McAfee

Before configuring anything in Bubble, verify that the Trellix ePO REST API is reachable from the public internet. Open a browser on any network not connected to your corporate VPN and navigate to https://your-epo-server:8443/trellix/epo/v2/system.ping (replace with your actual ePO hostname and port). If you see a JSON response like {"version":"..."}, the API is accessible. If the browser shows a connection timeout or certificate error, the networking prerequisite is not yet met. For connection timeouts: work with your IT infrastructure team to expose the ePO REST API port via a reverse proxy (nginx on a public server, or a Cloudflare Tunnel pointing to the internal ePO host). For certificate errors: the ePO server is using a self-signed or internal CA certificate that Bubble's API Connector will also reject — ask your IT team to either provision a public CA certificate (Let's Encrypt works for publicly accessible servers) or put the ePO API behind a reverse proxy that terminates TLS with a valid certificate. Note your ePO base URL including port: https://your-epo-hostname:8443/trellix/epo/v2. Also confirm whether you are on ePO 5.x (on-premise) or Trellix ePO Cloud — the endpoint paths and auth behavior may differ slightly between versions.

1// ePO REST API accessibility check
2// From a browser NOT on your corporate VPN, navigate to:
3// https://your-epo-server:8443/trellix/epo/v2/system.ping
4
5// Expected response if accessible:
6// { "version": "5.x.x", "status": "OK" }
7
8// Connection details to gather:
9// base_url = https://your-epo-server:8443/trellix/epo/v2
10// auth_endpoint = /auth/token
11// systems_endpoint = /system/query
12// threats_endpoint = /event/threat
13
14// SSL requirement: Bubble API Connector rejects these:
15//   - Self-signed certificates
16//   - Internal CA certificates not in public trust stores
17// Solution: public CA-signed certificate OR reverse proxy with valid cert
18
19// Network options for private-network ePO:
20//   Option A: nginx reverse proxy on a public server → forwards to internal ePO
21//   Option B: Cloudflare Tunnel (cloudflared) → no open firewall port needed
22//   Option C: Bubble Dedicated Cluster + VPN peering (enterprise scope)

Open your Bubble app editor → Plugins → API Connector → Add another API. Name the group 'Trellix ePO.' In the 'Root URL' field, enter your ePO base URL: https://your-epo-server:8443/trellix/epo/v2. Add a shared header: key 'Content-Type,' value 'application/json' (no Private checkbox). Do not add the Authorization header to the group level yet — the auth token must be fetched first and stored, and subsequent calls will use a dynamic header. Inside this group, add the first call: name it 'getEPOToken.' Set method to POST. Endpoint: /auth/token. In the Body section, set Body Type to 'JSON' and add the body: {"userId": "YOUR_EPO_USERNAME", "password": "YOUR_EPO_PASSWORD"}. Click the 'Private' indicator on the userId and password fields in the body (in Bubble's API Connector, you can mark individual body parameters as Private). Set 'Use as' to 'Action' (since this call is a login operation, not a data-retrieval call). Click 'Initialize call' — this fires the POST to ePO. If successful, ePO returns a JSON body containing a token field (the Bearer token string). If it returns a 401, verify the username and password. Click 'Save.'

1// Bubble API Connector — Trellix ePO group configuration
2{
3  "api_group_name": "Trellix ePO",
4  "root_url": "https://your-epo-server:8443/trellix/epo/v2",
5  "shared_headers": [
6    {
7      "key": "Content-Type",
8      "value": "application/json"
9    }
10  ]
11}
12
13// Call 1: getEPOToken
14{
15  "call_name": "getEPOToken",
16  "method": "POST",
17  "endpoint": "/auth/token",
18  "body_type": "JSON",
19  "body": {
20    "userId": "<private: your-epo-username>",
21    "password": "<private: your-epo-password>"
22  },
23  "use_as": "Action"
24}
25
26// Expected response from ePO /auth/token:
27// {
28//   "token": "eyJhbGciOiJSUzI1NiIsInR5cCI6...",
29//   "expires_in": 3600
30// }

