You can view details about how the campaign has affected the endpoint devices such as ENS and EDR and network devices such as IPS in your environment within the organization, as well as the event details associated with the device.
Log on to Trellix Insights.
Click
and select Campaigns. Go to the All Campaigns tab to view the list of campaigns. Alternatively, you can search a specific campaign by Campaign name. You can perform the following actions:Filter (
) campaigns by Severity, Labels, Profiles, Prevalent in selected sector, and Prevalent in selected country.Sort each column in the Campaigns table—such as Severity, Last Seen, Campaign Name, Sector, Country, and Threat Category.
View campaigns prevalent in selected sectors or countries.
Add campaigns to the Watch List.
Select the campaign, view the following details and take actions (if required).
Description - A brief description of the campaign.
Campaign Severity - Severity level of the campaign.
Impact Details - Displays whether your environment has detected the campaign.
Global Prevalence - List of sectors and countries affected by the campaign.
Labels - Labels are comprised of one or more categories of attack or threat actor.
Analyzed Indicators - Lists all analyzed IoCs for which campaign detection is possible.
Countermeasures - A set of effective countermeasures (if available) to remediate the attack.
Endpoint (analyzed indicators only) - Displays the number of campaign sightings or events based on their resolution within the organization.
Unresolved - A number of detections and devices where a campaign sighting or event has not been resolved by Trellix ENS.
Resolved - A number of detections and devices where Trellix ENS has resolved a campaign sighting or event.
Network - Displays the number of campaign sightings or events based on the IOC category and resolution within the organization.
Product - NSP
IOC category - View the category of the detection: URL, IP or Domain.
Unresolved detections - A number of detections and devices where a campaign sighting or event has not been resolved by Trellix IPS.
Resolved detections - A number of detections and devices where Trellix IPS has resolved a campaign sighting or event.
Content Package - View the number of devices based on their current AMCore Content (for Windows and Linux operating systems) version. Devices in red have insufficient coverage for the campaign. You can click How to update AMCore Content? to view details and links with instructions to improve your protection against this campaign.
Click View Details and go to the Your Environment page.
In the Your Environment page, view the following details:
Option
Description
Detection Timeline
The timeline illustrates the number of events associated with the campaign within the organization. To view events, you can:
Drag the timeline back and forth.
Scroll through the timeline.
Select the timeline (Last day , Last week, or Last month).
Your Endpoint Devices (ENS/EDR)
Select the following tabs to view a list of devices in your environment.
Devices Exposed — View devices where the campaign event is not remediated.
Devices with Insufficient Coverage — View devices that do not have the minimum AMCore Content version.
All Impacted Devices — View all devices that have IoCs for this campaign.
For each device, you can view the following details.
System Name — Click to view the system in the System Tree of ePO - SaaS for more details.
IP Address
Last communicated — the last time when the device communicated with Trellix ePO.
Current AMCore Content
Resolved Detections
Unresolved Detections
Last Detected — the last time the campaign was detected on this device.
Your Network Devices (Trellix IPS)
For each device, you can view the following details.
IOC Category which includes IP, URL, Domain, IP:Port, Hostname.
IOC Value
Total Detections
Resolved Detections
Unresolved Detections
Last Detected
View event details associated with your affected endpoint devices such as Trellix ENS or Trellix EDR and network devices such as Trellix ISP.