How it works
Initialize-C2CCredentials prompts for the Security Center and ePO service accounts, tests both logins before saving anything, then protects the credentials with Windows DPAPI. The data folder is restricted to the account that initialized it, SYSTEM, and local administrators.
Install-C2CScheduledTask verifies the same account can decrypt the saved credentials, then registers a task that runs whether or not anyone is logged in. The default interval is hourly, configurable from every 15 minutes to once per day. Runs do not overlap, and hung runs are terminated.
Installation starts in preview mode. Every endpoint the bridge would touch is shown and logged. After review, the same deployment can be switched to apply mode to begin live containment.
C2C-Bridge queries active Tenable Security Center findings for a configurable list of plugin IDs. The list is stored in a text file, so changing what is watched does not require redeploying the bridge.
Findings that carry accepted-risk status in ACAS are skipped. Existing risk decisions remain authoritative instead of being overridden by automation.
Each finding is correlated to Trellix ePO using exact MAC address matching. The bridge does not fall back to IP address or hostname, reducing the chance of containing the wrong endpoint when addresses or names change.
Servers, domain controllers, unmanaged systems, and ambiguous matches are logged and skipped. Only endpoints that meet the workstation criteria are eligible for automatic action.
C2C-Bridge applies an ePO tag. A Trellix Policy Assignment Rule maps that tag to a locked-down Endpoint Security Firewall policy; the script never edits the policy itself. Release occurs only after two consecutive clean runs. If ACAS or an API is unavailable, the run stops before release logic so an outage cannot clear containment across the environment.