Sensors in Trellix IPS are MDR-aware. When Sensors first establish trust with the Manager, they query the Manager to find out if the Manager is part of an MDR pair. The Manager responds and, if it is part of an MDR pair, includes its current status (active or standby) and the IP of its peer Manager. The Sensor then establishes trust with the peer as well.
The Sensor sends alerts and packet logs to both the Managers. Real-time synchronization between the MDR pair ensures that the data present in the active mode is exactly mirrored in the standby. This ensures minimal loss of data if the active Manager goes down. Alerts and packet logs sent by the Sensor to the Manager can be viewed in the Attack Log page.
In addition to alerts, faults are also synchronized between the Managers. You can view all hosts, alerts, and packet log data in the Attack Log page.
If one of the Managers goes down, after it comes up, the other Manager will update the missed alerts and packet log data to the first Manager during synchronization.