Trellix Enterprise Security Manager - Event Receivers enable you to collect activity logs from devices on your network. Receivers then parse the data into events, flows, and data source rules.
Data types
Types of collected data include:
Raw Logs — Records of activities on the assets (devices) connected to your network. Daemons running on assets log device activity to a log. The log is sent (or pulled) to the Receiver for parsing and storage. Raw logs are stored as received for compliance and historical searching.
Events — Records of activities on your network devices you want to record because they could help in identifying or hunting threats. An event is generated when a log, collected from a data source, matches a parsing rule.
Flows — Records of connections made between two IP addresses. Flows can be used to detect or investigate potential threats (because of data that might have been accessed or because of anomalous connections). Some flows are related to events via their IP addresses.
Data Source Rules - Unique identifiers for specific events occurring on specific devices.
System Logs and Device Logs - Records of activity on your SIEM system (devices and software), such as logons and configuration changes.
Events and flows are the most common type of data you use. They have common attributes:
Source and destination IP addresses
Ports
MAC addresses
Protocol
First and last time
They also have differences:
Because flows do not indicate anomalous or malicious traffic, they are more common than events.
Events are associated with rule signature (SigID); flows are not.
Flows are not associated with event actions, such as alerts, drops, and rejects.
Flows have source bytes and packets (the number of bytes and packets transmitted by the source) and destination bytes and packets (the number of bytes and packets transmitted by the destination).
Flows have direction: Inbound flows originate from outside of the HOME_NET. Outbound flows originate from inside the HOME_NET.
Trellix ESM data storage
Data sent to the Trellix ESM from a Receiver is stored in partitions to improve query speed.
By default, queries are performed against newer data, which is usually the subject of threat hunting. Queries can also be performed across other partitions to search older data, but this is slower.
As Trellix ESM storage space fills, older partitions are automatically deleted unless you set up an archive storage location - a DAS, for example.
The data retention limit controls how long parsed data is retained. An old partition is deleted when the newest data in that partition reaches the data retention limit.