The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Enable rules to audit log

  • Published on Sep 12, 2026
  • 1 minute(s) read
Prev Next

If the rule is turned on, an internal event is created.

  1. From the Trellix ESM dashboard, click menu.png.

  2. Click Policy Editor under System Settings.

  3. Click the <device> in the Rule Types pane.

  4. Click the Aggregation column for the rule and select on or off.

Related articles
  • Enable rules to audit log
    Enterprise Security Manager > Enterprise Security Manager 11.7.x > ESM 11.7.x Product Guide > PG - ESM - Tuning McAfee ESM > Tuning your ESM configuration > Audit logging
  • Add alarms to policy rules
    Enterprise Security Manager > Enterprise Security Manager 11.7.x > ESM 11.7.x Product Guide > Responding to threats > Alarms > Build specific alarms
  • Add correlation rules
    Enterprise Security Manager > Enterprise Security Manager 11.7.x > ESM 11.7.x Product Guide > Correlating data > Correlation rules