A standard (or integrated) appliance performs both monitoring and analysis. Trellix Distributed Network Security separates these two functions. Appliances that function as sensors extract objects and URLs from the traffic they monitor, and send submissions to an MVX cluster for inspection and analysis. A sensor and an integrated appliance have identical features and detection efficacy.
An appliance running in MVX hybrid mode can send submissions to an MVX cluster, but only when a predefined capacity threshold is reached. This offloads the analysis function from the appliance to the MVX cluster, which prevents delays and reduced efficacy when volume and other processing demands are high. When the capacity falls below this threshold, the appliance resumes sending submissions to its on-board analysis engine.
Sensors can be managed by the Central Management System appliance that manages the MVX cluster or by another Central Management System appliance. The sensors can also be standalone appliances that are not managed by a Central Management System appliance.
Hybrid appliances must be managed by the Central Management System appliance that manages the MVX cluster. They cannot be standalone appliances.
The MVX cluster contains compute nodes, which are Intelligent Virtual Execution - Server appliances with MVX analysis engines. Compute nodes are designated as brokers. The brokers receive the submissions from the sensors and manage them in a queue that is distributed across the brokers in the cluster. The compute nodes pull submissions from the queue, perform the analysis, and send the verdict to the sensors through the brokers.
The sensors generate alerts based on the verdict. A managed sensor sends the alerts to its managing Central Management System appliance, which aggregates the alerts and displays them on a single interface. A standalone sensor displays its own alerts.
For a list of the appliances that can function as sensors or hybrid appliances and for deployment details, see the MVX Smart Grid Guide.