Configure Trellix Endpoint Security (ENS) for the [EDR connector](/guides/connectors/edr/overview) (`edr_trellix_ens`). ENS uses OAuth 2.0 client credentials plus a tenant-scoped API key, accessed through ePolicy Orchestrator (ePO). Collect the API key and client credentials from the Trellix Developer Portal, grant the required scopes when you create the credential, and copy the tenant ID from IAM Tenant Settings.

For tenants running **Trellix EDR** (not ENS), use the [Trellix EDR Provider Configuration Guide](/guides/provider-configuration/trellix-edr-setup) instead.

## Supported operations

This integration supports four operations, gated by two scopes:

| Scope | Operations |
|  --- | --- |
| `epo.device.r` | `query_endpoints`, `get_endpoint` |
| `epo.evt.r` | `query_threatevents`, `query_edr_events` |


`epo.evt.r` is a single scope — it is required for **both** threat events and EDR events. Grant it once to enable both operations.

Alerts, remediation, and realtime search are not supported for ENS. Do not use Trellix EDR scopes (`soc.*`) for this provider.

## Prerequisites

API access depends on **both** your Trellix license entitlements and the OAuth scopes on the client credential. Scopes alone do not unlock operations your tenant is not licensed for.

| License / product area | Operations available | Related scope(s) |
|  --- | --- | --- |
| **EPO** (endpoint management) | Query and retrieve managed endpoints | `epo.device.r` |
| **Trellix ENS** | Query threat events and EDR events | `epo.evt.r` |


Endpoint operations require **EPO**. Threat and EDR event queries require **Trellix ENS**. Without the matching license, the related scopes may be unavailable in Client Credentials, and API calls for those operations return not authorized even if a scope is granted.

## 1. Collect credentials

You need four values: **API Key**, **Client ID**, **Client Secret**, and **Tenant ID**. The API key is tenant-scoped — it is not in the ePO or ENS product dashboard, and there is no separate ENS API key.

### Step 1: Copy the API key

1. Log in to the [Trellix Developer Portal](https://developer.manage.trellix.com)
2. Click **Self Service**
3. Under **API Access Information**, click **Configure**
4. Copy the value under **API Key Information**


The same key also appears as **Trellix API Key** at the top of the Client Credentials page in the next step.

### Step 2: Create client credentials

1. On the API Access Information page, click **Generate Client Credentials**. This opens [Client Credentials Management](https://uam.ui.trellix.com/clientcreds.html)
2. Click **Add**
3. Give the credential a description
4. Select **all** required scopes listed under [scopes](#2-add-scopes) — scope selection is configured at credential creation
5. Click **Create**, then save the generated **Client ID** and **Client Secret**. The secret is shown once.


If a licensed product's scopes are missing from the list, request them from the Developer Portal first.

### Step 3: Copy the tenant ID

1. Log in to the [Trellix IAM dashboard](https://auth.ui.trellix.com/dashboard.html)
2. Click the profile icon in the top right and select **Tenant Settings**
3. Copy **Tenant Id** from **Tenant Information**


## 2. Add scopes

Grant **all** scopes in the table below on the client credential. Each scope maps to operations described in [Supported operations](#supported-operations) and [Prerequisites](#prerequisites). Trellix checks license entitlements and scopes on every API call — missing either one causes that operation to be rejected as **not authorized**.

In **Client Credentials**, Trellix groups scopes by product area:

| Trellix console category | Scope(s) |
|  --- | --- |
| **Devices** | `epo.device.r` |
| **Events** | `epo.evt.r` (threat events and EDR events) |


### Required scopes

| Scope | Required for | Without this scope |
|  --- | --- | --- |
| `epo.device.r` | `query_endpoints`; `get_endpoint` | Cannot list or retrieve endpoints; Trellix returns not authorized. |
| `epo.evt.r` | `query_threatevents` and `query_edr_events` | Cannot query threat events or EDR events; Trellix returns not authorized. |


Event queries use `epo.evt.r` under **Events** in Client Credentials — not **EDR Events** (`soc.cfg.*`) and not Trellix EDR `soc.*` scopes.

## 3. Configure the integration

**Client ID**: OAuth client ID from Client Credentials.

**Client Secret**: OAuth client secret from Client Credentials.

**Tenant ID**: Trellix tenant GUID from IAM **Tenant Settings** → **Tenant Information**.

**API Key**: Tenant-scoped Trellix API key from Developer Portal **Self Service** → **API Access Information**, or **Trellix API Key** on the Client Credentials page.

Trellix API requests also send `X-Tenant-Id`, `x-api-key`, and a bearer token from `https://iam.cloud.trellix.com/iam/v1.0/token`.