SmartVision appliances use two methods to distribute the network alerts they generate: using the Trellix event notification services and, in a Helix environment, informing Helix by using JSON objects.
Trellix event notification services
Trellix event notification services provide four methods for distributing alert notifications:
SMTP email—Notifications are sent to an SMTP server that then forwards the notifications to one or more email recipients.
HTTP Web transmissions―Notifications are posted to one or more Web servers.
Remote system log messages―Notifications are written to one or more remote system log servers.
SNMP trap messages―Notifications are sent to one or more SNMP servers.
Before an appliance can use Trellix event notification service to send alerts, the individual notification methods must be configured. For each notification method, you can use the Web UI or CLI to specify default settings, such as delivery frequency and format, at the global level. You can override global-level notification settings for individual servers and recipients, and you can customized preferences for individual event types.
Informing Helix
When a network event is detected by a SmartVision appliance in a Helix environment, the appliance makes the alert information available to Helix. The appliance sends Helix a JSON object that contains key information about the alert and a link to detailed information about the alert. The JSON object includes the version of the SmartVision rules file used to detect the event. To view the current SmartVisionrules file version, use the show smartvision config command.
A standalone SmartVision appliance sends the JSON object directly to Helix. A managed SmartVisionappliance sends the JSON object to Helix through the Helix Central Management System appliance.
This feature is always enabled on all Network Security appliances, including SmartVision appliances ( SmartVisionEdition appliances, SmartVision SmartVision-enabled Network Security sensors, and SmartVision-enabled integrated appliances