Trellix HX Audit Feed (TRELLIX_HX_AUDIT) No Longer Receiving Bulk Acquisition Audit Events

Question

Hello,We're investigating an issue with a Trellix HX Audit integration in Google SecOps and would appreciate any guidance from others who have worked with this feed.EnvironmentGoogle SecOps SIEM	Trellix HX / FireEye HX API Feed	Log Type: TRELLIX_HX_AUDITIssueThe feed was ingesting normally for an extended period and then abruptly stopped receiving audit events.Observed ingestion pattern:Normal ingestion for several weeksSharp reduction in volumeSubsequently dropped to 0 events/day Current StatusFeed status shows OK/Healthy	Feed is enabled	Feed was recreated with the same configuration	Other Trellix HX-related feeds continue to ingest successfully	No parsing errors	No validation errors	No indexing errorsSpecific Event Type AffectedThe primary missing events are Bulk Acquisition audit events, such as:Bulk Acquisition InitiatedBulk Acquisition Completed These events were previously being ingested into Google SecOps under TRELLIX_HX_AUDIT.Additional FindingsWhile reviewing historical HX audit logs, we confirmed that Bulk Acquisition activities were previously audited through HX API operations related to bulk acquisition workflows.We're trying to understand:Whether Bulk Acquisition audit events require any special HX configuration or permissions.	Whether the HX Audit API can stop exposing these events while the feed itself remains healthy.	How others have validated that Bulk Acquisition audit records are still being returned by the HX Audit API.	Whether there are any known issues affecting TRELLIX_HX_AUDIT ingestion for Bulk Acquisition activitiesAll the permission have been granted properly as to the API account  Does it have a mandiant dependency as this issue took place after removing mandiant defense from the environment.But the secops configuration document does not suggest or say about mandiant dependencyAlso MD_Advance licence is in place for Trellix HX that supports bulk acqusision  Is there anything on the server level that needs done from trellix side for Fe_servicesAny suggestions on additional HX-side checks or API validation steps would be greatly appreciated.

whathehack81 · Answer

The feed’s Healthy status does not confirm that HX is returning audit events. Google SecOps can successfully poll a source that returns an empty payload and still show the source as Healthy.

In Health Hub, compare:

Last Collected

Last Ingested

Last Normalized

If Last Collected continues advancing while Last Ingested does not, the HX endpoint is responding but returning no ingestible records.

Google’s current integration documentation requires:

HX API access enabled

A dedicated local HX user

The api_analyst role

/hx/api/v3/token

X-FeApi-Token

It does not document a Mandiant Managed Defense or fe_services dependency. fe_services is a highly privileged HX appliance role/account, not the required Google SecOps feed identity.

I would perform a controlled source-side test:

Initiate a new Bulk Acquisition.

Record the UTC time, acquisition/request ID and initiating user.

Open browser Developer Tools on the HX console and capture the /hx/api/v3/ requests used to display that acquisition and its audit history.

Replay those exact GET requests using the same api_analyst credentials configured in Google SecOps.

Token validation:

export HX='https://hx.example'

export HX_USER='secops_api'

read -rsp 'HX password: ' HX_PASS

echo

curl -skD /tmp/hx-token.headers \

-o /dev/null \

-u "${HX_USER}:${HX_PASS}" \

"${HX}/hx/api/v3/token"

TOKEN="$(

awk -F': ' '

tolower($1) == "x-feapi-token" {

gsub("\r", "", $2)

print $2

}

' /tmp/hx-token.headers

)"

test -n "$TOKEN" || {

echo 'Token not returned'

exit 1

}

curl -sk \

-H "X-FeApi-Token: ${TOKEN}" \

"${HX}/hx/api/v3/version" |

jq .

Replay the exact acquisition/audit request captured from the HX UI:

curl -skD /tmp/hx-response.headers \

-H "Accept: application/json" \

-H "X-FeApi-Token: ${TOKEN}" \

"${HX}/<captured-hx-api-path>" |

tee /tmp/hx-audit-response.json |

jq .

Interpret the result:

Admin sees the record, api_analyst does not: HX RBAC or entitlement issue.

Neither account receives the record: HX audit generation, retention or appliance-service issue.

Both receive it, but SecOps does not: Google connector cursor/filtering or connector implementation issue.

HTTP 200 with an empty result: explains why the feed remains Healthy while ingestion is zero.

On the Trellix side, also verify the actual HX Power/bulk-acquisition API entitlement, not only the MD_Advance label. Because the failure began immediately after Managed Defense removal, entitlement reassignment or backend configuration changes should be checked even though Managed Defense is not a documented Google SecOps dependency.

I would not recreate the feed again until the direct API response is captured. Feed recreation cannot correct an HX endpoint that is returning no records.

I hope this works for you. Let's keep our 🤞...S

Environment

Issue

Current Status

Specific Event Type Affected

Additional Findings

Sign up

Login with SSO

Login to the community

Login with SSO