> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Activity Feed Configuration

Create an activity feed configuration that streams the EDR events of a topic to an external destination.

**Note:** A topic can only be registered with one destination.

> [!NOTE]
>
> External Documentation
>
> To learn more, visit the [Trellix EDR documentation](https://docs.trellix.com/bundle/mvision-endpoint-detection-and-response-product-guide/page/UUID-067dfc82-46b8-e2b5-5a37-ed9e86c032d3.html).

## Parameters

| Parameter | Description |
| - | - |
| AWS Region | The AWS region of the S3 bucket. |
| Certificate Data | The base64-encoded contents of the `server-cert.pem` certificate generated during the Syslog setup. **Note:** Provide the entire certificate details, including `--BEGIN--` and `--END--`, for both single and multi-chain certificates. |
| Client Email ID | The client email address to associate with the activity feed configuration. |
| Configuration Type | The type of the destination to stream the events to. |
| Custom Headers | A JSON object of the custom headers to send with the webhook requests. **For example:** <pre>`{  "key": "value"}`</pre> |
| Enable Compressed Output | Select to compress the streamed output. |
| Role ARN | The ARN of the cross-account IAM role that grants access to the S3 bucket. |
| S3 Bucket Name | The name of the S3 bucket to stream the events to. |
| S3 Prefix | The prefix path to write the events under. When omitted, the events folder is created in the root folder of the bucket. |
| Syslog Server IP | The IP address of the Syslog server to stream the events to. |
| Syslog Server Port | The port of the Syslog server. |
| Syslog Test Message | A test message for the Syslog destination. |
| Topic | The type of the events to stream. |
| Type | The type of the resource in the request body. |
| Webhook Test Message | A test message for the webhook destination. |
| Webhook URL | The URL of the webhook to stream the events to. Must present a CA-signed certificate, self-signed certificates are blocked. |

## Example Output

```json theme={"dark"}
{
	"jsonapi": {
		"version": "1.0"
	},
	"meta": {
		"totalResourceCount": 1
	},
	"data": {
		"id": "ce5cdfff-7818-455a-bc60-841be3513f4a",
		"type": "activityFeed",
		"attributes": {
			"topic": "threatEvents",
			"clientEmailId": "example@gmail.com",
			"configType": "s3Config",
			"enableCompressedOutput": "true",
			"s3Config": {
				"s3Prefix": "/prefix",
				"roleARN": "arn:aws:iam::91574147XXX:role/EAF_S3CrossAccountAccess",
				"s3BucketName": "example-bucket",
				"awsRegion": "us-west-2"
			}
		}
	}
}
```

## Workflow Library Example

[Create Activity Feed Configuration with Trellix Edr and Send Results Via Email](https://library.blinkops.com/workflows/create-activity-feed-configuration-with-trellix-edr-and-send-results-via-email)

![Workflow Library](https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max\&auto=format\&n=ojHYuDeYX5FWuN8a\&q=85\&s=b8af968e71438a9499c3223c9bd29fb2)

Preview this Workflow on desktop

[https://library.blinkops.com/workflows/create-activity-feed-configuration-with-trellix-edr-and-send-results-via-email/canvas](https://library.blinkops.com/workflows/create-activity-feed-configuration-with-trellix-edr-and-send-results-via-email/canvas)