Define inactivity threshold settings

When you set an inactivity threshold for a device, you are notified when no events or flows are generated in the specified time. If the threshold is reached, a yellow health status flag appears next to the device node on the system navigation tree. For child or client datasource, you can't set the inactivity threshold settings individually.

From the Trellix ESM dashboard, click and select More Settings .
On the system navigation tree, select the device and click .
On the device properties page, click Events, Flows and Logs → Inactivity Settings.
The Inactivity Threshold window opens.
Select the device, then click Edit.
For each device, set the inactivity threshold to be notified when a device has not received events or flows for the time period you specify.