The Sensor stores alerts internally until connection is restored. Trellix IPS classifies events and prioritizes to ensure the buffer is filled with the most meaningful events to an analyst.
The following table lists the number of alerts that can be stored locally on the Sensor.
Number | Alert Type |
|---|---|
100000 | Signature based alerts |
2500 | Throttled alerts (with source and destination IP information) |
2500 | Compressed throttled alerts (alerts with no source and destination IP information) |
2500 | Statistical or anomaly DoS |
2500 | Throttled DoS alerts |
1000 | Host sweep alerts |
1000 | Port scan alerts |
Once the connection from the Sensor to the Manager has been re-established, the queued alerts are forwarded up to the Manager. So the customer will retain them even in the event that connectivity is disrupted for some time.
If the buffer fills up before connectivity is restored, the Sensor will drop new alerts, but if blocking is enabled, the Sensor will continue to block irrespective of the Sensor's connectivity with the Manager.