Trellix Helix

https://docs.trellix.com/bundle/helix_pg/page/
Admin
Trellix Helix is an enterprise security solution platform that provides comprehensive threat...
Tokens:667,005
Snippets:14,156
Trust Score:9.9
Update:9 months ago
Show doc for...
Tokens:
Raw
### Example Asset-Based Search Query in Helix

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-6f6cb9c6-d3d9-6d48-88a5-3d5ebc9857d2

This example demonstrates a basic asset-based search query in the Helix Web UI. It uses the `assets.event_fields:username` field to find events related to usernames and then groups the results by `hostname`. This query requires no external dependencies and returns event data correlated by hostname.

```tql
assets.event_fields:username | groupby hostname
```

--------------------------------

### Helix API Usage Example

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-d7062a98-a224-8adf-fb83-cacf801264ad

This snippet demonstrates how to interact with the Helix API to retrieve data. It assumes you have API credentials and the necessary libraries installed. The example shows a basic GET request.

```python
import requests

API_URL = "https://helix.example.com/api/v1"
API_KEY = "YOUR_API_KEY"

def get_alerts():
    headers = {
        "Authorization": f"Bearer {API_KEY}",
        "Content-Type": "application/json"
    }
    try:
        response = requests.get(f"{API_URL}/alerts", headers=headers)
        response.raise_for_status()  # Raise an exception for bad status codes
        return response.json()
    except requests.exceptions.RequestException as e:
        print(f"Error fetching alerts: {e}")
        return None

if __name__ == "__main__":
    alerts = get_alerts()
    if alerts:
        print("Successfully retrieved alerts:")
        # Process the alerts data here
        for alert in alerts['data']:
            print(f"- Alert ID: {alert['id']}, Title: {alert['title']}")

```

--------------------------------

### Visibility Settings and Data Policies Interaction Examples (Trellix Product Guide)

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-02264c6b-e77d-1502-d2c1-dc13daf3a403

Illustrations of how visibility settings and data policies work together to control user access to data. These examples highlight scenarios involving archive searches, sensor restrictions, report visibility, and custom dashboards.

```text
An archive search with public visibility uses **class= Trellix_nx_alert** and **class= Trellix_ex_alert** in its search criteria. A user who is restricted from seeing Network Security alert data can see the search on the Archive Searches page and see both Network Security and Email Security — Server Edition data from the **View Results** menu item, which returns the cached data from the owner's initial execution. If the restricted user reruns the search, the new search results will exclude the Network Security data, according to that user's data policy.
```

```text
An archive search with public visibility uses **class= Trellix_hx_alert** in its search criteria. A user who is restricted from seeing Endpoint Security alerts can see the search on the Archive Searches page and see Endpoint Security data from the **View Results** menu item for that search, which returns the cached data from the owner's initial execution. If the restricted user reruns the search, a "not found" message is displayed, according to that user's data policy.
```

```text
A user is restricted from a certain sensor, based on a policy rule defined with constraint **meta_cbid!=[xxx]**. That user's view of the Sensors page will exclude that sensor.
```

```text
A report has private visibility. Only the report owner and organization admin will see the report on the Reports page.
```

```text
A user-created custom dashboard with public visibility uses **class= Trellix_etp** in the query for one of the widgets. A user who is restricted from seeing Email Security - Cloud data can see the widget in the custom report the owner created. If the restricted user clones the dashboard, the new dashboard will exclude that widget, according to that user's data policy.
```

--------------------------------

### Using the Helix API - Python Example

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-53b281d1-a363-fa11-b954-73ef528c8c4b

This snippet demonstrates how to interact with the Helix API using Python. It covers authentication and making a basic request to retrieve data. Ensure you have the 'requests' library installed and your API credentials configured.

```python
import requests

# Replace with your Helix API endpoint and credentials
HX_API_URL = "https://helix.trellix.com/api/v1"
HX_API_KEY = "YOUR_API_KEY"

def get_alerts():
    headers = {
        "Authorization": f"ApiKey {HX_API_KEY}",
        "Content-Type": "application/json"
    }
    try:
        response = requests.get(f"{HX_API_URL}/alerts", headers=headers)
        response.raise_for_status()  # Raise an exception for bad status codes
        return response.json()
    except requests.exceptions.RequestException as e:
        print(f"Error fetching alerts: {e}")
        return None

if __name__ == "__main__":
    alerts = get_alerts()
    if alerts:
        print(f"Successfully retrieved {len(alerts['data'])} alerts.")
        # Process the alerts data as needed
        for alert in alerts['data'][:5]: # Print first 5 alerts
            print(f" - Alert ID: {alert['id']}, Title: {alert['title']}")

