---
title: Trellix Endpoint Security (ENS)
description: Gain insights into Trellix Endpoint Security logs
breadcrumbs: Docs > Integrations > Trellix Endpoint Security (ENS)
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Trellix Endpoint Security (ENS)
Integration version1.0.0
{% callout %}
# Important note for users on the following Datadog sites: us2.ddog-gov.com

{% alert level="info" %}
To find out if this integration is available in your organization, see your [Datadog Integrations](https://app.datadoghq.com/integrations) page or ask your organization administrator.

To initiate an exception request to enable this integration for your organization, email [support@ddog-gov.com](mailto:support@ddog-gov.com).
{% /alert %}

{% /callout %}
Trellix Endpoint Security (ENS) - Threat Events
## Overview{% #overview %}

[Trellix Endpoint Security (ENS)](https://www.trellix.com/products/endpoint-security/) protects servers, computer systems, laptops, and tablets against known and unknown threats. These threats include malware, suspicious communications, unsafe websites, and downloaded files. Trellix Endpoint Security enables multiple defense technologies to communicate in real time to analyze and protect against threats.

This integration ingests the following logs:

- **Threat Events**: This endpoint provides details about threat events triggered by Trellix Endpoint Security, including threat prevention, web control, firewall, and adaptive threat protection.

This integration provides enrichment and visualization for above mentioned event types. It helps to visualize detailed insights into security trends, threats, and policy violations through the out-of-the-box dashboards. Also, This integration provides out of the box detection rules.

## Setup{% #setup %}

### Generate API Credentials in Trellix Endpoint Security{% #generate-api-credentials-in-trellix-endpoint-security %}

1. Log in to the Trellix ePO Saas.
1. Navigate to the **[Client Credentials](https://uam.ui.trellix.com/clientcreds.html)** page.
1. Click **Add** at the top right of the page.
1. From the **Scopes** menu, select `epo.evt.r`, which is listed in front of `Events`.
1. Click **Create**.
1. Copy the `Client ID`, `Client Secret`, and `API Key`.

### Connect your Trellix Endpoint Security Account to Datadog{% #connect-your-trellix-endpoint-security-account-to-datadog %}

1. Add your Client ID, Client Secret, and API Key.

| Parameters    | Description                            |
| ------------- | -------------------------------------- |
| Client ID     | The Client ID of Trellix ePO SaaS.     |
| Client Secret | The Client Secret of Trellix ePO SaaS. |
| API Key       | The API Key of Trellix ePO SaaS.       |

1. Click the Save button to save your settings.

## Data Collected{% #data-collected %}

### Logs{% #logs %}

The Trellix Endpoint Security integration collects and forwards events related to threat prevention, web control, firewall, and adaptive threat protection to Datadog.

### Metrics{% #metrics %}

The Trellix Endpoint Security integration does not include any metrics.

### Events{% #events %}

The Trellix Endpoint Security integration does not include any events.

## Support{% #support %}

For additional assistance, contact [Datadog support](https://docs.datadoghq.com/help/).