A standard (or integrated) appliance performs both monitoring and analysis. Trellix Distributed Network Security separates these two functions. Appliances that function as sensors extract objects and URLs from the traffic they monitor, and send submissions to an IVX cluster for inspection and analysis. A sensor and an integrated appliance have identical features and detection efficacy.
An appliance running in MVX hybrid mode can send submissions to an IVX cluster, but only when a predefined capacity threshold is reached. This offloads the analysis function from the appliance to the IVX cluster, which prevents delays and reduced efficacy when volume and other processing demands are high. When the capacity falls below this threshold, the appliance resumes sending submissions to its on-board analysis engine.
Sensors can be managed by the Central Management System appliance that manages the IVX cluster or by another Central Management System appliance. The sensors can also be standalone appliances that are not managed by a Central Management System appliance.
Hybrid appliances must be managed by the Central Management System appliance that manages the IVX cluster. They cannot be standalone appliances.
The IVX cluster contains compute nodes, which are Intelligent Virtual Execution - Server appliances with MVX analysis engines. Compute nodes are designated as brokers. The brokers receive the submissions from the sensors and manage them in a queue that is distributed across the brokers in the cluster. The compute nodes pull submissions from the queue, perform the analysis, and send the verdict to the sensors through the brokers.
The sensors generate alerts based on the verdict. A managed sensor sends the alerts to its managing Central Management System appliance, which aggregates the alerts and displays them on a single interface. A standalone sensor displays its own alerts.
For a list of the appliances that can function as sensors or hybrid appliances and for deployment details, see the Distributed Network Security IVX Smart Grid Guide.
Auto Enable/Disable of Broker role in MVX Cluster operations
From 11.x, Intelligent Virtual Execution - Server system now automatically enables or disables the broker role when a user creates or deletes a cluster through CLI. This simplifies workflows, reduces manual steps, and minimizes configuration errors during cluster lifecycle management.
CLI command to create a Cluster
mvx cluster <cluster-name>
This automatically enables the broker once the node is ready.
CLI command to delete a Cluster
no mvx cluster <cluster-name>
This automatically disables the broker before deleting the cluster.