Customize summary for triggered alarms and incidents

Allows you to select the data to include in the alarm summary and the incident summary of Field Match and Internal Event Match alarms.

From the Trellix ESM dashboard, click and select More Settings.
On the system navigation tree, select Trellix ESM and click .
Click Alarms, then click Add or Edit.
On the Condition tab, select the Field Match or Internal Event Match for Type.
On the Actions tab, select Create Case → Configure.
Select the fields to include in the incident summary and click OK.
On the Actions tab, select Custom alarm summary → Configure.
The Triggered Alarm Summary Configuration opens.
Click , then select the fields to include in the summary for the triggered alarm and click OK.
Enter the information requested to create alarms and click Finish.