Trellix ePO - On-prem provides you the option to view Trellix IPS data on a dashboard.
This dashboard in Trellix ePO - On-prem provides the following monitors:
Attack Severity Summary
Device Fault Summary
Manager Fault Summary
Top 10 Attack Destinations
Top 10 Attacks
Top 10 Attack Sources
To view product data in Trellix ePO - On-prem, you need to install Trellix IPS extension file in Trellix ePO - On-prem.
When this Extension file is installed in Trellix ePO - On-prem, a default dashboard with the above monitors is created on Trellix ePO - On-prem Dashboards page. This dashboard displays information from Trellix IPS. Optionally, you can create new dashboards for Trellix IPS in Trellix ePO - On-prem.
A default server task is also created in Trellix ePO - On-prem, as part of the installation of the product extension. This server task needs to be configured for pulling in the relevant data from Trellix IPS. For more details, refer to the section Configure a server task for Trellix IPS in Trellix ePO - On-prem.
Data retrieval when the Trellix IPS Manager is in Manager Disaster Recovery (MDR) mode:
Consider the following scenarios when the Manager is in MDR mode:
If the Primary Manager is active, the data is retrieved from the Primary Manager to Trellix ePO - On-prem. In case the Primary Manager is in standby mode, and the Secondary Manager is active, data is retrieved from the Secondary Manager.
If both Primary and Secondary Managers are in standby mode, the data that was last available in the Primary Manager is retrieved to Trellix ePO - On-prem and displayed on the dashboard.
If both Primary and Secondary Managers are not available, the data is not retrieved to Trellix ePO - On-prem. In this case, all the dashboard data tables are cleared and empty dashboards are displayed in Trellix ePO - On-prem.