How to Integrate Retool with McAfee (Trellix)

The Trellix ePO REST API uses bearer token authentication. You generate a token by posting your ePO credentials to the authentication endpoint, then include the returned token in all subsequent API requests. For ePO on-premises (version 5.10+), the token endpoint is typically at: POST /trellix/epo/v2/auth/token with a JSON body containing your username and password. For Trellix Cloud, the authentication endpoint follows the same pattern but uses your cloud ePO URL. Test this first using a REST client to confirm the endpoint is reachable and that your credentials are accepted. A successful response returns a JSON object containing a token string and expiry time. Note the token expiry — ePO tokens typically expire after a few hours, so you will need to handle token refresh in Retool either by re-running the auth query before each session or by implementing a scheduled Retool Workflow that refreshes the token and stores it in a Retool Configuration Variable. For Retool Cloud deployments where ePO is on-premises, ensure that Retool's egress IP ranges are whitelisted in your firewall rules for the ePO server's REST API port (default 8443). For self-hosted Retool inside the same VPC as ePO, this network step is unnecessary — Retool's backend will have direct connectivity to the ePO server's internal IP. Copy the base URL of your ePO REST API (e.g., https://epo.yourdomain.com:8443/trellix/epo/v2) — you will use this as the base URL for your Retool REST API Resource. Also note the exact format of the Authorization header the API expects, which is typically: Authorization: Bearer <token>.

1// Example: Fetch ePO bearer token via a JavaScript query (no resource needed)
2// Set this as a query that runs on page load, storing the token for other queries
3const response = await fetch('https://your-epo-server:8443/trellix/epo/v2/auth/token', {
4  method: 'POST',
5  headers: { 'Content-Type': 'application/json' },
6  body: JSON.stringify({
7    username: retoolContext.configVars.EPO_USERNAME,
8    password: retoolContext.configVars.EPO_PASSWORD
9  })
10});
11const tokenData = await response.json();
12return tokenData.token; // store as a state variable for use in other queries

Navigate to the Resources tab in Retool and click Add Resource. Select REST API from the resource type list. Configure the resource with the following settings: - Name: 'Trellix ePO' (or 'McAfee ePO' for clarity in your team) - Base URL: your ePO REST API base URL (e.g., https://epo.yourdomain.com:8443/trellix/epo/v2) For authentication, you have two options depending on your token strategy: Option A — Bearer Token (simpler, requires manual token rotation): Select 'Bearer Token' from the Auth dropdown and enter the bearer token you generated in Step 1. You will need to update this when the token expires. Option B — Custom Auth (recommended for production): Select 'Custom Auth' and configure a pre-request step that POSTs to the /auth/token endpoint, extracts the token from the response, and sets it as the Authorization header on all requests. This automates token refresh. Add a default header that applies to all requests: - Key: Content-Type - Value: application/json If your ePO server uses a self-signed SSL certificate (common in on-premises deployments), check the 'Disable SSL certificate verification' option under Advanced settings — note this reduces security and is not recommended for production. Alternatively, for self-hosted Retool, configure NODE_EXTRA_CA_CERTS to trust your internal CA. Click Save Changes. You should see the resource appear in your Resources list. Verify connectivity by creating a test query using this resource: set method to GET and path to /system/find or /system/findgroups — a valid ePO response confirms the token and URL are correctly configured.

The ePO REST API's system endpoints let you retrieve managed endpoint data including hostname, IP address, operating system, agent version, and last communication time. The primary endpoint for querying systems is typically GET /system/find with query parameters for filtering. Create a new query using the Trellix ePO resource: - Method: GET - Path: /system/find - URL Parameters: - searchText: {{ systemSearchInput.value || '' }} - orion.system.groupPath: {{ groupFilterSelect.value || '' }} The ePO API returns a JSON array of system objects. Each system object contains fields for hostname, IP address, OS type, agent GUID, agent version, last communication time, policy compliance status, and current threat detection count. The exact field names vary by ePO version — inspect the raw response in Retool's query panel to confirm the field names before binding to components. Write a JavaScript transformer attached to this query that formats the raw response into a clean array for the Table component. The transformer should parse date strings into readable formats, add a 'compliance_color' field (green/yellow/red) based on the policy compliance status value, and handle null or missing fields gracefully with default values. Drag a Table component onto your canvas and set its data source to {{ epoSystemQuery.data }} (or the transformer output). Configure columns for: Hostname, IP Address, OS, Agent Version, Last Check-In (formatted date), and Compliance Status. Set the Last Check-In column to highlight rows where the date is older than 7 days — these endpoints may be offline or not communicating with ePO.