The retrieved ePO Bearer token must be stored somewhere Bubble's subsequent API calls can read it as a dynamic parameter. Create a single-row Bubble data type to hold this token. Click Data → Data types → Add a new type → name it 'EPOToken.' Add two fields: 'token_value' (text) and 'fetched_at' (date). This data type should hold exactly one record at any time — the current valid token. Now configure strict privacy rules: click Data → Privacy → EPOToken. Remove any 'Everyone' rule. Add a single rule: Condition = Current User has role Admin → View all fields, Modify all fields. Under no circumstance should this data type be readable by non-admin users — the stored Bearer token grants access to the entire ePO system. Create the initial single-row record manually: go to Data → App data → EPOToken → Create new EPOToken → leave token_value empty for now (the first Backend Workflow run will populate it). Also go to Settings → API and ensure 'Enable Data API' is OFF so this record cannot be accessed via Bubble's public data endpoint.

1// Bubble Data tab — EPOToken data type
2// Data → Data types → EPOToken
3// Fields:
4// token_value  — text  (the Bearer token string from ePO)
5// fetched_at   — date  (when the token was last retrieved)
6
7// Data → Privacy → EPOToken rules:
8// Rule: Current User has role Admin → View all fields, Modify all fields
9// Default: No access (no Everyone rule)
10
11// Settings → API: Ensure 'Enable Data API' = OFF
12// (An enabled Data API could expose the EPOToken record to unauthenticated requests)
13
14// The EPOToken table will always contain exactly one row.
15// Initial row: created manually in Data → App data with empty token_value.
16// All subsequent updates come from the 'Refresh ePO Token' Backend Workflow.

Add the ePO system query calls inside the Trellix ePO API Connector group. Click 'Add call' and name the first call 'Query Systems.' Set method to POST. Endpoint: /system/query (verify the exact path from your ePO REST API documentation for your ePO version — paths may vary between ePO 5.x and Trellix ePO Cloud). Set Body Type to JSON with body: {"select": {"columns": ["EPOComputerProperties.ComputerName", "EPOComputerProperties.OSType", "EPOComputerProperties.LastUpdate", "EPOLeafNode.Tags", "EPOComputerProperties.AgentVersion"]}, "where": {"filter": {}}, "limit": 250}. Now add an Authorization header at the CALL level (not group level, since it needs the dynamic token value): key = 'Authorization,' value = 'Bearer ' + (result of: search for EPOToken:first item's token_value). In Bubble's API Connector, this dynamic value is expressed by clicking the parameter field and using the 'Get data from an external API' or 'Do a search for EPOToken's token_value' option to dynamically load the stored token. Set 'Use as' to 'Data.' Add a second call named 'Get Threat Events' — POST to /event/threat with a time-range filter in the body and the same dynamic Authorization header.

1// Bubble API Connector — 'Query Systems' call
2{
3  "call_name": "Query Systems",
4  "method": "POST",
5  "endpoint": "/system/query",
6  "headers": [
7    {
8      "key": "Authorization",
9      "value": "Bearer <dynamic: EPOToken first item's token_value>"
10    }
11  ],
12  "body_type": "JSON",
13  "body": {
14    "select": {
15      "columns": [
16        "EPOComputerProperties.ComputerName",
17        "EPOComputerProperties.OSType",
18        "EPOComputerProperties.LastUpdate",
19        "EPOComputerProperties.AgentVersion"
20      ]
21    },
22    "where": { "filter": {} },
23    "limit": 250,
24    "offset": 0
25  },
26  "use_as": "Data"
27}
28
29// 'Get Threat Events' call:
30{
31  "call_name": "Get Threat Events",
32  "method": "POST",
33  "endpoint": "/event/threat",
34  "body": {
35    "select": { "columns": ["AutoID", "ThreatName", "Severity", "DetectedUTC", "SystemName"] },
36    "where": {
37      "filter": {
38        "field": "DetectedUTC",
39        "operator": ">",
40        "value": "<dynamic: 24 hours ago timestamp>"
41      }
42    },
43    "limit": 100
44  },
45  "use_as": "Data"
46}

