Use watchlists to group rules that you can use as filters or alarm conditions that notify you when the rule occurs in an event. These watchlists can be global or specific to Trellix ESM users or groups.
Verify that you have administrator rights or belong to an access group with watchlist permissions.
In the Rule Types pane of the Policy Editor, select the rule type, then select the rules that you want to have on this watchlist.
Click Operations, then select the Create new watchlist option.
Type a name, then make sure the Static option is selected.
Select the type of data this watchlist is watching for, then select the assignee.
Note
A user with administrator privileges can assign a watchlist to anyone or any group on the system. If you do not have administrator privileges, you can only assign watchlists to yourself and groups you are a member of.
To add more values to the watchlist, do one the following:
To import a file of values in new-line-separated values format, click Import, then select the file.
To add individual values, type one value per line in the Values box.
Note
Maximum number of values is 1000.
After configuring watchlists, you can append rule values to specific watchlists.
Select the rules you want to append to the watchlist.
Click → .
Select the watchlist to append the rules and click OK.
To receive an alarm when a generated event contains any of the values on this watchlist, click Create Alarm.
Click OK.