FireEye Trellix Helix

This guide explains how to integrate FireEye Trellix Helix (now Trellix Helix) with RedCarbon.

Overview

The Trellix Helix integration allows RedCarbon to ingest alerts and incidents from the Helix platform.

• Vendor Documentation: Trellix Helix API Documentation

Configuration

To configure the integration, you need to generate an API Key in the Helix console.

Step 1: Access IAM

1. Log in to the Helix Homepage.
2. Click on the Profile icon > Identity Access Management Console (IAM).

Step 2: Create an API Key

1. Navigate to API Keys.
2. Click Create New API Key.

Step 3: Configure Settings

1. Select API Key with entitlements.
2. Set the expiration date (e.g., 1 year).
3. Under Products, select Threat Analytics Platform.

Step 4: Set Entitlements

1. In the Entitlements section, search for and select the following permissions:
   • tap.alerts.browse
   • tap.alerts.read
   • tap.alerts.edit (optional, for write access)

Step 5: Configure RedCarbon

1. Copy the generated API Key.
2. Log in to the RedCarbon Dashboard.
3. Navigate to the customer's Integrations page.
4. Select FireEye Trellix Helix.
5. Paste the API Key and your Helix Instance URL.
6. Click Save and then Test.

Severity Mapping

Original Severity	RedCarbon Score
Low	10
Medium	40
High	70
Critical	90