When you enable Risk Advisor data acquisition on ePO - On-prem, the system generates a score list and sends it to any Trellix ESM - ACE Trellix Advanced Correlation Engine (ACE) used for scoring SrcIP and DstIP fields.
On the system navigation tree, select → , then click Enable.
Complete the configuration.
Click Manage ELM Logging to configure the default logging pool for the selected device. This option is only available if you have a Trellix Enterprise Security Manager - Enterprise Log Manager on Trellix ESM.
Assign the ePO - On-prem to a Zone .
Click Manual refresh device to refresh the list of applications from your ePO - On-prem device and build a client data source for each application.
To enable Risk Advisor data acquisition, click Enable MRA.
Assign a Priority to data from this device. When multiple devices report the same data, priority determines which data is kept.
To automatically refresh the list of applications from your ePO - On-prem device, select the frequency from the Schedule application refresh drop-down list.
Click OK.