A standard (or integrated) appliance performs both monitoring and analysis. Trellix Distributed Network Security separates these two functions. Appliances that function as sensors extract objects and URLs from the traffic they monitor, and send submissions to an IVX cluster for inspection and analysis. A sensor and an integrated appliance have identical features and detection efficacy.
The sensors can be managed by a Central Management System appliance or can be standalone appliances that are not managed by a Central Management System appliance.
The IVX cluster is hosted in the FireEye public cloud. The cluster receives the submissions from the sensors, performs the analysis, and sends the verdict to the sensors.
The sensors generate alerts based on the verdict. A managed sensor sends the alerts to its managing Central Management System appliance, which aggregates the alerts and displays them on a single interface. A standalone sensor displays its own alerts.
Before a sensor can connect with the Cloud MVX service, it must authenticate with the cloud enrollment service. The enrollment service validates the sensor's DTI credentials and appliance ID, and verifies that the sensor has an active license for the Cloud MVX service. If the sensor passes the validation checks, it is automatically enrolled and connected to the cloud broker. The connection is on-demand; it persists as long as the sensor is sending submissions to the IVX cluster. The connection is dropped when all submissions are completed, and is re-established when submissions resume.