```

--------------------------------

### Example Data Policy Rule Syntax

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-29d0aaea-987b-7c8b-de29-c17aa9db8551

This example demonstrates the syntax for a data policy rule with multiple constraints using 'not equal to' operators and an OR grouping. It specifies exclusions for 'class' and 'meta_cbid' filters.

```text
class!=["Trellix_ex_metadata","Trellix_ex_alert","Trellix_nx_alert"]
```

--------------------------------

### Search Query Example (Index Search)

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-147dfd36-252f-d2f7-ec39-80d326144af1

This code snippet shows an example of how to construct and execute an index search query within the Trellix Helix platform. It includes selecting a date range and a specific sensor.

```json
{
  "query": "process_name: \"powershell.exe\"",
  "timeRange": {
    "startDate": "2023-10-26T00:00:00Z",
    "endDate": "2023-10-27T00:00:00Z"
  },
  "sensorId": "sensor-12345"
}
```

--------------------------------

### Data Policy Rule Examples (Trellix Product Guide)

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-02264c6b-e77d-1502-d2c1-dc13daf3a403

Examples of data policy rules, including their syntax and a brief description of their effect on user data access. These rules use operators like 'DOES NOT EQUAL', 'EQUALS', 'AND', and 'OR' to define access constraints.

```text
`class!=Trellix_nx_alert`
Users with this data policy will be unable to see Network Security alert data.
```

```text
`product!=[hx]`
Users with this data policy will be unable to see Endpoint Security (HX) appliances on the Appliances, Appliance Groups, and Appliance Settings pages.
```

```text
`class!=appliance_health AND class!=Trellix_ex_alert AND meta_cbid=12345`
Users with this data policy will be unable to see health data and Email Security — Server alert data for Comm Broker 12345.
```

```text
`class=Trellix_nx_alert OR class=Trellix_ex_alert`
Users with this data policy will only be able to see Network Security alert data and Email Security — Server alert data.
```

```text
`class!=ms_windows_event`
Users with this data policy will be unable to see Windows event logs.
```

```text
`class=Trellix_hx AND deviceid=0123456789`
Users with this data policy will only be able to see Endpoint Security (HX) data from the device with the specified ID.
```

```text
`class=[appliance_health,Trellix_hx] AND deviceid=[1234,5678]`
Users with this data policy will only be able to see health or Endpoint Security (HX) data from either of the two specified devices.
```

--------------------------------

### Creating a Custom Dashboard - JSON Configuration Example

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-53b281d1-a363-fa11-b954-73ef528c8c4b

This JSON example illustrates the structure for defining a custom dashboard in Helix. It includes properties for dashboard metadata and widgets. This configuration can be used to programmatically create or update dashboards.

```json
{
  "dashboardName": "My Custom Security Overview",
  "description": "A dashboard providing a high-level view of security events and threats.",
  "owner": "user@example.com",
  "widgets": [
    {
      "widgetType": "AlertsTable",
      "title": "Recent Alerts",
      "config": {
        "வுகளில்": 10,
        "filter": "status=open"
      }
    },
    {
      "widgetType": "ThreatsChart",
      "title": "Top Threats by Risk Score",
      "config": {
        "வுகளில்": 5,
        "groupBy": "riskScore"
      }
    },
    {
      "widgetType": "EventTrend",
      "title": "Event Volume Over Time",
      "config": {
        "timeRange": "24h",
        "interval": "1h"
      }
    }
  ]
}

```

--------------------------------

### Index Search Query Example

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-579d8f91-ba22-67f5-02c4-50f8fd837fdd

An example of constructing a query for an index search within Trellix Helix. This focuses on retrieving specific event data based on defined criteria.

```text
process_name:"powershell.exe" AND command_line:"-enc" AND outcome:success
```

--------------------------------

### Using the Helix API - Example Python Request

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-2512cbc6-86ca-ffe8-fcb4-9b3cbdcce7d0

