[trellix_epo] Initial release for the Trellix ePO - #6029
Conversation
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
🌐 Coverage report
|
|
@janvi-elastic Given that there's both cloud and on-prem versions on ePO, we should make it clearer that this integration only supports ePO Cloud. Could we update the package name to Trellix ePO (Cloud) or something along those lines, and include a line in the description to make it clear this is for ePO Cloud. We'll likely focus on an on-prem integration soon too, so can call that ePO (on-premises) to avoid any confusion. |
|
|
||
| The [Trellix ePO](https://www.trellix.com/en-us/products/epo.html) integration allows users to monitor devices, events and groups. Trellix ePolicy Orchestrator is centralized security management platform to orchestrate and manage all your endpoints. | ||
|
|
||
| Use the Trellix ePO integration to collect and parse data from the REST APIs. Then visualize that data in Kibana. |
There was a problem hiding this comment.
Suggestions - "Use the Trellix ePO integration to collect and parse data from ePO Cloud. This integration does not support on-premises installations of ePO.
Also, expand on visulize data, e.g. "Use this data from Trellix to identify threats through search, correlation and visualisation within Elastic Security"
|
|
||
| ## Requirements | ||
|
|
||
| Elasticsearch is needed to store and search data. Kibana is needed for visualizing and managing it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your hardware. |
There was a problem hiding this comment.
We can drop this line. We can just list the requirements based on the minimum Kibana version that we require for the integration, the version of Trellix ePO we've tested against and any user permissions required to pull from the API. We can also list Elastic Agent as a requirement too, with a link to Elastic Agent installation docs.
| | Events | GET | | ||
| | Groups | GET | | ||
| 5. Click **Request**. | ||
| 6. Copy **Client ID**, **Client Secret** and **API Key**. |
There was a problem hiding this comment.
Add a step 7, what do to once you've copied the secret/key. It's obvious to us, but users after often left wondering what next, once they've copied the details. As it stands, we tell them to copy some data from Trellix with no guidance on what to do next.
@jamiehynds Yes, we are working on it considering new package name as trellix_epo_cloud. And also do the respective changes in Readme. |
|
@P1llus I've approve the naming/docs updates if you wouldn't mind merging from here? |
|
Package trellix_epo_cloud - 0.1.0 containing this change is available at https://epr.elastic.co/search?package=trellix_epo_cloud |
andrewkroh
added
Crest
* Initial release for the trellix ePO * Update the changelog entry * Update kibana.version to 8.7.1 * Update package name to trellix_epo_cloud
5 participants
What does this PR do?
Integration release checklist
This checklist is intended for integrations maintainers to ensure consistency
when creating or updating a Package, Module or Dataset for an Integration.
All changes
New Package
Dashboards changes
Log dataset changes
How to test this PR locally
Automated Test
Screenshot