Trellix

Connect Trellix to collect endpoint detection & response evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Trellix:

   1. First create the permission set: on the ePO - On-prem Home page, open the menu and select User Management › Permission Sets.
   2. Click New Permission Set, type a name in Name and click Save. The new set appears on the Permission Sets page.
   3. Click the new permission set on the Permission Sets page, scroll to the settings you need and click Edit next to them. Under Systems, allow System Tree (to view the System Tree tab) and set System Tree access (to search and access the nodes and portions of the System Tree).
   4. Next create the user: select User Management › Users and click New User.
   5. On the New User page, type a User name, leave Logon status as Enabled and Authentication type as ePO authentication, and enter the Password and Confirm Password.
   6. Under Manually assigned permission sets, choose Selected permission sets, check the read-only permission set you created and click Save.

   Where to find the other values:

   • Server URL: The address of your own ePO - On-prem server, the one you open the ePO console on. The fetched docs do not show it on a screen.
   • Username: The User name you entered on the New User page (User Management › Users).

   Trellix's public documentation does not cover every step.

   The steps come from Trellix's ePO - On-prem pages written for the IPS Manager and Endpoint Upgrade Assistant integrations, but the User Management screens they describe are ePO's own. The exact label of the Threat Event Log view permission was not found on any fetched Trellix page, so that step is described generally. The password is the one you set yourself, so nothing is shown only once. Trellix recommends the user change the password at first login. ePO - SaaS manages users differently (Menu › Configuration › Users & Roles, Invite User) and does not apply to a self-hosted Server URL.

   Source: docs.trellix.com, docs.trellix.com, docs.trellix.com, docs.trellix.com, checked 2026-10-07.

   The permissions Safeguard needs: System Tree: View, Threat Event Log: View.

2. On Compliance › Connectors, open Trellix, click Connect, choose API token and fill in:

   Field	What to enter
   Server URL	Required. Your own server: an https address reachable from the internet.
   Username	Required.
   Password	Required. Stored encrypted and never shown again.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Trellix and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Endpoint Detection & Response connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks