Trellix Network Security (NX)

SamurAI [Local] Collector	SamurAI [Cloud] Collector

This guide describes the steps required to integrate Trellix Network Security (NX) to the SamurAI platform.

To complete this Integration you will need to:

1) Ensure Connectivity Requirements are in place:

• Connectivity Requirements

2) From your Trellix Network Security (NX):

• Create a local user account for data retrieval

3) From the SamurAI Portal:

• Complete the Trellix Network Security (NX) Integration

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Create a local user account for data retrieval

For additional information you can refer to Trellix documentation:

• Managing user accounts
• Creating a user account using the Web UI
• Creating a user account using the CLI

To create a dedicated local user account, follow the steps below:

1. Log in to the Trellix Network Security Web UI with an administrator account.

2. Click the Settings tab.

3. Click User Accounts on the sidebar.

4. Perform the following steps:

   4.1 Enter pod as the User Name for the account (this user name is mandatory for the SamurAI integration).
   4.2 Select analyst from the Role list.
   4.3 Enter a case-sensitive password in the Create Password and Confirm Password fields.

The pod account with the analyst role is used by the SamurAI Local Collector to authenticate when retrieving evidence from the Trellix NX appliance.

5. Record the following values:

• NX Appliance IP Address / Hostname
• User Name (pod)
• Password

Alternatively, a local user account can be created using the CLI. To create a local user account from the CLI, follow the steps below:

hostname> enable
hostname# configure terminal
hostname(config)# username pod
hostname(config)# username pod role analyst
hostname(config)# username pod password [password]
hostname(config)# show usernames
hostname(config)# write memory

where pod is the required username for the integration, and password is the case-sensitive password for the pod account.

Complete the Trellix Network Security (NX) Integration

1. Log in to the SamurAI Portal.
2. Click Telemetry and select Integrations from the main menu.
3. Select Create.
4. Locate and click Trellix Network Security (NX).
5. Select the relevant Local Collector and click Next.
6. You will be presented with the Local Collector IP Address on the left of the screen.
7. Enter a Name of Integration.
8. Enter a Description (Optional).
9. Enter the User Name (pod).
10. Enter the Password for the pod account.
11. Enter the NX Appliance IP Address / Hostname.
12. Optional: Skip Packet Captures

• You may choose to enable: Skip packet captures (optional)
  • Packet capture data will not be ingested

13. Click Finish.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the SamurAI MDR Portal and we shall get it updated.