This snippet demonstrates how to interact with the Trellix Helix API using Python. It shows a basic structure for making requests, which would typically involve authentication and specific endpoint calls for data retrieval or manipulation. Ensure you have the `requests` library installed (`pip install requests`).

```python
import requests

API_ENDPOINT = "https://api.helix.trellix.com/v1/"
API_KEY = "YOUR_API_KEY"

def get_alerts():
    headers = {
        "Authorization": f"Bearer {API_KEY}",
        "Content-Type": "application/json"
    }
    try:
        response = requests.get(f"{API_ENDPOINT}alerts", headers=headers)
        response.raise_for_status()  # Raise an exception for bad status codes
        return response.json()
    except requests.exceptions.RequestException as e:
        print(f"Error making API request: {e}")
        return None

if __name__ == "__main__":
    alerts = get_alerts()
    if alerts:
        print("Successfully retrieved alerts:")
        # Process the alerts data here
        # print(alerts)
    else:
        print("Failed to retrieve alerts.")
```

--------------------------------

### Custom Dashboard Widget Creation Example

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-147dfd36-252f-d2f7-ec39-80d326144af1

Illustrates the process of creating a custom widget for a Trellix Helix dashboard. This example focuses on defining the widget's properties and data source.

```javascript
{
  "widgetType": "Chart",
  "title": "Custom Alert Count",
  "dataSource": {
    "type": "Search",
    "query": "SELECT count(*) FROM alerts WHERE status = 'active'",
    "timeRange": "last_24_hours"
  },
  "visualizationOptions": {
    "chartType": "Bar",
    "xAxisLabel": "Status",
    "yAxisLabel": "Count"
  },
  "refreshInterval": "5m"
}
```

--------------------------------

### Searching Data - Helix Search Query Example

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-53b281d1-a363-fa11-b954-73ef528c8c4b

This example shows a typical search query syntax used within the Helix platform for data investigation. It focuses on searching for specific events within a defined time range and from particular sensors. Note that the exact syntax may vary based on Helix version and configuration.

```kql
event_type:"malware_detected" AND sensor.name:"sensor-01" AND timestamp:[2023-10-26T00:00:00Z TO 2023-10-27T00:00:00Z]
```

--------------------------------

### Example of a broad Helix rule and its optimized version

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-a9d8032a-8620-6085-33fd-05abff99bf90

Demonstrates a broad Helix rule with a large search scope, multiple distinguishers, a wide window, and a high threshold, followed by an optimized version with a narrowed scope, single distinguisher, shorter window, and lower threshold for improved performance.

```plaintext
Search: metaclass:[http_proxy,firewall,connection]
Distinguishers: srcipv4, dstipv4, srcport, dstport
Window: 1 day
Threshold: 10
```

```plaintext
Search: metaclass:[http_proxy,firewall,connection] srcipv4:153.251.53.0/24 srcport:80
Distinguishers: srcipv4
Window: 1 minute
Threshold: 1
```

--------------------------------

### Create First Rule for JAR Download Assertion

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-07b57395-7da0-6dbb-360e-c142c3f0d7fa

This rule identifies a Java archive (JAR) file download. It does not trigger an alert but sets an assertion named 'proxy.download.jar' for 1 minute, which can be used by other rules. The query looks for JAR files in HTTP proxy logs or bro_files with a 'java-archive' mimetype, using the source IP as a distinguisher.

```tql
((metaclass:http_proxy uri:/\.jar$/) or (class:bro_files mimetype=“application/java-archive”))
```

--------------------------------

### Get List of Devices Sending Logs - TQL Query

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-f227df97-8aec-1ff9-b3b9-40c153ba6839

This TQL query is used to retrieve a list of IPv4 addresses for devices that are currently sending logs to the Helix instance. This is a preliminary step before configuring silent log detection.

```sql
| groupby meta_sip4
```

--------------------------------

### Helix API Usage Example

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-147dfd36-252f-d2f7-ec39-80d326144af1

