Configure automatic triage throttling settings

Caution

Do not change the triage throttling settings without consulting Trellix Customer Support.

You can use the Automatic Triage Settings page to control whether the Endpoint Security (HX) appliance generates automatic triage collections when a widespread compromise or false positive is generating inordinate numbers of triage requests. Throttling settings allow you to specify the number of automatic triage requests that can be generated (request limit) and the time period (in seconds) during which they can be generated.

The following table lists the settings that you can configure on the Automatic Triage Settings page.

Global Triage Settings

Maximum Triages

Controls the maximum number of automatic triage collection requests created globally during a set time period. Valid time periods range from 0-604800 seconds. Valid request limits range from 0-65535 requests.

Controls the number of automatic triage collection requests created for unique agents during a set time period. Valid time periods range from 0-604800 seconds per agent. Valid request limits range from 0-65535 requests per agent.

Controls the number of automatic triage collection requests created for unique conditions occurring for an individual agent during a set time period. Valid time periods range from 0-604800 seconds per condition per agent. Valid request limits range from 0-65535 requests per condition.

Alert Type Specific Settings

Real-Time Detection (IOC)

Controls the number of automatic triage collection requests created for all indicator of compromise (IOC) rules during a set time period. Valid time periods range from 0-604800 seconds. Valid request limits range from 0-65535 requests.