Configure notifications

You can configure alerts or automatic responses to receive a notification when data congestion begins for your environment.

To receive a notification when congestion begins for your setup, you can configure an alert for the Data Congestion Detected event. Similarly, to receive a notification when data is deleted from the Trellix ePO - On-prem database to resolve congestion, you can configure an alert for the Clogged Data Deleted event.

1. Select Menu → Automation → Automatic Responses.
2. Click Actions → New Response, then enter the alert name.
3. Select the ePO Notification Events group and Threat event type.
4. Select Enabled, then click Next to open the Filter page.
5. Select My Organization for the Defined at property, then Select Threat Name from the Available Properties pane.
6. Include this information in the Value field:
   1. Type DATA_CONGESTION_DETECTED and click +.
   2. Type CLOGGED_DATA_DELETED and click Next.
7. Specify aggregation details, then click Next to open the Actions page.
8. Select Send Email, specify the email details, and click Next to open the Summary page, then review the details and click Save.