This snippet demonstrates how to interact with the Helix API to retrieve data or perform actions. It assumes you have the necessary authentication credentials and API endpoint configured.

```python
import requests

api_key = "YOUR_API_KEY"
api_endpoint = "https://api.helix.trellix.com/v1/"

headers = {
    "Authorization": f"Bearer {api_key}",
    "Content-Type": "application/json"
}

def get_alerts():
    response = requests.get(f"{api_endpoint}alerts", headers=headers)
    if response.status_code == 200:
        return response.json()
    else:
        print(f"Error: {response.status_code} - {response.text}")
        return None

if __name__ == "__main__":
    alerts = get_alerts()
    if alerts:
        print("Successfully retrieved alerts:")
        # Process alerts data here
        print(alerts)
```

--------------------------------

### Alert Suppression Example

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-147dfd36-252f-d2f7-ec39-80d326144af1

This example demonstrates how to suppress alerts, either individually or in batches, within the Trellix Helix platform. It outlines the necessary parameters for suppression.

```json
{
  "alertIds": ["alert-abc", "alert-def"],
  "reason": "False positive identified",
  "suppressUntil": "2023-11-01T00:00:00Z"
}
```

--------------------------------

### Running an Index Search Query in Helix

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-5121bf72-4746-e944-efba-d3118ec98a01

Demonstrates how to execute an index search within the Helix platform. This typically involves specifying a search query, a date range, and potentially a sensor. The code examples show how to construct and submit such a search.

```shell
POST /api/v1/search/index
{
  "query": "process_name:powershell.exe",
  "startDate": "2023-10-26T00:00:00Z",
  "endDate": "2023-10-27T23:59:59Z",
  "sensorId": "sensor-123"
}
```

```python
import requests
import json

api_url = "https://helix.trellix.com/api/v1/search/index"
headers = {
    "Authorization": "Bearer YOUR_API_TOKEN",
    "Content-Type": "application/json"
}
data = {
    "query": "process_name:cmd.exe",
    "startDate": "2023-10-26T00:00:00Z",
    "endDate": "2023-10-27T23:59:59Z"
}

response = requests.post(api_url, headers=headers, data=json.dumps(data))

if response.status_code == 200:
    search_results = response.json()
    print(f"Search found {len(search_results)}")
else:
    print(f"Error: {response.status_code}")
    print(response.text)
```

--------------------------------

### Search Audit Logs for Cases - Trellix Query Language

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-00e58bb7-aeed-88f6-5b24-04725596cca6

This example illustrates how to search for audit logs related to case events in Trellix Helix. It provides insights into changes made to cases, such as their severity and priority.

```trellix_query_language
class=trellix_audit eventtype=case
```

--------------------------------

### CSV Indicator Format Example

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-b2e05488-333f-4a41-cb7e-e95292435917

This example demonstrates the correct format for a CSV file containing custom indicators for Helix. It includes the header row and a sample data row with quoted fields for value, notes, risk, and type.

```csv
"supermalwarez4u.com", “verified evil site", "Low", "fqdn"
```

--------------------------------

### Upload and Get Silent Log Detection Status via API

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-f227df97-8aec-1ff9-b3b9-40c153ba6839

This snippet demonstrates how to upload a CSV configuration file for silent log detection and how to retrieve the current status of this feature using cURL commands. It requires an API key and the Helix ID.

```bash
$ curl -X POST -F "file=@<_path to CSV from step 1_>" -H "x-fireeye-api-key:<_API Key from step 3_>" https://apps.fireeye.com/helix/id/<Helix ID>/api/v3/senders
$ curl -X GET -H "x-fireeye-api-key:<_API Key from step 3_>" https://apps.fireeye.com/helix/id/<Helix ID>/api/v3/senders
```

```bash
$ curl -X POST -F "file=@deviceConfig.csv" -H "x-fireeye-api-key:ABCDEF1234567890" https:/apps.fireeye.com/helix/id/<Helix ID>/api/v3/senders
{"message":"Upload succeeded. Config updated for customer <Helix ID>"}

$ curl -X GET -H "x-fireeye-api-key:ABCDEF1234567890" https://apps.fireeye.com/helix/id/<Helix ID>/api/v3/senders
{"message":"Silent log detection is disabled for customer <Helix ID>"}
```

--------------------------------

### Search Audit Logs for Rules - Trellix Query Language

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-00e58bb7-aeed-88f6-5b24-04725596cca6

This example shows how to search for audit logs pertaining to rule events in Trellix Helix. It helps in tracking modifications to rules, including their enabled/disabled status and any added or removed distinguishers.

```trellix_query_language
class=trellix_audit eventtype=rule
```

