Notify users of an event or flow that they might want to investigate. An alarm is composed of two parts - the conditions that trigger it and the actions that Trellix ESM takes when the alarm is triggered.
Build alarms
Before you create alarms, make sure that your environment contains the following building blocks:
Alarm message templates
Message recipient groups
Mail server connection
Alarm audio files
Alarm reports queue
Visible alarms pane on the dashboard
Tip
Numerous alarms that trigger frequently can create distracting noise for analysts. Focus on creating alarms that escalate only critical events.