Trellix Insights allows you to analyze a campaign in your environment that requires immediate attention and take the necessary steps to remediate it.
The following criteria indicate that a campaign requires attention:
A campaign has been observed on a device within the organization and Trellix Endpoint Security (ENS) was not able to remediate the threat.
If there are any unresolved events from network security devices such as Intrusion Prevention System (IPS) and endpoint security devices such as ENS.
AMCore Content detected on one or more devices is out of date and unable to protect against one or more campaigns known to Insights.
Note
When a campaign is detected in devices due to insufficient coverage or outdated AMCore content versions, you can exclude those devices by creating an exclusion and improve the posture score. These campaigns are not listed in the Requiring Attention category.
A campaign does not appear here if an IoC was detected on a device in an organization but was successfully remediated.
Log on to Trellix Insights.
Click
and select Campaigns. The list of campaigns that requires attention are displayed under the Requiring Attention tab. Alternatively, you can search a specific campaign by Campaign name. You can perform the following actions:Filter (
) campaigns by Severity, Labels, Profiles, Prevalent in selected sector, and Prevalent in selected country.Sort each column in the Campaigns table—such as Severity, Last Seen, Campaign Name, Sector, Country, and Threat Category.
Sort high priority campaigns based on the number of events containing IOCs with a risk score higher than your threshold. For more information, see Analyze high priority campaigns using Risk Scores in Trellix Insights.
View campaigns prevalent in a sector, country and worldwide. You cannot select a sector or country but can only view the campaigns list based on the sector or country selected in the All Campaigns tab.
Add campaigns to the Watch List.
Select the campaign, view the following details and take actions (if required).
Why requiring attention - The reason for adding a campaign to the list of Requiring Attention. A campaign requires immediate attention if there are any unresolved events or the device does not have the updated AMCore content version. This must be resolved immediately to remediate the campaign attack.
Description - A brief description of the campaign.
Campaign Severity - Severity level of the campaign.
Impact Details - Displays whether your environment has detected the campaign.
Global Prevalence - List of sectors and countries affected by the campaign.
Labels - Labels are comprised of one or more categories of attack or threat actor.
Analyzed Indicators - Lists all analyzed IoCs for which campaign detection is possible.
Countermeasures - A set of effective countermeasures (if available) to remediate the attack.
Endpoint (analyzed indicators only) - Displays the number of campaign sightings or events based on their resolution within the organization.
Unresolved - A number of detections and devices where a campaign sighting or event has not been resolved by Trellix ENS.
Resolved - A number of detections and devices where Trellix ENS has resolved a campaign sighting or event.
Network - Displays the number of campaign sightings or events based on the IOC category and resolution within the organization.
Product - NSP
IOC category - View the category of the detection: URL, IP or Domain.
Unresolved detections - A number of detections and devices where a campaign sighting or event has not been resolved by Trellix IPS.
Resolved detections - A number of detections and devices where Trellix IPS has resolved a campaign sighting or event.
Content Package - View the number of devices based on their current AMCore Content (for Windows and Linux operating systems) version. Devices in red have insufficient coverage for the campaign. You can click How to update AMCore Content? to view details and links with instructions to improve your protection against this campaign.
Click View Details. For more information about the campaign, see Campaign Overview.