Data collection
Trellix ePO SaaS
Trellix ePolicy Orchestrator (ePO SaaS) threat detection events polled from the ePO v2 events API, authenticated through the Trellix IAM client_secret_basic token exchange.
- Logs
- Collector-based
- Package 1.0.1
What it collects
- Signals
- Logs
- How it collects
- HTTP API polling (
http_poll) - Where it runs
- On a Tracix Collector you install. Agentless collection is not offered for it.
- Package version
- 1.0.1
Included in the package
- Trellix ePO overview dashboard, 7 panels
- A log-parsing pipeline that maps fields to OpenTelemetry semantic conventions first
How to connect it
- 01Open the connect wizardIn the Tracix console, open Integrations and pick Trellix ePO SaaS.
- 02Install the Tracix CollectorInstall it where it can reach the data, then add the integration to that collector's policy.
- 03Fill in the connectionEnter the settings the wizard asks for. Collectors pick up the policy change on their own.
More in security
All packages in security
Okta
Security
Okta System Log events (authentication, authorization, and admin activity) polled from the System Log API.
Logs
Palo Alto Networks PAN-OS
Security
Traffic, threat, and system logs from Palo Alto Networks firewalls over syslog, parsed into searchable fields.
Logs
Cisco ASA
Security
Firewall connection, ACL, and VPN session logs from Cisco ASA over syslog, parsed into searchable fields.
Logs
Fortinet FortiGate
Security
Firewall traffic, UTM, and event logs from FortiGate over syslog, parsed into searchable fields.
Logs
CrowdStrike Falcon
Security
Falcon alerts (endpoint, identity and cloud detections) polled from the CrowdStrike Alerts API with an API client (OAuth2 client credentials), plus…
Logs
1Password Events
Security
1Password Business sign-in attempts, item usage, and audit events from the Events Reporting API.
Logs
Connect Trellix ePO SaaS to Tracix
Start free and connect it from the console, or book a demo and we will walk through your environment with you.