Create a Backend Workflow that fetches a fresh ePO token and stores it. Navigate to Backend Workflows in the Bubble editor (Starter plan required). Add a new API Workflow and name it 'Refresh ePO Token.' This workflow does two things: Step 1 — Call the 'getEPOToken' API Connector action. Step 2 — Make changes to EPOToken (the single-row record) setting token_value = Step 1's response token field, and fetched_at = Current date/time. Now schedule this workflow to run before the token expires. If your ePO token expires after 60 minutes (3600 seconds), schedule the refresh every 50 minutes (3000 seconds) to provide a safety buffer. From an app initialization workflow or a page-load workflow, add a 'Schedule API Workflow' action for 'Refresh ePO Token' recurring every 3000 seconds. Add a health check: create a separate Backend Workflow 'ePO Health Check' that reads the EPOToken's fetched_at field and sends an admin email alert if the token is more than 90 minutes old — this catches cases where the refresh workflow failed silently (for example, if the ePO server was unreachable during the refresh cycle).

1// Backend Workflow: 'Refresh ePO Token'
2// Navigate to: Backend Workflows section (Starter plan required)
3
4// Step 1: Call API connector action
5//   Call: Trellix ePO > getEPOToken
6//   (This POSTs credentials to /auth/token and returns the new token)
7
8// Step 2: Make changes to EPOToken
9//   Thing to change: Do a search for EPOToken > first item
10//   Changes:
11//     token_value = Result of step 1's token
12//     fetched_at  = Current date/time
13
14// Scheduling (from an app-startup or initialization workflow):
15// Action: Schedule API Workflow
16//   Workflow: Refresh ePO Token
17//   Scheduled time: Current date/time
18//   Recurs: Yes, every 3000 seconds (50 minutes)
19
20// Health check workflow: 'ePO Token Health Check'
21// Trigger: Scheduled (every 90 minutes, offset from refresh)
22// Step 1: Search for EPOToken:first item
23// Step 2: Only when Step1's fetched_at is more than 90 minutes ago:
24//         Send email to admin: 'ePO token refresh has not run in 90+ minutes'

Create a Bubble page named 'security-dashboard' visible only to admin users (set page access controls in the Bubble editor to require Current User has role Admin — Bubble checks this before rendering the page). Add summary metric cards at the top: total managed endpoints (count of Bubble EndpointRecord Things), endpoints with high-severity threat events in the last 24 hours (count of ThreatEvent Things where severity = 'High' and detection_timestamp > 24 hours ago), and last sync time (EPOToken's fetched_at formatted as 'Refreshed at HH:MM:SS'). Add a Repeating Group for endpoint inventory: Type = EndpointRecord, data source = search for EndpointRecord sorted by last_update descending. Cells show computer name, OS type, agent version, and a 'Last seen' relative timestamp. Add a second Repeating Group for threat events: Type = ThreatEvent, filtered to last 24 hours, sorted by severity. Add severity badges (red = High, orange = Medium, yellow = Low). Consider adding a 'Trigger Manual Sync' button for admins that runs the Backend Workflow immediately rather than waiting for the scheduled interval — useful when investigating a security incident. If you are building a production-grade Bubble security dashboard on ePO data and want architecture review, RapidDev's team has built enterprise internal tools of this complexity — schedule a free scoping call at rapidevelopers.com/contact.

1// Bubble data types for security dashboard:
2// EndpointRecord: computer_name (text), os_type (text),
3//                 agent_version (text), last_update (date), tags (text)
4// ThreatEvent:    threat_name (text), severity (text),
5//                 detection_timestamp (date), system_name (text),
6//                 auto_id (number)
7
8// Dashboard page access control:
9// Page settings → Visible when: Current User is logged in AND Current User has role Admin
10// (or redirect to login page using a redirect workflow on page load)
11
12// Summary cards — expressions:
13// Total endpoints:  Do a search for EndpointRecord:count
14// High threats 24h: Do a search for ThreatEvent where severity="High"
15//                   and detection_timestamp > Current date/time - 1440 minutes :count
16// Last sync:        Search EPOToken:first item's fetched_at (formatted)
17
18// Threat severity badge conditionals (on a Shape element):
19// When severity = "High"   → background #ef4444 (red)
20// When severity = "Medium" → background #f97316 (orange)
21// When severity = "Low"    → background #eab308 (yellow)
22
23// Manual sync button workflow:
24// On click: Schedule API Workflow 'Sync ePO Data' → run immediately (Current date/time)