Enable Sensor CLI activity log events to the Manager

Trellix IPS allows you to view the Sensor CLI user actions, such as user login and command execution, on the Manager.

By default, this feature is disabled.

To enable activity log events from the Manager:

Select Devices → <Admin Domain Name> → Global → IPS Device Settings → Advanced Device Settings.
The Advanced Device Settings page appears.
In CLI options, go to CLI Activity Logging and select Log to Device Only, Log to Manager Only, or Log to Device and Manager.
Click Save.
To view Sensor CLI user activity log, see Trellix Intrusion Prevention System Product Guide.
To view Sensor CLI user activity report, see the section Generate User Activity Reports in Trellix Intrusion Prevention System Product Guide.