Before on-boarding endpoints, you should review the indicators provided with the module. These are discussed in Streaming Indicators and Conditions and Trellix Provided Indicators,
Depending on your needs, some set of indicators may be highly useful, while others may have too much detail or data volume. Trellix recommends reviewing these indicators in the context of your environment and detection goals. Reduce the set of rules enabled to minimum for an initial phase as you roll out to your endpoints. Take time to observe the telemetry provided. As you go further in understanding how useful this data is, you will be in a better position to decide what to adjust. As you enable more rules, do so in increments.