Configuring the SmartVision event notification filter using the CLI

Follow these steps to configure the filter-by-severity criteria for SmartVision alerts distributed by Trellix event notification services.

Trellix event notification services and their service consumers are configured. For details, see the Network Security User Guide
Admin or Operator access to the SmartVision appliance.

To configure the severity used to filter Trellix event notifications for SmartVision alerts:

Log in to the appliance CLI and go to configuration mode:
```
hostname > enable
hostname # configure terminal
```
View the filter-by-severity setting for SmartVision alert distribution by Trellix event notification service.
In this example, the appliance can send Trellix event notifications for SmartVision events of all severity levels. This is the default setting.
```
hostname (config) show fenotify preferences
Notification customized settings:
.
.
.
Smart Vision Event Severity Filter Level: all
```
Configure the filter-by-severity setting for SmartVision alert distribution by Trellix event notification service. Use the following command:
```
fenotify preferences smartvision-event severity <severityRange>
```
Replace the <severityRange> variable with one of the following variables:
- minor―Distribute alerts for severities 1 – 3 only.
- major―Distribute alerts for severities 4 – 6 only.
- critical―Distribute alerts for severities 7 – 10 only.
- all―Distribute alerts of all severities.
This example limits the distribution of SmartVision alerts by Trellix event notification services to events with severities from 7 through 10.
```
hostname (config) # fenotify preferences smartvision-event severity critical
```

Verify your changes.

hostname (config) # show fenotify preferences