If custom fields pull numeric data from a source, you can accumulate several events together and average their value or generate a trending value.
From the Trellix ESM dashboard, click and select More Settings .
From the Trellix ESM dashboard, click and select More Settings .
Click Database, then click Settings.
Select an accumulator field from the Available drop-down list.
Select the fields you want and move them to Enabled.
Select whether to accumulate from the present time or to rebuild past data from a date you specify.
Note
The system indexes all ports and MAC addresses by default.