--------------------------------

### Search Audit Logs for Alerts - Trellix Query Language

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-00e58bb7-aeed-88f6-5b24-04725596cca6

This example demonstrates how to search for audit logs related to alert events within Trellix Helix. It allows users to review changes made to alerts, such as state, risk score, and assignment.

```trellix_query_language
class=trellix_audit eventtype=alert
```

--------------------------------

### Using the Helix API

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-bd255b77-e595-fd08-a626-a8187d9c0932

This section details how to interact with the Helix API. It outlines the prerequisites for API access and provides examples of common API calls for retrieving and manipulating data within Helix. Further details on authentication and endpoints can be found in the official API documentation.

```bash
curl -X GET "https://api.helix.trellix.com/v1/alerts" -H "Authorization: Bearer YOUR_API_KEY"
```

```python
import requests

api_key = "YOUR_API_KEY"
headers = {"Authorization": f"Bearer {api_key}"}
response = requests.get("https://api.helix.trellix.com/v1/alerts", headers=headers)
print(response.json())
```

--------------------------------

### Using the Helix API

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-5c3d16d5-b255-e641-69e6-842ab4ba0f76

This section would typically detail how to interact with the Helix API. It would explain authentication methods, available endpoints for data retrieval and management, and provide examples of API calls and expected responses. This is crucial for integrating Helix with other systems or automating tasks.

```json
{
  "endpoint": "/api/v1/alerts",
  "method": "GET",
  "parameters": {
    "status": "open",
    "limit": 10
  },
  "response": {
    "alerts": [
      {
        "id": "alert-123",
        "severity": "high",
        "summary": "Potential malware detected"
      }
    ]
  }
}
```

```bash
curl -X GET "https://helix.trellix.com/api/v1/alerts?status=open&limit=10" \
     -H "Authorization: Bearer YOUR_API_KEY"
```

--------------------------------

### Perform TQL Search via Helix API using cURL

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-1fa29a61-f2d5-601e-dd27-e72f93627e59

This cURL command demonstrates how to perform a TQL search through the Helix API. It requires an API key and Helix instance ID, and sends a JSON payload containing the query and transformation details.

```shell
curl -v -H  "Content-Type: application/json" -H ">" -H "x-fireeye-api-key:<API-key>" -d '{"query":"<MQL-query>","transforms":<transforms-value>,"stream":<stream-value>,"options":{<option-pairs>}}' https://apps.fireeye.com/helix/id/<Helix-instance-ID>/api/v1/search
```

--------------------------------

### Using regular expressions with parsed fields in Helix

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-a9d8032a-8620-6085-33fd-05abff99bf90

Illustrates how to use regular expressions effectively in Helix by targeting a parsed field like 'msg' instead of raw fields like 'rawmsg' to search for specific string values, improving query efficiency.

```regex
msg:"/.(ModuleVersion)./"
```

--------------------------------

### Trellix Helix TQL Query for Pie Widget

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-d9606baa-bb51-1bda-eb18-329ffeb3ebb6

This is a sample TQL query used to create a pie widget in Trellix Helix Enterprise. It groups events by class to visualize the distribution of events across different classes. The query assumes a 'has=class' input and uses the 'groupby' transform.

```tql
has=class | groupby [class]
```

--------------------------------

### CSV Indicator Format Example with Optional Notes Field Blank

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-b2e05488-333f-4a41-cb7e-e95292435917

This example shows how to format a CSV file when the 'notes' field is omitted for a custom indicator in Helix. The blank notes field is represented by consecutive commas.

```csv
"supermalwarez4u.com", ,"Low","fqdn"
```

--------------------------------

### CSV Custom Indicator Data Example

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-b2e05488-333f-4a41-cb7e-e95292435917

These examples show data rows for custom indicators in a CSV file for Helix. Each row contains quoted values for the indicator's value, optional notes, risk level, and type.

```csv
"supermalwarez4u.com", "verified evil site", "Low", "fqdn"
```

```csv
"5815b13044fc9248bf7c2dba771f0e6496d9e536", "Conficker", "Critical", "sha1"
```

--------------------------------

### GET /api/v3/senders

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-f227df97-8aec-1ff9-b3b9-40c153ba6839