1// JavaScript transformer for ePO system inventory response
2const systems = data || [];
3
4return systems.map(system => {
5  const lastComm = system.EPOComputerProperties?.LastUpdate
6    || system.lastUpdate
7    || null;
8  
9  const daysSinceComm = lastComm
10    ? Math.floor((Date.now() - new Date(lastComm)) / (1000 * 60 * 60 * 24))
11    : null;
12  
13  const complianceStatus = system.EPOLeafNode?.PolicyCatalogStatus
14    || system.policyStatus
15    || 'Unknown';
16  
17  return {
18    hostname: system.EPOComputerProperties?.ComputerName || system.hostname || 'Unknown',
19    ip_address: system.EPOComputerProperties?.IPAddress || system.ipAddress || '',
20    os: system.EPOComputerProperties?.OSType || system.osType || '',
21    agent_version: system.EPOComputerProperties?.AgentVersion || system.agentVersion || '',
22    last_checkin: lastComm ? new Date(lastComm).toLocaleString() : 'Never',
23    days_offline: daysSinceComm,
24    compliance_status: complianceStatus,
25    compliance_color: complianceStatus === 'In Compliance' ? 'green'
26      : complianceStatus === 'Out of Compliance' ? 'red' : 'yellow',
27    threat_count: system.EPOLeafNode?.DetectedThreatsCount || system.threatCount || 0
28  };
29});

The ePO REST API's threat event endpoints expose malware detections, intrusion prevention events, and other security alerts. The endpoint for retrieving threat events is typically GET /threat/find or GET /event/query, with parameters for filtering by date range, severity, and event type. Create a new query using the Trellix ePO resource: - Method: GET - Path: /threat/find (or the equivalent endpoint for your ePO version — check your ePO API documentation) - URL Parameters: - startTime: {{ dateRangePicker.startDate }} (ISO date string) - endTime: {{ dateRangePicker.endDate }} - severity: {{ severityFilter.value || 'high' }} (filter options: critical, high, medium, low) - limit: 200 The response is an array of threat event objects, each containing the source hostname, threat name, threat category (Trojan, Ransomware, etc.), detection time, severity level, and current status (Cleaned, Quarantined, Pending). Create a transformer that reshapes the response into a table-ready array and adds a severity sort order field (critical=1, high=2, medium=3, low=4) so the Table can be sorted by severity by default. Bind the transformer output to a Table component with columns for Hostname, Threat Name, Category, Severity, Detection Time, and Status. Add a Stat component above the Table showing the count of critical threats detected in the selected date range: {{ threatQuery.data.filter(t => t.severity === 'critical').length }}. This gives managers an at-a-glance health indicator before drilling into the full event list.

1// JavaScript transformer for ePO threat event response
2const threats = data || [];
3
4const severityOrder = { critical: 1, high: 2, medium: 3, low: 4, unknown: 5 };
5
6return threats
7  .map(threat => ({
8    hostname: threat.sourceHostName || threat.hostname || 'Unknown',
9    threat_name: threat.threatName || threat.name || 'Unknown Threat',
10    category: threat.threatCategory || threat.category || 'Unknown',
11    severity: (threat.severity || 'unknown').toLowerCase(),
12    severity_order: severityOrder[(threat.severity || 'unknown').toLowerCase()] || 5,
13    detected_at: threat.detectedUTC
14      ? new Date(threat.detectedUTC).toLocaleString()
15      : (threat.detectionTime ? new Date(threat.detectionTime).toLocaleString() : 'Unknown'),
16    status: threat.actionTaken || threat.status || 'Pending',
17    product: threat.detectedProduct || threat.product || ''
18  }))
19  .sort((a, b) => a.severity_order - b.severity_order);

Retool Workflows allow you to run automated server-side processes on a schedule. Configure a Workflow that queries ePO for new critical and high-severity threats detected in the last hour, then sends a summary notification to your team's communication channel (Slack, Microsoft Teams, or email). Navigate to Workflows in Retool and click New Workflow. Set up a Schedule trigger to run every 60 minutes. Add a Resource Query block using your Trellix ePO resource: - Method: GET - Path: /threat/find - Parameters: severity=critical, startTime set to one hour ago via JavaScript expression: new Date(Date.now() - 60*60*1000).toISOString() Add a JavaScript Code block after the ePO query that formats the results into a readable alert message. The block receives the ePO response as epoQuery.data and should extract the count and list of hostnames affected. Add a Branch logic block that only proceeds if the threat count is greater than zero (skip the notification if no new threats were found in the last hour). After the Branch, add a Resource Query block using your Slack or Teams resource to post the formatted message. For complex multi-source security workflows involving multiple ePO queries, SIEM correlations, and escalation logic, RapidDev can help architect and build your Retool security automation solution. Publish the Workflow by clicking Publish Release. Monitor the first few runs in the Workflow run history to verify that the ePO query returns data in the expected format and that notifications are formatted correctly.

1// JavaScript Code block in Retool Workflow
2// Runs after the ePO threat query block
3const threats = epoThreatQuery.data || [];
4const criticalThreats = threats.filter(t =>
5  ['critical', 'high'].includes((t.severity || '').toLowerCase())
6);
7
8if (criticalThreats.length === 0) {
9  return { shouldAlert: false, message: 'No critical/high threats detected in last hour.' };
10}
11
12const hostnames = [...new Set(criticalThreats.map(t => t.hostname || t.sourceHostName))]
13  .slice(0, 10)
14  .join(', ');
15
16const message = `🚨 ePO Threat Alert: ${criticalThreats.length} critical/high severity detection(s) in the last hour.\nAffected hosts: ${hostnames}${criticalThreats.length > 10 ? ` (+${criticalThreats.length - 10} more)` : ''}\nCheck the Retool security dashboard for full details.`;
17
18return { shouldAlert: true, message, count: criticalThreats.length };