Trellix Helix Enterprise is a cloud-based security operations platform that surfaces threats and empowers you to make expert decisions based on the latest front line intelligence.
Note
In this document, the name Helix Enterprise is used interchangeably with Helix Enterprise.
Helix Enterprise does the following:
Collects and indexes network, endpoint, and security events from your environment
Compares indicators in your events against Trellix intelligence in real time and generates alerts on hits
Supplies context with alerts based on what Trellix knows about an attack, along with third-party information
Applies both Trellix-defined rules and rules that you define to event data to generate alerts
Suggests steps for investigating alerts through Investigative Tips
Provides an incident workflow for tracking both events associated with alerts and any events that you deem suspicious from investigation to remediation
Makes events available for efficient searching and pivoting
Allows you to pivot to Trellix appliances (Endpoint Security (HX), Email Security - Cloud, Central Management) to continue research on a security event or to address the health of the appliance
Note
Screenshots in this guide may vary from the current Web UI. However, the functionality they illustrate remains the same.