Trellix HX Audit Feed (TRELLIX_HX_AUDIT) No Longer Receiving Bulk Acquisition Audit Events

The feed’s Healthy status does not confirm that HX is returning audit events. Google SecOps can successfully poll a source that returns an empty payload and still show the source as Healthy.

In Health Hub, compare:

Last Collected

Last Ingested

Last Normalized

If Last Collected continues advancing while Last Ingested does not, the HX endpoint is responding but returning no ingestible records.

Google’s current integration documentation requires:

HX API access enabled

A dedicated local HX user

The api_analyst role

/hx/api/v3/token

X-FeApi-Token

It does not document a Mandiant Managed Defense or fe_services dependency. fe_services is a highly privileged HX appliance role/account, not the required Google SecOps feed identity.

I would perform a controlled source-side test:

Initiate a new Bulk Acquisition.

Record the UTC time, acquisition/request ID and initiating user.

Open browser Developer Tools on the HX console and capture the /hx/api/v3/ requests used to display that acquisition and its audit history.

Replay those exact GET requests using the same api_analyst credentials configured in Google SecOps.

Token validation:

export HX='https://hx.example'

export HX_USER='secops_api'

read -rsp 'HX password: ' HX_PASS

echo

curl -skD /tmp/hx-token.headers \

  -o /dev/null \

  -u "${HX_USER}:${HX_PASS}" \

  "${HX}/hx/api/v3/token"

TOKEN="$(

  awk -F': ' '

    tolower($1) == "x-feapi-token" {

      gsub("\r", "", $2)

      print $2

    }

  ' /tmp/hx-token.headers

)"

test -n "$TOKEN" || {

  echo 'Token not returned'

  exit 1

}

curl -sk \

  -H "X-FeApi-Token: ${TOKEN}" \

  "${HX}/hx/api/v3/version" |

jq .

Replay the exact acquisition/audit request captured from the HX UI:

curl -skD /tmp/hx-response.headers \

  -H "Accept: application/json" \

  -H "X-FeApi-Token: ${TOKEN}" \

  "${HX}/<captured-hx-api-path>" |

tee /tmp/hx-audit-response.json |

jq .

Interpret the result:

Admin sees the record, api_analyst does not: HX RBAC or entitlement issue.

Neither account receives the record: HX audit generation, retention or appliance-service issue.

Both receive it, but SecOps does not: Google connector cursor/filtering or connector implementation issue.

HTTP 200 with an empty result: explains why the feed remains Healthy while ingestion is zero.

On the Trellix side, also verify the actual HX Power/bulk-acquisition API entitlement, not only the MD_Advance label. Because the failure began immediately after Managed Defense removal, entitlement reassignment or backend configuration changes should be checked even though Managed Defense is not a documented Google SecOps dependency.

I would not recreate the feed again until the direct API response is captured. Feed recreation cannot correct an HX endpoint that is returning no records. 

I hope this works for you. Let's keep our 🤞...S

Hello I have tried the same, but it seems that google secops is sending proper GET request but there is no log for it to pull, which would be the post from Fireeye HX. Is there some script that needs to running on the fireeye or it would automatically trigger it. Also tried to manually perform bulk acqs put google secops did not pull that logs. Previously whenever google secops was pull the logs it was visible that fe_services was active in that but now can see the same pattern. 
Kindly assist with this as there is no outcome visible. 
 

Hi ​​@DrVigilant ,

Thanks for clarifying — if SecOps is sending proper GET requests but HX is returning no logs, then the issue is almost certainly on the FireEye HX side rather than the Google connector.

🔑 Key checks on the HX appliance

• HX services status → Confirm fe_services and acquisition services are running. If they’re inactive, SecOps will see no data even though the feed looks “Healthy.”

• Bulk acquisition entitlement → Double‑check that the api_analyst account still has entitlement for Power/Bulk acquisition APIs. Entitlements often change after Managed Defense removal.

• Audit generation/retention → If HX is not generating audit records or retention was shortened, the API will return empty results.

• RBAC validation → Replay the same request with Admin vs api_analyst credentials. If Admin succeeds but api_analyst fails, it’s a role/permission issue.

🛠 Practical troubleshooting steps

1. Replay the captured /hx/api/v3/acquisition or /audit GET request with both Admin and api_analyst credentials.

   • Admin succeeds → RBAC/entitlement issue.

   • Neither succeeds → HX audit/service issue.

   • Both succeed but SecOps shows zero ingestion → connector cursor/filtering issue.

2. Check HX logs for service restarts or entitlement changes around the time Managed Defense was removed.

3. Avoid recreating the feed until HX is confirmed to return records directly via API. Feed recreation cannot fix an endpoint that is returning empty JSON.

⚠️ Why SecOps shows “Healthy” but no data

• If HX responds with HTTP 200 + empty JSON, SecOps marks the feed healthy (API reachable) but ingests nothing. That matches your observation.

