The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Manage auto-learned data source rules

  • Published on Sep 12, 2026
  • 1 minute(s) read
Prev Next

View and change auto-learned data source rules.

  1. On the Policy Editor, select Receiver → Data Source.

  2. On the Filters/Tagging pane, click the Advanced bar at the bottom of the pane.

  3. On the Origin drop-down list, select user-defined, then click the Run Query icon GUID-9E27FAD7-66B6-444F-A303-6A2D91FAFBD1-low.png.

  4. Select the rule you want to change or delete, click Edit, then select Modify or Delete Auto Learned Rules.

    • If you selected Modify, change the name, description, or normalized ID, then click OK.

    • If you selected Delete Auto Learned Rules, select the correct option, then click OK.

:
Related articles
  • Manage auto-learned data source rules
    Enterprise Security Manager > Enterprise Security Manager 11.6.x > ESM 11.6.x Product Guide > Defining policies and rules > Rules > Trellix ESM rule types > Data source rules
  • Manage rules
    Enterprise Security Manager > Enterprise Security Manager 11.7.x > ESM 11.7.x Product Guide > Defining policies and rules > Rules
  • Manage rules
    Enterprise Security Manager > Enterprise Security Manager 11.6.x > ESM 11.6.x Product Guide > Defining policies and rules > Rules