The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Alert Settings

  • Published on Sep 11, 2026
  • 1 minute(s) read
Prev Next
Skip to main content

The Process Guard module can generate alerts for events on processes that access LSASS. To generate alerts, select the Enable Alerts for Process Guard Events checkbox. Enabling this option activates alerts on all unique events from an endpoint. If you also want to receive alerts for throttled events, select the Enable Alerts for Throttled Events checkbox. Alerts will be generated when the Endpoint Server receives events from an endpoint that has Event Throttling configured in agent policy section.

Note

The generation of alerts is not controlled by the enricher verdict. For more information about how to setup Process Guard before enabling alerts, see Detecting Processes Accessing LSASS.

Caution

Enabling alerts for throttled events can lead to a high volume of alerts. Make sure that correct exclusions are in place before enabling this setting.

Process Guard Settings

Throttle_Alerts3.PNG
Related articles
  • Detecting Processes Accessing LSASS
    Endpoint Security Modules (HX) > Process Guard > Endpoint Security Process Guard Module User Guide Release 1.7.0 > Installing the Process Guard Module‌
  • Alert settings
    Endpoint Security Modules (HX) > Process Tracker Module > Endpoint Security Process Tracker Module User Guide Release 1.3.166 > Configuring the Process Tracker module > Configuring the Process Tracker server module
  • Host Set Alert Details
    Endpoint Security Modules (HX) > Process Guard > Endpoint Security Process Guard Module User Guide Release 1.7.0 > Alerts‌