Set up receivers to create data sources automatically using pre-defined rules that come with the receiver or rules that you create.
Click the Get Events and Flows icon
.png "GUID-C73D838B-2B39-49A3-B992-83E05AECF050-low.png")
on the actions toolbar to pull events or flows.From the Trellix ESM dashboard, click and select More Settings .
On the system navigation tree, select the receiver, then click the Properties icon.
.png "GUID-F191D568-8B93-4D2C-9BFC-F1342FC407BD-low.png")
On the Receiver Properties page, click → .
On the Auto Learn page, click Configure.
On the Auto Add Rule Editor page, select Enable auto creation of data sources.
Click Add, then select the auto add rules you want the receiver to use to create data sources automatically.
To apply selected rules to the existing auto learned data, click Run Now.