Trellix

SIEM Platform

Synopsis

The Trellix target forwards events, formatted as CEF, to Trellix SIEM / McAfee ESM over syslog. It handles transport framing (UDP, TCP, or TLS) — the event payload is expected to already be in CEF format when it reaches the target.

Schema

- name: <string>
  description: <string>
  type: trellix
  pipelines: <pipeline[]>
  status: <boolean>
  properties:
    address: <string>
    port: <numeric>
    protocol: <string>
    hostname: <string>
    priority: <numeric>
    template: <string>
    max_message_size: <numeric>
    application_name: <string>
    tls:
      status: <boolean>
      verify: <boolean>
      server_name: <string>
      ca_name: <string>
      cert_name: <string>
      key_name: <string>
      passphrase: <string>
      min_tls_version: <string>
      max_tls_version: <string>
    field_format: <string>
    debug:
      status: <boolean>
      dont_send_logs: <boolean>

Configuration

The following fields are used to define the target:

Field	Required	Default	Description
name	Y		Target name
description	N	-	Optional description
type	Y		Must be trellix
pipelines	N	-	Optional post-processor pipelines
status	N	true	Enable/disable the target

Connection

Field	Required	Default	Description
address	Y	-	Trellix SIEM / McAfee ESM receiver IP or hostname (data source: Syslog CEF). Resolved at dial time
port	N	514	Remote receiver port. 514 for tcp/udp, often 6514 for tls. Valid range 1–65535
protocol	N	tcp	Transport protocol: tcp, udp, or tls

Framing

Field	Required	Default	Description
hostname	N	this host's name	Hostname written into the syslog header
priority	N	13	Syslog PRI value (facility×8 + severity). Valid range 0–191; 13 = user.notice
template	N	`<{{.Priority}}>{{.BSDTimestamp}} {{.Hostname}} {{.Message}}`	BSD (RFC 3164) syslog header template. Set to `{{.Message}}` to send the raw payload with no header
max_message_size	N	0	Maximum framed line length in bytes. 0 sends the full event
application_name	N	product name	Syslog tag / app-name. Only rendered when template references `{{.AppName}}` — the default template does not use it

TLS

Field	Required	Default	Description
tls.status	N	false	Enable TLS. Also enabled automatically when protocol: tls
tls.verify	N	true	Verify the server certificate
tls.server_name	N	-	SNI / expected server hostname
tls.ca_name	N	-	Custom CA to trust. Empty uses the OS trust store
tls.cert_name	N*	-	Client certificate for mutual TLS
tls.key_name	N*	-	Client key for mutual TLS
tls.passphrase	N	-	Passphrase for an encrypted client key
tls.min_tls_version	N	tls1.2	Minimum negotiated TLS version
tls.max_tls_version	N	tls1.3	Maximum negotiated TLS version

* = Conditionally optional. tls.cert_name and tls.key_name must be supplied together to enable mutual TLS; supplying only one fails configuration validation.

note

TLS material fields (cert_name, key_name, ca_name, client_ca_name) accept any of the following:

• File name — resolved relative to the service root directory. Nested paths such as certs/prod/server.pem are supported.
• Absolute path — honored only if it resolves inside the service root. Any path that escapes the root is refused.
• Inline PEM content — used verbatim when the value contains -----BEGIN.
• Environment variable — ${ENV_VAR}.
• Vault reference — $secret{id=...} or $secret{store=...,ref=...}.

Processing

Field	Required	Default	Description
field_format	N	-	Optional target-side normalization format applied before delivery. Typically left empty, since the payload already arrives in CEF from upstream processing. See applicable Normalization section

Scheduling

See Scheduling and Pool Behavior for interval and cron fields shared by all targets.

Debug Options

Field	Required	Default	Description
debug.status	N	false	Enable debug logging
debug.dont_send_logs	N	false	Process logs but don't send to target (testing)

Details

This target is transport-only: it does not render CEF itself. It expects each event to already be a complete CEF record when it reaches the target, and applies syslog framing and delivery on top of that payload. There is no batching — each event is a single, complete delivery to the Trellix SIEM / McAfee ESM receiver (data source: Syslog CEF).

Template Variables

The following variables are available in template:

Variable	Description
{{.Year}}	Current year (4-digit)
{{.Month}}	Current month (2-digit)
{{.Day}}	Current day (2-digit)
{{.Priority}}	Syslog PRI value
{{.Timestamp}}	Current time, RFC3339
{{.BSDTimestamp}}	Current time, RFC3164 (Jan _2 15:04:05)
{{.Hostname}}	Syslog-header hostname
{{.AppName}}	Application name (application_name)
{{.PID}}	Process ID
{{.Message}}	The CEF payload

If template fails to render, the target falls back to sending the raw, sanitized payload with no header.

Framing and Transport

Embedded carriage returns and line feeds in the payload are neutralized before framing, so one event cannot forge a second line on the wire. On a TCP or TLS stream, exactly one trailing newline delimits each event (RFC 6587 non-transparent framing); this is harmless on UDP. No size limit applies by default (max_message_size: 0); set a cap when the transport is UDP and the receiver enforces a lower datagram limit.

TLS

TLS is enabled automatically when protocol: tls, or explicitly via tls.status: true. A client certificate is optional — supplying tls.cert_name without tls.key_name (or vice versa) fails configuration validation. tls.verify defaults to true.

note

The target does not perform CEF rendering or field mapping — it only frames and delivers the payload it receives. Format the event as CEF before it reaches this target.

Examples

Basic Configuration

Sending CEF events to a Trellix SIEM / McAfee ESM receiver over TCP...

targets: - name: trellix type: trellix properties: address: "10.0.0.52"

Secure TLS

Delivering over an encrypted TLS connection with server verification...

targets: - name: trellix-tls type: trellix properties: address: "trellix.example.com" port: 6514 protocol: tls tls: status: true verify: true

Capped UDP

Capping message size for a UDP receiver with a limited datagram size...

targets: - name: trellix-udp type: trellix properties: address: "10.0.0.52" protocol: udp max_message_size: 8192