Follow Run your search through the Helix search API: a POST to https://apps.fireeye.com/helix/id/<instance-id>/api/v1/search with your API key in the x-fireeye-api-key header and the query in the body. Regional instances use their own hosts, such as helix.eu.fireeye.com. The results come back as JSON, and the original log line is kept in the raw message field.
Trellix Helix, formerly FireEye Helix and called Helix Enterprise in newer docs, combines log search with detection content. Prime Core has 18,667 detection rules for Trellix Helix, mapped to 632 MITRE ATT&CK techniques. Below is how to get events out, sanitize them, and investigate them for free in LogTotal.
Before you start
An API key. Create one in Trellix Identity and Access Management under API Keys, with the search scopes your query needs.
Your instance ID. It’s shown in the top-left corner of the Helix interface, and it goes into every API URL.
The query language. Helix uses TQL, which replaced MQL. Free-text terms without a field are matched against the raw message index. Build and test the query in the Helix search page first.
Export with the search API
HELIX="https://apps.fireeye.com/helix/id/<instance-id>"
curl -sS -X POST "$HELIX/api/v1/search" \
-H "x-fireeye-api-key: $HELIX_KEY" -H 'Content-Type: application/json' \
-d '{"query": "hostname:\"web-03\""}' \
> helix_web03_1019.json
Once you know the structure, flatten it to one event per line with jq -c, and pull out the raw field with jq -r when the source was text.
Upload, sanitize and review in LogTotal
- Upload. Open logtotal.com and drop in the file.
- Sanitize.
- Review.
What this looks like on real data.
When it goes wrong
| Symptom | Likely cause | Fix |
|---|---|---|
| 401 or 403 | Key missing scopes, or the wrong header | Check the key’s scopes; use x-fireeye-api-key |
| 404 | Wrong instance ID or regional host | Copy the instance ID from the UI; use your region’s host |
| Query error | MQL syntax in a TQL query | Rewrite it in TQL; test in the UI |
| Results cut short | Result limit | Split the time range |
FAQ
Is this the same as Trellix EDR search?
No. Trellix EDR has its own real-time search API. This guide covers Helix log search.
What about Helix alerts?
Alerts have their own endpoint (/api/v3/alerts). For LogTotal, export the events behind them.
