A standard (or integrated) appliance performs both monitoring and analysis. Trellix Distributed Network Security separates these two functions. Appliances that function as sensors extract objects and URLs from the traffic they monitor, and send submissions to an IVX cluster for inspection and analysis. A sensor and an integrated appliance have identical features and detection efficacy.
An appliance running in MVX hybrid mode can send submissions to an IVX cluster, but only when a predefined capacity threshold is reached. This offloads the analysis function from the appliance to the IVX cluster, which prevents delays and reduced efficacy when volume and other processing demands are high. When the capacity falls below this threshold, the appliance resumes sending submissions to its on-board analysis engine.
Sensors can be managed by the Central Management System appliance that manages the IVX cluster or by another Central Management System appliance. The sensors can also be standalone appliances that are not managed by a Central Management System appliance.
Hybrid appliances must be managed by the Central Management appliance that manages the IVX cluster. They cannot be standalone appliances.
The IVX cluster contains compute nodes, which are Intelligent Virtual Execution - Server Series appliances with MVX analysis engines. One or two compute nodes are designated as brokers. The brokers receive the submissions from the sensors and manage them in a queue that is distributed across the brokers in the cluster. The compute nodes pull submissions from the queue, perform the analysis, and send the verdict to the sensors through the brokers.
The sensors generate alerts based on the verdict. A managed sensor sends the alerts to its managing Central Management appliance, which aggregates the alerts and displays them on a single interface. A standalone sensor displays its own alerts.