Retrieves the current enable/disable status of silent log detection.

```APIDOC
## GET /api/v3/senders

### Description
Retrieves the current enable/disable status of silent log detection.

### Method
GET

### Endpoint
`/api/v3/senders`

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
- **x-fireeye-api-key** (string) - Required - The API key for authentication.

### Request Example
```
$ curl -X GET -H "x-fireeye-api-key:<API Key>" https://apps.fireeye.com/helix/id/<Helix ID>/api/v3/senders
```

### Response
#### Success Response (200)
- **message** (string) - A message indicating whether silent log detection is enabled or disabled.

#### Response Example
```json
{
  "message": "Silent log detection is disabled for customer <Helix ID>"
}
```
```

--------------------------------

### Running an Index Search Query

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-ad4393c7-be56-d93f-5876-1b9531e60989

Demonstrates how to perform an index search within Helix. This involves specifying a query, a date range, and optionally a sensor. Index searches are for real-time or near real-time data.

```json
{
  "query": "process_name:powershell.exe AND parent_name:explorer.exe",
  "startDate": "2023-10-26T00:00:00Z",
  "endDate": "2023-10-27T23:59:59Z",
  "sensorId": "your_sensor_id"
}
```

--------------------------------

### Using the Helix API

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-7f5be413-0134-0cb9-3339-0f0b74b5fd2f

This section provides an overview of how to use the Helix API for programmatic interaction with your security data and functionalities.

```APIDOC
## Using the Helix API

### Description
This API allows you to programmatically access and manage data within the Trellix Helix platform. You can retrieve alerts, threats, asset information, and configure various aspects of your security environment.

### Method
GET, POST, PUT, DELETE

### Endpoint
`/api/v1/*`

### Parameters
#### Path Parameters
None

#### Query Parameters
- **api_key** (string) - Required - Your unique API key for authentication.
- **limit** (integer) - Optional - Maximum number of results to return.
- **offset** (integer) - Optional - Number of results to skip.

### Request Example
```json
{
  "message": "Refer to specific endpoint documentation for request body examples."
}
```

### Response
#### Success Response (200)
- **data** (object) - Contains the response payload specific to the endpoint.
- **status** (string) - Indicates the success status of the operation.

#### Response Example
```json
{
  "data": {},
  "status": "success"
}
```
```

--------------------------------

### Running an Index Search Query

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-ca330db6-346c-83b6-0d5f-2029e1a42c6d

This describes how to execute an index search within Helix. It covers selecting a date range and a sensor for the search query.

```python
# Example Python script for performing an index search (conceptual)
import requests

api_url = "https://helix.trellix.com/api/search/index"
headers = {
    "Authorization": "Bearer YOUR_API_KEY",
    "Content-Type": "application/json"
}

search_payload = {
    "query": "process_name:notepad.exe",
    "startDate": "2023-10-26T00:00:00Z",
    "endDate": "2023-10-27T23:59:59Z",
    "sensorId": "sensor-12345"
}

response = requests.post(api_url, headers=headers, json=search_payload)

if response.status_code == 200:
    print("Search successful:", response.json())
else:
    print("Search failed:", response.status_code, response.text)
```

--------------------------------

### Using the Helix API

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-8e3e2d9b-4b14-2940-dafb-607c1514952c

This section provides an overview and introductory information on how to use the Helix API. It covers general concepts and best practices for API integration.

```APIDOC
## Using the Helix API

### Description
This API allows you to programmatically interact with Trellix Helix for various security operations, including data retrieval, alert management, and threat analysis. It provides endpoints to access information about events, assets, alerts, and threats within your environment.

### Method
GET, POST, PUT, DELETE

### Endpoint
/api/v1/helix

### Parameters
#### Query Parameters
- **apiKey** (string) - Required - Your unique API key for authentication.
- **format** (string) - Optional - The desired output format (e.g., json, xml).

### Request Example
```
GET /api/v1/helix?apiKey=YOUR_API_KEY&format=json
```

### Response
#### Success Response (200)
- **status** (string) - Indicates the success of the API call.
- **data** (object) - Contains the requested data payload.

#### Response Example
```json
{
  "status": "success",
  "data": {
    "message": "Welcome to the Helix API!"
  }
}
```
```

