License keys are required for system operation. The Endpoint Security (HX) appliance requires three license keys:
FIREEYE_APPLIANCE—Required to register your system and use the product features. The Central Management System license has either the CMS or CMSHA product type. The CMSHA product type is used in High Availability deployments. Network Security appliances licensed in Release 7.7.1 or later can run in either the Power or Essentials product edition. Network Security appliances licensed before Release 7.7.1 run in the classic product edition. The licensed edition is shown in the appliance license details in the Web UI and CLI. Endpoint Security servers refer to this license as the Endpoint Security (HX) Essentials license.
FIREEYE_SUPPORT—Allows your system to receive software image updates and the latest guest images.
CONTENT_UPDATES—Allows your system to access the Dynamic Threat Intelligence (DTI) network, which provides the latest intelligence on advanced cyber attacks and malware callback destinations. This enables Trellix products to proactively recognize new threats and block attacks. There are two versions of the content update license:
The two-way sharing license provides your appliance with malware intelligence from the DTI network and shares data about malware analyzed by your appliance.
The one-way sharing license provides your appliance with malware intelligence, but no information is submitted to the DTI cloud.
The following licenses are optional:
IPS —Allows your appliance to use Trellix integrated Intrusion Prevention System features.
ATI —Allows your appliance to use Advanced Threat Intelligence features.
HX_ADVANCED —Allows access to Endpoint Security exhaustive Enterprise Search requests, data acquisition requests, and bulk acquisition endpoint requests via the API. This license is referred to as the Endpoint Security (HX) Power license. HXD (DMZ) appliances do not need an HX_ADVANCED license if the Endpoint Security (master) server associated with the DMZ server already has one.
MD_ACCESS—Allows Trellix products to connect to the Managed Defense VPN. Without this license, Managed Defense cannot manage the appliance.
AV_ENGINE_SOPHOS —Allows your appliance to use the integrated Sophos Engine to scan submitted malware samples. For details, see AV-Check.
DA_HANCOM —Allows your appliance to perform dynamic analysis of Hancom Office files.
Note
The functionality provided by optional licenses is disabled if the FIREEYE_APPLIANCE license is invalid.
If licenses have expired or will expire within 30 days, warnings are displayed on the Appliance License Settings page. For details, see Viewing License Notifications Using the Web UI.