Use watchlists as alarm conditions so that the alarm triggers when the system encounters an event that matches a value in the watchlist.
Verify that you have administrator rights or belong to an access group with alarm management permissions.
Verify that you have administrator rights or belong to an access group with watchlist permissions.
From the Trellix ESM dashboard, click
.png "menu.png")
and select System Properties.Click Alarms, then add an alarm.
On the Condition tab, find the → option and select if a watchlist contains the values for this alarm.
On the Actions tab, identify what happens to the watchlist you set as an alarm condition. You can append (add) or remove values in that watchlist.
Note
This action requires that you identify a watchlist using the Internal Event Match condition type.