👉 In short: validate HX services and entitlements first. If HX itself is returning empty results, SecOps cannot ingest anything. Once HX is confirmed to produce records, then connector filtering can be checked.

Kind regards

redact any critical ithink there is nothing still check Hey,  I checked for the api user roles and all the privilages has been granted. The role i am using currently is HX_API_ADMIN for the log injestion. But it seems that there is no bulk acqusition going on the fireeye hx server. Is there any way to turn on, or a script to initiate acqusition from the fireeye server so that google secops and GET those events.  

[27/Jun/2026:17:32:40 +0530] "GET /hx/api/v3/acqs/bulk?comment=Created+by+Google+SecOps&offset=0 HTTP/1.1" 200 1274
[27/Jun/2026:17:32:41 +0530] "GET /hx/api/v3/acqs/bulk/10039/hosts/Y1EElmipBO8g1VJeKCaRJk.zip HTTP/1.1" 404 178
Later 

- - [13/Jul/2026:12:59:55 +0530] "GET /hx/api/v3/acqs/bulk?comment=Created+by+Google+SecOps&offset=0 HTTP/1.1" 200 160
- - [13/Jul/2026:12:59:56 +0530] "DELETE /hx/api/v3/token HTTP/1.1" 204 -
- - [13/Jul/2026:13:00:03 +0530] "GET /hx_ng/about/log_manager/get_last_upload_time?system_request=true HTTP/1.1" 200 37
- - [13/Jul/2026:13:00:05 +0530] "GET /hx_ng/about/log_manager/get_last_upload_time?system_request=true HTTP/1.1" 200 37
- - [13/Jul/2026:13:00:15 +0530] "GET /hx_ng/about/log_manager/get_last_upload_time?system_request=true HTTP/1.1" 200 37
- - [13/Jul/2026:13:00:17 +0530] "GET /hx_ng/about/log_manager/get_last_upload_time?system_request=true HTTP/1.1" 200 37
- - [13/Jul/2026:13:00:19 +0530] "GET /hx/ui/v1/current_time HTTP/1.1" 200 101
- - [13/Jul/2026:13:00:27 +0530] "GET /hx_ng/about/log_manager/get_last_upload_time?system_request=true HTTP/1.1" 200 37
- - [13/Jul/2026:13:00:29 +0530] "GET /hx_ng/about/log_manager/get_last_upload_time?system_request=true HTTP/1.1" 200 37
- - [13/Jul/2026:13:00:31 +0530] "GET /hx/api/v3/token HTTP/1.1" 204 -
 

I checked there is no bulk acquisition going on the fireeye server. 
Before i used to see bulk acquisition but now only google secops is requesting with a GET but no acquisition is being created on the server. I have not seen any document that states that this acquisition can be only performed by Mandiant for fe_services. I have got the HX_Advanced licence too for the same thing. Cant understand how to trigger the bulk acquisition on the HX server for secops to fetch. Is there something that needs to be done for the same. I had even tried to perform a bulk acquisition manually but secops does not pull the manual acquisition. Kindly help for this if anyone knows where it is failing.
Thanks 

​@cmorris/ ​@DanDye , could you please assist me with this. 

Hi @DrVigilant, from Gemini for recommended next steps, can you try below? 

The behavior you are observing is expected based on how Trellix HX and Google SecOps interact:

1. Why Bulk Acquisitions Stopped: Bulk Acquisition audit events are not generated automatically by Trellix HX unless an acquisition job is actively initiated. When you had Mandiant Managed Defense, Mandiant’s automation (using fe_services) was automatically triggering bulk acquisitions for alert triage. When Managed Defense was offboarded, those triggers stopped, resulting in 0 acquisition events.

2. Why the Feed Shows "Healthy": Google SecOps continues to poll the HX API and receives HTTP 200 OK with an empty JSON payload ([]). Because the API connection is successful, Health Hub reports the feed as Healthy even though there are no new records to ingest.

3. Why Your Manual Acquisition Wasn't Ingested: Looking at your HX access log:

   "GET /hx/api/v3/acqs/bulk?comment=Created+by+Google+SecOps&offset=0 HTTP/1.1" 200

   The Google SecOps connector explicitly queries acquisitions where the comment equals Created by Google SecOps. A manual acquisition initiated from the UI without that exact comment is filtered out by the query parameter.

4. How to Automate Acquisitions Moving Forward: The Google SecOps SIEM feed is a read-only log collector and does not initiate acquisitions on endpoints. If you want automated acquisitions upon alerts (replacing Mandiant's workflow), configure a Google SecOps SOAR playbook using the Trellix HX integration to initiate the bulk acquisition action when alerts fire.

Quick Validation Test: Initiate a bulk acquisition (via API or UI) with the comment explicitly set to Created by Google SecOps. You should see SecOps ingest the event during the next polling cycle.