Purpose
This guide explains how to create an API-enabled user account on your Trellix HX Controller (formerly FireEye HX) appliance and how to use it in Logsign USO to ingest HX endpoint detection alerts for security analytics and forensic purposes.
Trellix HX is deployed as a Controller appliance in your own environment, not as a shared SaaS console. The appliance exposes alert data through a REST API (HX Series API) rather than syslog. This API poller is the supported way to bring HX alert data into Logsign USO. The appliance itself does not offer a syslog forwarding option for alert data, so API polling is the only path.
Prerequisites
You need administrator access to your HX Controller's own web console (the appliance management UI, typically reachable at https://<appliance-IP>:3000). Only an administrator can create new user accounts.
The account used by Logsign must be assigned the api_analyst role (read-only access, sufficient for pulling alerts) or the api_admin role. Do not reuse the appliance's built-in api_analyst account for this integration; create a dedicated account instead, so access can be revoked independently later.
Step 1: Identify Your HX Controller Address
Confirm the address of your HX Controller appliance, for example https://192.168.10.5:3000. This is the same address you use to log in to the HX web console. Port 3000 is the appliance's standard management/API port. This is the Base URL you will enter in Logsign in Step 3.
Unlike SaaS products, there is no shared login portal or region-based domain here; every customer's HX Controller is a separate appliance with its own address, deployed in the customer's own network.
Step 2: Create a Dedicated API User Account
- Sign in to the HX Controller web console as an administrator.
- Go to Admin > Appliance Settings > User Accounts.
- Add a new user account (for example, named
logsign-api) rather than reusing an existing account. - Assign the api_analyst role to the account. Use api_admin only if your organization specifically requires the broader privileges it grants (such as agent configuration or containment actions); Logsign's poller only reads alert data and does not need them.
- Set a password for the account and record the username and password. Logsign uses this username/password pair directly; there is no separate API key or secret to generate.
Step 3: Configure the Integration in Logsign USO
After creating the account, log in to Logsign USO and add a new Trellix HX Endpoint Security data source. You will be asked for:
| Field | Value |
|---|---|
| HX Host | Your appliance address from Step 1, for example https://192.168.10.5:3000 |
| Username | The account username from Step 2 |
| Password | The account password from Step 2 |
Logsign exchanges the username and password for a short-lived token automatically on the first poll (via the appliance's /hx/api/v3/token endpoint), and re-exchanges it whenever it expires or is rejected. You do not need to generate or refresh a token yourself. Logsign then periodically queries the HX Series alerts API for new alerts, using each alert's numeric ID as the sync cursor (fetching everything with an ID greater than the last one seen, sorted ascending) so no alert is skipped or duplicated, and normalizes each alert into a Logsign event, including its detection type, matched indicator, affected host/agent, and associated process or file-write details when present.
Notes and Limits
- The token obtained by the integration is treated by Logsign as valid for about 58 minutes. Logsign requests a new one automatically before it expires or immediately after an authorization failure, so no manual action is needed under normal operation. The appliance's own server-side token lifetime was not independently confirmed against official Trellix documentation at the time of writing; treat the 58-minute figure as Logsign's own refresh cadence, not a guaranteed server-side limit.
- If polling stops and the source logs repeated authorization errors, check first whether the dedicated API account was disabled, deleted, or had its password changed on the HX Controller. Restore the account or create a new one with the api_analyst role and update the data source in Logsign USO.
- This poller only covers the HX Series alerts endpoint (endpoint detection/EDR alerts, including process and file-write event detail when the alert carries it). Other HX Controller surfaces, host inventory/audit data, indicator (IOC) management, agent containment actions, and bulk acquisition results, are not part of this integration and would require separate connectors.
- Requests from the poller to the appliance do not validate the appliance's TLS certificate (certificate verification is disabled), which matches the common on-premises pattern of HX Controllers using a self-signed certificate. Confirm this is acceptable under your organization's security policy.
- Exact official rate-limit thresholds for the HX Series API were not confirmed from Trellix's official documentation at the time of writing. The poller does handle HTTP 429 (rate limited) responses, but the specific request-per-minute ceiling is not documented here.
- Make sure the HX Host you enter is your own appliance's address, not a shared Trellix login page. Trellix HX has no shared cloud login for this API; each customer connects directly to their own appliance.