The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Press CTRL+K to open search

Configure Risk Advisor

  • Published on Sep 12, 2026
  • 1 minute(s) read
Prev Next

When you enable Risk Advisor data acquisition on ePO - On-prem, the system generates a score list and sends it to any Trellix ESM - ACE Trellix Advanced Correlation Engine (ACE) used for scoring SrcIP and DstIP fields.

  1. On the system navigation tree, select ePO Properties → Device Management, then click Enable.

  2. Complete the configuration.

    1. Click Manage ELM Logging to configure the default logging pool for the selected device. This option is only available if you have a Trellix Enterprise Security Manager - Enterprise Log Manager on Trellix ESM.

    2. Assign the ePO - On-prem to a Zone .

    3. Click Manual refresh device to refresh the list of applications from your ePO - On-prem device and build a client data source for each application.

    4. To enable Risk Advisor data acquisition, click Enable MRA.

    5. Assign a Priority to data from this device. When multiple devices report the same data, priority determines which data is kept.

    6. To automatically refresh the list of applications from your ePO - On-prem device, select the frequency from the Schedule application refresh drop-down list.

  3. Click OK.