You can specify multiple ePO - On-prem servers from which to acquire Risk Advisor data. The data is acquired through a database query from the ePO - On-prem SQL Server database.
The database query results in an IP versus reputation score list, and constant values for the low reputation and high reputation values are provided. The system merges all ePO - On-prem and Risk Advisor; duplicate IPs receive the highest score. The system sends the merged list, with low and high values, to any Trellix ESM - ACE devices used for scoring SrcIP and DstIP fields.
When you add ePO - On-prem, the system prompts whether you want to configure Risk Advisor data. If you click Yes, the system creates and rolls out a data enrichment source and two Trellix ESM - ACE scoring rules (if applicable). If you want to use the scoring rules, you must create a risk correlation manager.