Trellix Response Actions API

openapi: 3.2.0
info:
  title: Trellix EDR Action History Response Actions API
  description: Endpoint Detection and Response API for advanced threat hunting, investigation, and automated response capabilities. The EDR API supports querying threat data, searching devices, retrieving action history, and executing real-time search and response actions across managed endpoints. Authentication uses OAuth 2.0 client credentials with the soc.act.tg scope.
  version: '2.0'
  contact:
    name: Trellix Support
    url: https://www.trellix.com/support/
  termsOfService: https://www.trellix.com/en-us/about/legal/terms-of-use.html
servers:
- url: https://api.manage.trellix.com
  description: Trellix Cloud Management Platform
security:
- bearerAuth: []
tags:
- name: Response Actions
  description: Trigger automated response actions on managed endpoints, including policy enforcement and remediation tasks.
paths:
  /epo/v2/response-actions:
    post:
      operationId: createResponseAction
      summary: Create a response action
      description: Trigger an automated response action on one or more managed endpoints. Response actions include policy enforcement, scan initiation, agent wake-up, and remediation tasks.
      tags:
      - Response Actions
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResponseActionCreate'
      responses:
        '202':
          description: Response action accepted for processing
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/ResponseAction'
        '400':
          description: Invalid response action request
        '401':
          description: Unauthorized - invalid or expired access token
components:
  schemas:
    ResponseAction:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the response action
        actionType:
          type: string
          description: Type of response action triggered
        status:
          type: string
          enum:
          - pending
          - in_progress
          - completed
          - failed
          description: Current status of the response action
        targetDevices:
          type: array
          items:
            type: string
          description: List of device identifiers targeted by the action
        createdAt:
          type: string
          format: date-time
          description: Timestamp when the action was created
    ResponseActionCreate:
      type: object
      required:
      - actionType
      - targetDevices
      properties:
        actionType:
          type: string
          enum:
          - wake_up_agent
          - run_scan
          - enforce_policy
          - collect_data
          description: Type of response action to execute
        targetDevices:
          type: array
          items:
            type: string
          description: List of device identifiers to target
        parameters:
          type: object
          description: Additional parameters specific to the action type
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 access token obtained through the client credentials flow with soc.act.tg scope. Credentials are generated through the Trellix EDR Credential Generator.
externalDocs:
  description: Trellix EDR Product Guide
  url: https://docs.trellix.com/bundle/mvision-endpoint-detection-and-response-product-guide