Network Security and Email Security — Server appliances

Verify that the customer ID on the appliance matches the ID in the IAM Web UI.

Standalone appliances: Prevent the appliance from automatically connecting to the Trellix Helix-enabled cloud Central Management System appliance (if any).

Run the no cmc client enable command from the appliance CLI.

See Preventing connections to a cloud Central Management appliance.

Enable Trellix Helix mode on each appliance.

Run the helix mode on-premises command to enable Trellix Helix and allow Single Sign-On (SSO).

Run the helix mode on-premises with-sso command to enable Trellix Helix and enforce SSO.

See Enabling Helix Mode.

Central Management System-connected appliances: Ensure that alerts and health statistics are streamed directly to Trellix Helix and not through the Trellix Helix-enabled Central Management System appliance.

Run the show datastreaming helix command on each connected appliance and verify that the Helix data-streaming enabled field is yes.

Run the show helix health-stats status command on each connected appliance and verify that the Enabled field is yes.

Run the no fenet dti helix service override command on each appliance.

See Sending alerts and health status directly from appliances.

Configure the HelixConnect Client on each appliance.

The HelixConnect Client is enabled automatically when Trellix Helix mode is enabled, but additional steps may be required.

See Establishing HelixConnect connectivity.

If your appliances use an HTTP proxy for outbound communication: Enable the appliances to communicate with Trellix Helix through the proxy.

Run the helix proxy preference fenet-proxy command on the appliance.

See Enabling HTTP proxy communication.

Configure which alerts should trigger email notifications from Trellix Helix. Otherwise, you could be overwhelmed by notifications, especially if you push prior alerts as described in Verification.

Email Security — Server appliances only: Add the Trellix Helix sender address to the Allowed List on the appliance. Otherwise, additional Email Security — Server analysis will be performed on malicious links that might be included in Trellix Helix email notifications.