Advantages

When the integration with Trellix NI enabled, you can have a high-level view of alert information from Manager, and net flow records and L7 metadata from Sensors, on Trellix NI. You can create multiple dashboards with different configurations on NI Web UI as per your requirement that allows you to track specific threat information affecting your network. NI Web UI also provides JSON file links and other filtering options for both alert data and netflows, thus allowing you to drill down on any network event, look for specific threat patterns, and perform correlation of attacks.

Trellix NI configuration options enable you to set alert severity thresholds and specify protocols the metadata of which you wish to review and analyze during investigation.

Using NI Web UI, you can create basic as well as advanced search queries with Boolean operators, terms, phrases, and special characters, that allow you quickly find useful information from the flow and alert data entries for a specific time period. You can further refine your search with the sorting and filtering options available in NI.

The alert data, flow data, and L7 metadata gathered by NI are displayed in convenient and highly customizable table formats which help you view and analyze the details in each data entry with ease.

You can view the alert and flow entries in multiple graphical formats, such as pie chart, bar graph and donut chart, via the widgets available in NI Web UI. You can review summarized versions of all alert data and flow data entries on NI and export the table content in a .CSV file for further analysis.

If Trellix IPS is integrated with any NI appliance connected to Packet Capture or PX appliance(s), you can perform reconstruction of single or multiple events with the flow records and alert data available on NI Event table. For more in-depth analysis, you can also download the packets of interest in the PCAP format directly from the PX Web UI or from the NI Web UI itself.