Trellix Enterprise Security Manager - Event Receivers collect and parse large amounts of security data from sources such as firewalls, virtual private networks (VPNs), routers, NetFlow, sFlow, and others.
Most of the parsing is done by the Advanced Syslog Parser (ASP), but a few other parsers process specific types of logs. In common usage, the term "parsing" means "ASP parsing" and "parsing rule" means "ASP parsing rule".
Once a receiver has parsed the data, it passes it to a Trellix ESM in the form of events, flows, and data source rules. Trellix ESM uses events and flows help you monitor activity in your environment. Data source rules are used to manage your assets in Policy Manager.
Receivers also send data to Trellix Enterprise Security Manager - Enterprise Log Manager and Trellix ESM - ELS devices.
High availability receivers
High availability receivers (Receiver-HA) can be used in primary and secondary mode, acting as backups for each other. The secondary receiver monitors the primary receiver continuously. New configuration or policy information is sent to both devices. When the secondary receiver determines that the primary receiver has failed, it disconnects the primary's data source NIC and takes over as the primary. It remains primary until you manually restore the failed receiver as primary.