An event or flow can be generated thousands of times. Instead of recording and processing thousands of identical records, you can aggregate them and view them as a single event or flow with a count that indicates the number of times it occurred.
Aggregation uses less disk space on the Receiver and on the Trellix ESM because it eliminates the need to store each packet. You turn aggregation on or off in Policy Editor.
Source IP address and destination IP address
The source IP address and destination IP address "not-set" values or aggregated values appear as "::" instead of as "0.0.0.0" in all result sets. For example:
::ffff:10.0.12.7is inserted as0:0:0:0:0:FFFF:A00:C07(A00:C07is10.0.12.7).::0000:10.0.12.7would be10.0.12.7.
Aggregated events and flows
Aggregated events and flows use the first, last, and total fields to indicate the duration and amount of aggregation.
For example, if the same event occurred 30 times in the first 10 minutes after noon:
First time = 12:00 for the time of the event's first instance
Last time = 12:10 for the time of the event's last instance
Total = 30 for the number of occurrences
You can change the default event or flow aggregation settings for the device as a whole. For events, you can add exceptions to the device's settings for individual rules.
Aggregation retrieves records based on the events, flows, and logs retrieval setting. If it is set for automatic retrieval, the device compresses a record only until the first time Trellix ESM pulls it. If it is set for manual retrieval, a record compresses up to 24 hours or until a new record is pulled manually, whichever comes first. If the compression time reaches the 24-hour limit, a new record is pulled and compression begins on that new record.
WMI aggregation
WMI parsing has aggregation set differently than other parsers and will not create separate events with the same aggregation settings as ASP. When a Receiver gets WMI data, it creates events based on the SIGID, SourceIP, and SourceUser, not based on the standard aggregation that other parsers use. New events are aggregated into existing events when an aggregation period already has an event defined that matches the SIGID, SourceIP, and SourceUser.