Add rule correlation manager to enhance threat detection through real-time analysis, pattern identification, and proactive security monitoring.
Verify that Trellix ESM - ACE or Trellix Enterprise Security Manager - Enterprise Log Manager devices exist on Trellix ESM.
Make sure that storage pools exist on the Trellix Enterprise Security Manager - Enterprise Log Manager.
Make sure zones exist.
From the Trellix ESM dashboard, click
.png "menu.png")
and select More Settings.On the system navigation tree, select Trellix ESM - ACEand click
.png "Settings.png")
.Select Correlation Management and click Add.
In the manager type, select Rule Correlation.
On the Main tab, enter the manager name and enable it.
Trellix ESM collects both event and flow data.
Indicate whether to send event or flow data to the Trellix ESM - ACE device (the default is to send event data only).
Select Enable ELM Logging to save the logs on the Trellix Enterprise Security Manager - Enterprise Log Manager. Identify the storage pool on the Trellix Enterprise Security Manager - Enterprise Log Manager where you want the system to save the logs.
If you want the data to be assigned to a zone, select it from the drop-down list.
Select the amount of time that the rule correlation allows for events to be out of order. For example, if you set up 60 minutes, the system can use an event that is 59 minutes late.
Select Case Sensitive or Case Insensitive from the Default String Compare drop-down list.
Note
Case Sensitive is the default global setting in the rule correlation manager.
On the Filters tab, use logic elements and components to set up filters.
Click Finish, then click Write to write the managers to the device.