The Central Management System appliance correlates Endpoint Security (HX) alerts with managed appliance alerts and creates badges for the appropriate alerts. Correlated Network Security alerts may have Endpoint Compromised, Endpoint Contained, and Containment Requested badges. Correlated Email Security — Server alerts may have a Related Endpoint badge.
Endpoints Compromised, Related Endpoints, and Endpoints Contained links appear on the Central Management System Dashboard What's Happening panel if there are alerts with the associated badges. Click a link to view the Alerts page with the list of alerts labeled with the associated badge.
If available, you can download triage collections from the Central Management System for alerts that have endpoints that are compromised. Click the Endpoint Compromised badge or Endpoints Compromised link, expand an alert and click the Download package link.
For details about how a managed appliance alert becomes an Endpoint Security (HX) alert and a Central Management System badge, see the Endpoint Security (HX) System Administration Guide.
For details on endpoint containment and triage collections, see the Endpoint Security (HX) Server User Guide.