Add a Trellix Enterprise Security Manager - Advanced Correlation Engine device

Set up a Trellix ESM - ACE to receive events from a Receiver. It is recommended to use a dedicated Trellix ESM - ACE device as it significantly impact on system resources.

Set up and install virtual or physical devices.

Note

Each correlation manager must be configured with a filter that defines a range of device IDs for that manager. Use only the In operator to define the device range.

From the Trellix ESM dashboard, click and select More Settings .
Add a Trellix ESM - ACE.
1. On the left pane, click .
2. Select Trellix Enterprise Security Manager - Advanced Correlation Engine and click Next.
3. Enter a unique Device Name and click Next.
4. Enter the Target IP Address or URL.
5. If required, change the default settings of Target SSH Port, Databus Management Port, Databus Data Port and Use ESM NTP settings.
6. Click Next.
7. Enter and confirm the new password for this device and click Next.
(Optional) Configure the ACE by editing the parameters in the ACE Configuration tab.
Add a correlation rule. See the Trellix Enterprise Security Manager Product Guide for more information.