About the Trellix ePolicy Orchestrator Integration
Trellix ePolicy Orchestrator (ePO) is Trellix’s centralized security management platform, providing unified policy administration, deployment, and reporting across endpoints and Trellix security products from a single console. Part of Synqly’s EDR Unified API, the Trellix ePolicy Orchestrator integration enables security teams to access normalized endpoint detection and response data—including detections, alerts, and managed endpoint telemetry—through a standardized connector. Integrate with Trellix ePolicy Orchestrator to incorporate endpoint threat context into your SIEM, threat detection, and security operations workflows, enabling faster investigation and response.
Integration Use Cases
Get Endpoint
Gets a single endpoint assets matching the UID from the token-linked EDR source.
Quarantine Endpoints
Connect or disconnect one or more endpoints assets to the network, allowing or disallowing connections.
Query Alerts
Returns a list of alerts that match the query from the token-linked EDR source.
Query Endpoints
Returns a list of endpoint assets matching the query from the token-linked EDR source.
Query Threat Events
Returns a list of threats that match the query from the token-linked EDR source.
