When the Trellix Agent communicates with the server for the first time, the server uses an algorithm to place the system in the System Tree. When it cannot find an appropriate location for a system, it puts the system in the Lost and Found group.
On each agent-server communication, the server attempts to locate the system in the System Tree by Trellix Agent GUID. Only systems whose agents have already called into the server for the first time have a Trellix Agent GUID in the database. If a matching system is found, it is left in its existing location.
If a matching system is not found, the server uses an algorithm to sort the systems into the appropriate groups. Systems can be sorted into any criteria-based group in the System Tree, as long as each parent group in the path does not have non-matching criteria. Parent groups of a criteria-based subgroup must have no criteria or matching criteria.
The sorting order assigned to each subgroup (defined in the Group Details tab) determines the order that the server considers subgroups for sorting.
The server searches for a system without a Trellix Agent GUID (the Trellix Agent has never before called in) with a matching name in a group with the same name as the domain. If found, the system is placed in that group. This can happen after the first Active Directory or NT domain synchronization, or when you have manually added systems to the System Tree.
If a matching system is still not found, the server searches for a group of the same name as the domain where the system originates. If such a group is not found, one is created under the Lost and Found group, and the system is placed there.
Properties are updated for the system.
The server applies all criteria-based tags to the system if the server is configured to run sorting criteria at each agent-server communication.
What happens next depends on whether System Tree sorting is enabled on both the server and the system.
If System Tree sorting is disabled on either the server or the system, the system is left where it is.
If System Tree sorting is enabled on the server and system, the system is moved based on the sorting criteria in the System Tree groups.
Note
Systems that were added using Active Directory or NT Domain synchronization have System Tree sorting disabled by default. With System Tree sorting disabled, systems are not sorted on the first agent-server communication
The server considers the sorting criteria of all top-level groups according to the sorting order on the My Organization group’s Group Details tab. The system is placed in the first group with matching criteria or a catch-all group it considers.
Once sorted into a group, each of its subgroups is considered for matching criteria according to their sorting order on the Group Details tab.
Sorting continues until there is no subgroup with matching criteria for the system, and is placed in the last group found with matching criteria.
If such a top-level group is not found, the subgroups of top-level groups (without sorting criteria) are considered according to their sorting.
If such a second-level criteria-based group is not found, the criteria-based third-level groups of the second-level unrestricted groups are considered.
Note
Subgroups of groups with criteria that doesn't match are not considered. A group must have matching criteria or have no criteria for its subgroups to be considered for a system.
This process continues down through the System Tree until a system is sorted into a group.
Note
If the server setting for System Tree sorting is configured to sort only on the first agent-server communication, a flag is set on the system. The flag means that the system can never be sorted again at agent-server communication unless the server setting is changed to enable sorting on every agent-server communication.
If the server cannot sort the system into any group, it is placed in the Lost and Found group within a subgroup that is named after its domain.