--------------------------------

### Scheduling a Saved Search Query

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-d3e8dd5d-9aea-20db-b2ba-8a6e771f99e5

Provides an example of how to schedule a previously saved search query to run automatically. This is useful for regular monitoring and reporting. You can configure the frequency and time of execution.

```json
{
  "saved_query_id": "unique_saved_query_id",
  "schedule": {
    "type": "daily",
    "at": "03:00"
  }
}
```

--------------------------------

### Using the Helix API

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-3d3b3b40-d6e3-fa00-b13f-0e14eea92ecd

This section details how to interact with the Trellix Helix API. It covers authentication, endpoints, and common operations for data retrieval and management. Specific examples are provided for common use cases.

```json
{
  "apiKey": "YOUR_API_KEY",
  "apiEndpoint": "https://api.helix.trellix.com/v1"
}
```

```bash
curl -X GET \
  'https://api.helix.trellix.com/v1/alerts?limit=10' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Content-Type: application/json'
```

--------------------------------

### Searching Data with Index Searches

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-335a243f-a8fe-08d5-4f92-a4f4dd343429

This documentation covers how to perform index searches within Trellix Helix. It explains the differences between index and archive searches, how to construct search queries, select date ranges, and specify sensors. Limitations like query timeouts are also mentioned.

```kql
// Example KQL query for index search
process_name:"cmd.exe" AND parent_name:"explorer.exe"
```

```restql
// Example RESTQL query for index search
SELECT * FROM events WHERE process_name = 'cmd.exe' AND parent_name = 'explorer.exe'
```

--------------------------------

### Running an Index Search Query

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-d3e8dd5d-9aea-20db-b2ba-8a6e771f99e5

Demonstrates how to run searches against the indexed data within Trellix Helix. This includes specifying search queries, date ranges, and selecting specific sensors. Be mindful of query timeout limits for complex searches.

```json
{
  "query": "process_name:powershell.exe AND parent_name:explorer.exe",
  "time_range": {
    "start": "2023-10-26T00:00:00Z",
    "end": "2023-10-27T00:00:00Z"
  },
  "sensors": ["sensor_id_1", "sensor_id_2"]
}
```

--------------------------------

### Scheduling a Saved Search Query (Helix)

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-05032052-78a5-344a-4f5a-499b54d400d6

This example shows how to schedule a previously saved search query to run automatically at specified intervals. This is beneficial for automated reporting and monitoring. Ensure the scheduler is properly configured.

```shell
schedule_search --name "Daily Threat Summary" --saved_search "Daily Threat Report" --interval "daily" --time "08:00"
```

--------------------------------

### Retrieve All Alerts from Helix API using cURL

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-1fa29a61-f2d5-601e-dd27-e72f93627e59

This cURL command retrieves all alerts from the Helix API. It requires an API key and Helix instance ID to authenticate and specify the target instance.

```shell
curl -v -H ">" -H "x-fireeye-api-key:<API-key>" https://apps.fireeye.com/helix/id/<Helix-instance-ID>/api/v3/alerts
```

--------------------------------

### Suppressing Alerts - PowerShell Example

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-53b281d1-a363-fa11-b954-73ef528c8c4b

This PowerShell script demonstrates how to programmatically suppress individual alerts in Trellix Helix. It utilizes the Helix API to send a request to mark an alert as suppressed. Ensure you have the necessary API credentials and permissions.

```powershell
Invoke-RestMethod -Uri "https://helix.trellix.com/api/v1/alerts/suppress" -Method Post -Headers @{ "Authorization" = "ApiKey YOUR_API_KEY"; "Content-Type" = "application/json" } -Body (@{
    "alertIds" = @("alert_id_1", "alert_id_2");
    "reason" = "False positive identified."
} | ConvertTo-Json)
```

--------------------------------

### Using the Helix API

Source: https://docs.trellix.com/bundle/helix_pg/page/UUID-ad4393c7-be56-d93f-5876-1b9531e60989

This section provides an overview of how to use the Helix API, including general concepts and authentication.

```APIDOC
## Using the Helix API

### Description
This section provides an overview of how to use the Helix API, including general concepts and authentication.

### Method
N/A (This is an informational section)

### Endpoint
N/A

### Parameters
N/A

### Request Example
N/A

### Response
N/A
```
Tokens:
Raw