About the Central Management System appliance

Rather than using several interfaces for multiple appliances, the Central Management System appliance streamlines the workflow by consolidating the functions of all managed appliances into a single interface—all individual or grouped appliances are fully configurable and operational from the Central Management System appliance. You can perform the following functions remotely from the Central Management System appliance on behalf of its managed appliances:

The Central Management System Dashboard provides tables, graphs, and charts that afford instant visibility into malware threats and appliance status. You can drill down to view details and take appropriate action. The pages you access from the Alerts tab in the Central Management System Web UI mirrors the comprehensive information available on the managed appliances about detected malware. As with the Dashboard, you can drill into this information for deeper forensic analysis.

You can use the following methods to send alerts to notification servers:

For details, see Managing the distribution of alert notifications.

Alerts in Central Management System are retained in the CM database as long as they are retained by the connected Trellix appliances. When the data is removed from the databases of connected Trellix appliances, it is removed from Central Management System. See the documentation for the connected Trellix appliances for details about their alert retention periods.

All results of malware detected by any managed appliance can be monitored by the Central Management System appliance. To offer advanced protection against spearphishing attacks and converged threats, the Central Management System appliance identifies correlations between email- and Web-based malware events. When characteristics of malware detected by a Network Security appliance are identified in an Email Security — Server event, the Central Management System appliance alerts users of a blended attack. For details, see Network Security and Email Security — Server Edition event correlation.

Locally generated malware profiles and detection information can be shared among appliances using the Central Management System appliance. Once malware is detected by one blocking appliance, its profile can be uploaded to other appliances in the network to make it easier to identify and protect against that threat in the future.

Malware detected by any managed appliance can be submitted from the Central Management System Web UI to the Malware Analysis appliance for deeper forensic analysis.

You can manage and monitor appliances individually or in groups. By default, a group is created for each product type when an appliance of that type is added to the Central Management System appliance. You can create custom groups and add appliances to them as needed.

The benefits of appliance groups include:

For details, see Grouping appliances.