Follow these steps on the Network Sentry so that the appliance can push syslog events to Trellix Helix:
Navigate to System>Settings>Log Receivers.
Add a Log Receiver and select or set the following information:
Type: CEF
IP Address of the Comm Broker
Navigate to Logs>Event Management.
For each event type that is to be logged with Trellix Helix, set the Event Log to either:
“Log External
Log Internal & External
Note
Some events are generated frequently and may not be necessary for day-to-day operations. Review the list of events to determine which ones will provide the most useful feedback, and then enable them. You may also choose to enable an event for a short period of time only, such as to find a particular host when it connects to the network.