Verify successful installation

Type status in the Sensor CLI.

The status report appears.

The Sensor parameter System Initialized should be yes, and for Manager communication Trust Established should be yes.

From the Manager Dashboard, view the Manager status in the System Faults monitor.

The Manager status displays as Up and Sensor status is Active.

From the Manager, click Devices → <Admin Domain> → Devices → Setup → Physical Ports to view the port details of the standalone Sensor.

Click Devices → <Admin Domain Name> → Devices → <Device Name> → Member Sensors → <Stackname-Node ID> → Setup → Physical Ports to view the port details of a Sensor in a stack.

A policy named Default Prevention is active upon the addition of the Sensor. To view this policy, select Policy → <Admin Domain Name> → Intrusion Prevention → Policy Types → IPS Policies.

The Default Prevention policy contains attacks already configured with a "blocking" Sensor response action. If any attack in the policy is triggered, the Sensor automatically blocks the attack. To tune this or any other Trellix-provided policies, you can clone the policy and then customize it as described in Trellix Intrusion Prevention System Product Guide.

Click Devices → <Admin Domain Name> → Devices → Setup → Physical Ports.

To view port settings, select the port on the Sensor that you cabled. Ensure that your port settings match the cabling. For example, if port 1 is cabled for inline mode, the mode of operation in the port setting should be inline mode.

Note

For more information on port settings, see the chapter Configuring the monitoring and response ports of a Sensor in Trellix Intrusion Prevention System Product Guide.