You can leverage the Trellix Wise feature in the Device Search to enhance threat analysis and refine search results for improved accuracy. Each tenant is allocated a predefined quota limit based on the Trellix Wise quota purchased for that specific tenant. See Quota Management System for details.
The Ask Wise functionality in the Device Search allows you to enter the details of a specific device, generating a list of results for the respective artifacts. This feature is limited to a single device/endpoint.
Note
For a conclusive analysis, it is recommended to filter the results based on the timestamp under the chosen artifacts.
How to perform analysis in Device Search using Ask Wise.
Tip
The Device Search pane can be accessed by selecting the option available under Threat Details on the Monitoring dashboard or from the Trellix EDR Menu.
Navigate to the Device Search from either the Monitoring dashboard or the Trellix EDR Menu and enter the details pertaining to the device under analysis.
The search results for the respective artifacts will be populated. Refine the search to the specific time frame when the threat occurred for more precise results.
Right-click on each row/event under the respective artifact and select Add to Wise Analysis which adds the event to the cart. Once you add the required events to the cart, click on Ask Wise. A navigation pane for analysis will then be displayed with the added events, on the right. You can minimize or expand the navigation pane while performing other analysis in the Device search without any loss of data.
Note
You can add a maximum of 25 events, regardless of the artifact chosen for analysis. Once you have added 25 events to the cart, a yellow prompt will appear, indicating that you have reached the maximum limit.
.PNG)
The system highlights the selected events under the heading of the respective artifact, and each selected event is shaded in grey to prevent users from selecting the same event more than once.
Note
The system prohibits duplicating events for analysis with Ask Wise. When a user selects events under a specific artifact, they are initially highlighted in grey. Upon navigating back to the same artifact after selecting a different one, it will be highlighted as shown.
.PNG)
You can deselect events in the navigation pane if you wish to analyze a different event instead.
After selecting the events, click Next. Select either Interactive mode or Dossier mode, and then click Triage. For more information about features of Interactive and Dossier mode, see Analyze threats with Generative AI.
Note
The default analysis mode is Interactive mode.
Each artifact has a set of predefined analysis options that you can employ based on the nature of the analysis. For a list of predefined analysis options for the artifacts, see Analysis Options for Artifacts under Search for historical data on a single endpoint.
You can provide feedback on the assistance received from the Trellix Wise service. The feedback system includes a rating option, allowing you to rate the support from 1 (poor service) to 5 (excellent service). Additionally, you can include constructive comments in the Additional Feedback section.