Add Trellix ESM - ELS devices to the console, set up Trellix ESM - ELS storage and retention policies, and associate data sources with specific retention policies.
Set up and install virtual or physical devices.
From the Trellix ESM dashboard, click and select More Settings .
Add Trellix ESM - ELS devices to the console.
On the actions toolbar, click
.png "GUID-66CEDB9A-A83B-4A7F-AFF3-F5DB2E974859-low.png")
, then select Enterprise Log Search then click Next.Enter a unique device name, then click Next.
Enter the target IP address or URL, target SSH port number, and Network Time Protocol (NTP) settings for the device then click Next.
Enter a password for this device, then click Next.
Set up storage.
Note
Retaining uncompressed data speeds the Trellix ESM - ELS search capabilities, but it requires more storage space, such as hard drives or network storage.
Select Trellix ESM-ELS, click
.png "GUID-F191D568-8B93-4D2C-9BFC-F1342FC407BD-low.png")
, then click Data Storage.If using iSCSI, Trellix DAS, SAN, or virtual local drives, fill in the information in the top grid.
If using SAN, virtual local, NFS, iSCSI, or CIFS, click Add in the lower grid.
Enter the correct parameters and click OK.
Add retention policies (limited to no more than 6).
Note
To search Trellix ESM-ELS log data, you must have at least one retention policy. The system sets the first retention policy created as the default. If only one policy exists, you can change it but you can't delete it. The Trellix ESM-ELS accepts data up to six months older than the date that you created the first retention policy.
Select Trellix ESM-ELS, click
, then click Retention Policies.Click Add.
Specify the name and duration of the retention policy and click OK.
Note
The system stores duration in days. You can set up a duration in years (365 days), quarters (90 days), or months (30 days).
Associate data sources with retention policies.
Select the data source device (such as a Trellix Enterprise Security Manager - Event Receiver) and click
.Click Data Sources.
In the Logging column, choose the relevant checkbox to display the Log Data Options screen.
Select the retention policy you want to associate with this data source and click OK.
The Trellix ESM - ELS makes data available for searching.