You can add a ePO - On-prem device to Trellix ESM, with its applications listed as secondary devices on the system navigation tree. Once authenticated, you can access functions from Trellix ESM, and assign ePO - On-prem tags to source or destination IP addresses directly and to events generated by alarms.
You must associate ePO - On-prem with the Trellix Enterprise Security Manager - Event Receiver because the events are pulled from the Trellix Enterprise Security Manager - Event Receiver, not ePO - On-prem.
Note
You must have read permissions on the master database and ePO - On-prem database to use ePO - On-prem.
If the ePO - On-prem device has a Trellix® Threat Intelligence Exchange (TIE) server, the system adds it automatically when you add the ePO - On-prem device to Trellix ESM.