Trellix Network Security (NX)

SamurAI [Local] Collector	SamurAI [Cloud] Collector

This guide describes the steps required to integrate Trellix Network Security (NX) to the SamurAI platform.

To complete this Integration you will need to:

1) Ensure Connectivity Requirements are in place:

• Connectivity Requirements

2) From your Trellix Network Security (NX):

• Configure syslog forwarding
• Create a local user account for data retrieval

3) From the SamurAI Portal:

• Complete the Trellix Network Security (NX) Integration

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Configure syslog forwarding

For additional information you can refer to System log notifications in the Trellix Network Security System Administration Guide.

To configure syslog forwarding to the SamurAI Local Collector, follow the steps below:

1. From the Trellix Network Security Web UI, configure the rsyslog destination that sends to the Local Collector with the following mandatory settings:

• Server Name
• IP Address: SamurAI Local Collector IP address (ensure it is enabled)
• Delivery: Per event
• Notification: All events
• Format: CEF
• Send As: Alert
• Protocol: TCP

These settings ensure that events are transmitted in CEF format over TCP and can be correctly parsed by the SamurAI Local Collector.

Refer to Adding system log servers in the Web UI in the Trellix Network Security User Guide.

2. Connect to the Trellix NX appliance CLI using SSH with an administrator account.

3. Apply the following additional CLI command to ensure correct log line formatting is sent to the Local Collector:

hostname> enable
hostname# configure terminal
hostname(config)# no fenotify preferences rsyslog-strip-lnfb enable
hostname(config)# write memory

Create a local user account for data retrieval

For additional information you can refer to Trellix documentation:

• Managing user accounts
• Creating a user account using the Web UI
• Creating a user account using the CLI

To create a dedicated local user account, follow the steps below:

1. Log in to the Trellix Network Security Web UI with an administrator account.

2. Click the Settings tab.

3. Click User Accounts on the sidebar.

4. Perform the following steps:

   4.1 Enter pod as the User Name for the account (this user name is mandatory for the SamurAI integration).
   4.2 Select analyst from the Role list.
   4.3 Enter a case-sensitive password in the Create Password and Confirm Password fields.

The pod account with the analyst role is used by the SamurAI Local Collector to authenticate when retrieving evidence from the Trellix NX appliance.

5. Record the following values:

• NX Appliance IP Address / Hostname
• User Name (pod)
• Password

Alternatively, a local user account can be created using the CLI. To create a local user account from the CLI, follow the steps below:

hostname> enable
hostname# configure terminal
hostname(config)# username pod
hostname(config)# username pod role analyst
hostname(config)# username pod password [password]
hostname(config)# show usernames
hostname(config)# write memory

where pod is the required username for the integration, and password is the case-sensitive password for the pod account.

Complete the Trellix Network Security (NX) Integration

1. Log in to the SamurAI Portal.
2. Click Telemetry and select Integrations from the main menu.
3. Select Create.
4. Locate and click Trellix Network Security (NX).
5. Select the relevant Local Collector and click Next.
6. You will be presented with the Local Collector IP Address on the left of the screen.
7. Enter a Name of Integration.
8. Enter a Description (Optional).
9. Enter the User Name (pod).
10. Enter the Password for the pod account.
11. Enter the NX Appliance IP Address / Hostname.
12. Optional: Skip Packet Captures

• You may choose to enable: Skip packet captures (optional)
  • Packet capture data will not be ingested

13. Click Finish.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the SamurAI MDR Portal and we shall get it updated.