The Trellix CM connector is designed to attach to a single Trellix CM instance. The connector pulls alerts from your Trellix CM instance and uploads the data as indicators and events to ThreatQ.

The events are tagged as Malware type events.

The connector also uploads indicators from a provided ThreatQ data collection to Trellix CM. You can submit multiple data collections by providing comma-separated lists.

Note:  The Trellix CM connector replaces the FireEye CMS connector as of version 3.4.2.