for all services (tap.*.list, tap.*.browse) & full permissions on Cases and Rules:

• Alerts

• Events

• Search

• List

• Cases

• Rules

• Users

• Roles

• Assets

• Appliance

• Archive

A few examples of permissions are below [Ensure you add Read-only permission and Full permission as requested above]:

tap.alert.suppressions.add
tap.alert.suppressions.browse
tap.alert.suppressions.edit
tap.alert.suppressions.read
tap.alerts.browse
tap.alerts.edit
tap.alerts.read
tap.appliances.browse
tap.appliances.read
tap.archivesearch.add
tap.archivesearch.browse
tap.assets.browse
tap.assets.read
tap.lists.add
tap.lists.browse
tap.lists.edit
tap.lists.read
tap.search.browse
tap.search.regex

How to Generate an API Token

1. Log in to the Trellix Helix Console.

2. Navigate to: Identity & Access Management → API Keys → Create API Key.

3. Provide the following:

   • API Key Name (example: AIStrikeIntegration)

   • Expiration Date

   • Products → Select required products.

4. Press Next.

5. Assign the required permissions listed above.

6. Click Create and copy the API Token.

Example API Request

Use the API token in the x-fireeye-api-key header for all requests:

GET /helix/id/hexqsj477/api/v3/appliances/health HTTP/1.1
Host: helix.eu.fireeye.com
x-fireeye-api-key: xxxxxxxxxxxxxxxxxxxxx

Determining the Helix instance ID:

To determine your Helix instance ID:

1. Select the Organization Settings tab on the IAM page.

2. The instance ID is displayed in the upper left corner of the screen. The ID uniquely identifies your Helix instance.

Verification

Run a simple health check API call to verify integration:

GET /helix/id/hexqsj477/api/v3/appliances/health HTTP/1.1
Host: helix.eu.fireeye.com
x-fireeye-api-key: <YOUR_API_KEY>

Expected Response:

{
  "status": "ok",
  "appliances": [
    {
      "id": "appliance-123",
      "status": "healthy"
    }
  ]
}

Share the following details with AiStrike for configuration: