A metaclass is simply a generic class name that refers to events from one or more actual classes in Trellix Helix. Metaclasses allow you to refer to specific types of events without knowing in which class they actually exist.
For example, if you have both Bluecoat HTTP proxies and a Palo Alto Networks firewall with HTTP inspection enabled, your event data may have classes called bluecoat and palo_alto_http. Both contain similar data (that is, logs of users browsing websites on the Internet). You can search either or both of these classes directly, but then you must remember to use a query such as:
class=bluecoat OR class=palo_alto_http
Instead you can use the metaclass called http_proxy, which can reference events from both classes. In other words, the following search:
metaclass=http_proxy
is the equivalent of the following search:
class=bluecoat OR class=palo_alto_http