When a riskware alert is generated in a Helix environment, the Network Security appliance automatically informs Helix about the alert and makes the alert information available to Helix. The appliance passes Helix a JSON object that contains key details about the alert and a link back to a file that the Network Security appliance stores for that alert.
Standalone appliances―When a riskware alert is generated by a standalone appliance deployed in Helix mode, the appliance passes the JSON object directly to Helix.
Centrally managed appliances―When a riskware alert is generated by a centrally managed appliance in Helix mode, the appliance sends the JSON object to Helix through the Helix Central Management System appliance.
This feature is automatically enabled when you enable riskware detection on Network Security appliances deployed in Helix mode.