Set up correlation alarms to include source events

To include source events information in alarm results, set up an Internal Event Match or Field Match alarm that uses a correlation event as the match.

From the Trellix ESM dashboard, click and select More Settings.
On the system navigation tree, select Trellix ESM and click .
Click Alarms.
Click the Settings tab and click Templates.
On the Template Management page, click Add, then enter the information requested.
In the Message Body section, place your cursor where you want to insert the tags, then click , and select Source Events Block.
Place your cursor inside the tags, click , and select the information you want to include when the correlation alarm triggers.

The following example shows what an alarm message template looks like when you insert fields for an event's source IP address, destination IP address, and severity:

Alarm: [$Alarm Name] Assignee: [$Alarm Assignee] Trigger Date: [$Trigger Date] Summary: [$Alarm Summary] [$REPEAT_START] Correlation SigID: [$Signature ID] Correlated Last Time: [$Last Time] [$SOURCE_EVENTS_START] Source Event Details: Last Time: [$Last Time] SigID: [$Signature ID] Rule Message: [$Rule Message] Severity: [$Average Severity] Src User: [$%UserIDSrc] Src IP: [$Source IP] Src Port: [$Source Port] Dst User: [$%UserIDDst] Dst IP: [$Destination IP] Dst Port: [$Destination Port] Host: [$%HostID] Command: [$%CommandID] Application: [$%AppID] Packet: [$Packet Data] [$SOURCE_EVENTS_END] [$REPEAT_END]

Note
If a correlated event does not trigger the alarm, the message does not include the data.