ePO - On-prem provides you the option to view Trellix IPS data on a dashboard.
This dashboard in ePO - On-prem provides the following monitors:
Attack Severity Summary
Device Fault Summary
Manager Fault Summary
Top 10 Attack Destinations
Top 10 Attacks
Top 10 Attack Sources
To view product data in ePO - On-prem, you need to install Trellix IPS extension file in ePO - On-prem.
When this Extension file is installed in ePO - On-prem, a default dashboard with the above monitors is created on ePO - On-prem Dashboards page. This dashboard displays information from Trellix IPS. Optionally, you can create new dashboards for Trellix IPS in ePO - On-prem.
A default server task is also created in ePO - On-prem, as part of the installation of the product extension. This server task needs to be configured for pulling in the relevant data from Trellix IPS. For more details, refer to the section Configure a server task for Trellix IPS in ePO - On-prem .
Data retrieval when the Trellix IPS Manager is in Manager Disaster Recovery (MDR) mode:
Consider the following scenarios when the Manager is in MDR mode:
If the Primary Manager is active, the data is retrieved from the Primary Manager to ePO - On-prem. In case the Primary Manager is in standby mode, and the Secondary Manager is active, data is retrieved from the Secondary Manager.
If both Primary and Secondary Managers are in standby mode, the data that was last available in the Primary Manager is retrieved to ePO - On-prem and displayed on the dashboard.
If both Primary and Secondary Managers are not available, the data is not retrieved to ePO - On-prem. In this case, all the dashboard data tables are cleared and empty dashboards are displayed in ePO - On-prem.