cyber.hendryadrian.com
Detection & Defense · socprime.com

How to Export Trellix Helix Logs for Investigation

· Original article ↗

Summary

A guide shows how to export Trellix Helix logs through its search API, prepare JSON events, and troubleshoot authentication, instance, query, and result-limit errors before reviewing the data in LogTotal.

Key points

  • Helix log searches use TQL; the guide recommends testing a query in the Helix search interface before using the API.
  • The search API requires an API key with appropriate scopes and the Helix instance ID.
  • Send a POST request to the Helix search endpoint at hxxps://apps[.]fireeye[.]com/helix/id/<instance-id>/api/v1/search, with the key in the x-fireeye-api-key header.
  • Search results are JSON; jq can flatten events to one per line or extract the raw log message.
  • The guide links authentication errors to missing scopes or an incorrect header, 404 errors to an incorrect instance ID or regional host, and query errors to using MQL instead of TQL.
  • It recommends splitting the time range if result limits cut off the export.
  • Helix alerts use a separate /api/v3/alerts endpoint; the guide focuses on exporting the events behind them.

Article Details

Defense Focus
Export Trellix Helix log-search results for sanitization and investigation in LogTotal.
Detection Methods
  • Build and test searches in the Helix search page before submitting them through the search API.
  • Use TQL queries to search Helix logs; unfielded terms are matched against the raw message index.
  • Flatten search results to one event per line and extract the raw field when the source data is text.
Data Sources
  • Events returned by the Helix search API as JSON, including the original log line in the raw message field.
  • Events behind Helix alerts, which can be exported separately from the alerts endpoint.
Rule Types
  • TQL search queries
Defensive Actions
  • Create an API key with the search scopes required by the query and send it in the x-fireeye-api-key header.
  • Use the instance ID in the API URL and the correct regional host when applicable.
  • Rewrite MQL queries in TQL and test them in the Helix UI.
  • If results are cut short by the result limit, split the time range.
  • Upload exported logs to LogTotal for sanitization and review.

Vendors

FireEyeRun your search through the Helix search API: a POST to https://apps.fireeye.com/helix/id/<instance-id>/api/v1/search with your API key in the x-fireeye-api-key header and the query in the body.TrellixTrellix Helix, formerly FireEye Helix and called Helix Enterprise in newer docs, combines log search with detection content.

Products

FireEye HelixTrellix Helix, formerly FireEye Helix and called Helix Enterprise in newer docs, combines log search with detection content.Helix EnterpriseTrellix Helix, formerly FireEye Helix and called Helix Enterprise in newer docs, combines log search with detection content.LogTotalBelow is how to get events out, sanitize them, and investigate them for free in LogTotal.Trellix EDRIs this the same as Trellix EDR search?Trellix HelixTrellix Helix, formerly FireEye Helix and called Helix Enterprise in newer docs, combines log search with detection content.

Related Articles