The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Event forwarding

  • Published on Sep 12, 2026
  • 2 minute(s) read
Prev Next

Event forwarding allows you to send events from Trellix ESM to another device or facility.

You can send the data via Syslog to a third-party application, to storage, or even to the receiver of another Trellix ESM. Control which data is sent via a filter. Obfuscate IP address data to protect data privacy.

From Trellix ESM version 11.6.2 or greater, events are forwarded from each clustered TESM appliance. This reduces the load on the primary appliance and increases overall forwarding performance. Event forwarding configuration changes are propagated to any non-management TESM appliances by the nsync process; changes will take affect when the next nsync thread completes.

Note

Contact support if one or more TESMs in the cluster cannot be made to communicate with the Event Forwarding destinations.

Important changes for TESM 11.6.2:

  • Legacy formats have been consolidated into CEF (Common Event Format) and SEF (Standard Event Format). All other formats will be converted to these two formats on upgrade.

  • The Source field has been added to select between Events and Logs. Source field cannot be changed after a forwarder is created.

  • Send Packet option has been removed.

  • Legacy Time format has been removed.

  • The 10-device filter limit for an Event Forwarder has been removed.

  • Local relay port is now handled internally.

System profile types for event forwarding

Two System Profile types are usable for Event Forwarding:

  • Event Forwarding - This profile specifies all the traditional destination settings seen in the Event Forwarding dialog other then mode/username.

  • Remote Share - This profile specifies a remote share connection type and all of its specific connection requirement information. Event Forwarding will send up to 50,000 syslogs per file or 1 file every 5 minutes.

    Important

    Event forwarding using a Remote Share profile could use all available space on the remote share if left unattended.

Two transport protocols can be used when configuring event forwarding in the TESM.

  • UDP protocol - UDP is the standard that syslog is based on. UDP is a connectionless protocol and sends packets without verifying connectivity or success.

  • TCP protocol - TCP syslog packets are formatted exactly like their UDP counterparts including facility, severity, and message. The only exception is a new line character (ASCII character code 10) appended to the end of the message. TCP is not connectionless, and a connection must be established between Trellix ESM and the destination server. If a connection can't be established or is dropped, Trellix ESM tries to re-establish the connection. When re-established, Trellix ESM picks up the forwarding event where it left off.

: