A sensor has the same detection features and requires the same configuration as an integrated appliance, with the exception of guest images, YARA rules, and static analysis tools.
Important
Do not configure YARA rules and static analysis tools using the File Protect appliance settings. They are configured on and managed by the Virtual Execution appliances (nodes).
Hybrid appliances require the same configuration as integrated appliances, because they operate as integrated appliances until their capacity reaches the predefined threshold for sending submissions to an IVX cluster.
A compute node or broker requires little configuration:
The values you define and the default values you accept in the configuration wizard during the initial configuration are sufficient to deploy the Virtual Execution appliance in your network and to enable it to function as a broker or compute node.
Guest images are pre-installed on the Intelligent Virtual Execution - Server appliance; the Central Management Web UI warns you when they are out-of-date and provides an easy way to update them.
Static analysis tools are enabled by default.
Trellix provides a set of YARA rules. You can define and upload custom YARA rules on a Intelligent Virtual Execution - Server appliance. The "Write changes to group" feature in the Central Management Web UI allows you to apply the rules to all brokers and compute nodes at once.