Add event delta alarms

Out-of-sync data sources can generate events with timing issues. Set up event delta alarms to notify you of possible event timing issues.

Possible event timing issues can occur for several reasons:

Incorrect time zones are set for Trellix ESM or data sources.
Trellix ESM has been on for a long time and the timing slips out of sync.
Trellix ESM isn't connected to the Internet.
Events are out of sync when it comes into the Trellix Enterprise Security Manager - Event Receiver.

Note
When out-of-sync data sources generate events, a red flag appears next to its Trellix Enterprise Security Manager - Event Receiver on the system navigation tree.

From the Trellix ESM dashboard, click and select More Settings.
On the system navigation tree, select Trellix ESM and click .
Set up alarms when out-of-sync data sources generate events:
1. Click Alarms → Add.
2. Enter the information requested on the Summary tab and click the Condition tab.
3. Select Event Delta for the Type field.
4. Select how often Trellix ESM checks for out-of-sync data sources.
5. Select the time difference that must exist for the alarm to trigger.
6. Complete the information in the remaining tabs.
View, edit, or export the out-of-sync data sources:
1. On the system navigation tree, select the Trellix Enterprise Security Manager - Event Receiver and click .
2. Click Receiver Management → Time Delta.